Set up for the system
you’re running
We build software with Google Cloud services, with projects set up for each system, access without key files and a line around sensitive data, so every path to your data is one you chose.
Thanks, we’ll be in touch soon.
{{ heroStatus }}
You’re in good company
A few of the companies we’ve worked with.
When the first settings stay on
With Google Cloud services, everything a system runs on sits in projects. A project holds a system’s services, data and settings together, and projects can be grouped in folders under one organization. A new project is quick to start because some of it can come ready, such as an automatically created default network, with firewall rules, the rules that say what traffic may come in, already letting some kinds of traffic in.
Those first settings suit a first try more than a live system. Programs act through identities, the accounts a program or a person works as, and depending on how your organization is set up, the default service accounts some services create in a project may be given the Editor role, which can read and change everything in that project.
Organizations created since May 3, 2024 start with stricter settings: policies that stop that grant, and the creating of new key files, are on from the start. Projects in older organizations keep the settings they had, and turning the policy on later doesn’t take the Editor role from the accounts that already have it.
And key files, the downloaded keys a program can sign in with, often stay in use long after the first set-up, in pipelines and on servers. A key made that way has no expiry date by default and works until someone deletes it.
A project on its first settings still runs. The work is choosing each setting for the system it serves, starting with whichever matters most for yours.
What we build
Each setting is chosen for the system it serves and kept in code, so a change goes through review and CI before it reaches a live project.
Services that run while there’s work
Cloud Run services, scaled by default to the instances, the running copies of a service, that their requests need, and to none when no requests come in. Each is deployed from CI, with tests written alongside the code.
Projects set up from the start
Each system in projects of its own, grouped in folders, with the organization’s policies and each project’s starting settings chosen before its first service goes live.
Access without key files
Each system with an identity of its own and only the roles its work needs, and pipelines that run outside your Google Cloud projects given access through Workload Identity Federation in place of a key file.
A line around sensitive data
A perimeter with VPC Service Controls, a line drawn around the projects that hold sensitive data so it can’t be copied to a project outside it, tried in dry-run mode before it’s enforced.
Data with owners and limits
BigQuery datasets and Cloud SQL databases planned with the teams that own them, and daily query limits set for each project and each person.
Costs with owners
A budget for each project, the spending planned for it, with alerts to the team that owns it as costs near the plan, and the Cloud Billing reports read with you.
Everything in code, checked on every change
Projects, policies, networks and services defined in code, and each change checked in CI before it goes live.
Systems moved across a part at a time
Systems moved onto Google Cloud services one part at a time, each part tried on a copy first, with the old system running until the new part does its work.
AI features in your own apps
Apps that call Gemini models through Gemini Enterprise Agent Platform, under the same access and limits as the rest of the system.
- Apps with their sign-in, data and files on the Firebase platform:App development
- CI, delivery and operations, on any platform:Cloud, DevOps & Security
- Shared templates and the internal platforms your teams build on:Platform Engineering
- Data platforms and pipelines:Data EngineeringData Platforms & MLOps
- A security review of what you run:Application Security
- AI features, built into your products:AI Services
- Everything in code, with a plan read before each change:Infrastructure as code
- Developers in your own team:Developers for your team
A line around the data, as well as a lock
Permissions decide who may read or copy data. A perimeter, drawn with VPC Service Controls around the projects that hold it, decides where the data can go: inside the line, work goes on as before, and data can’t be copied to a project outside it, unless a rule you wrote lets it through.
So having permission to copy a table isn’t enough to copy it out of the line. The line works for the Google Cloud services it supports, alongside permissions and never in place of them.
A perimeter can run in dry-run mode first: it records each request it would have stopped, and stops nothing.
So we draw the line around the projects that hold sensitive data, run it in dry-run mode, read what it would have stopped, and only then enforce it.
Press the underlined words to change where the table goes.
Inside the line, at Quarrington Insurance
An analyst who may copy the customer table copies it to .
{{ pmNow }}{{ pmAns }}
Preview to try, generally available to build on
Google Cloud products and features each carry a launch stage. At Preview, one is ready for customers to test, but may not be complete, comes with no service level agreement or technical support commitments and, unless Google says otherwise, is meant for test environments only. Google’s terms for these early offerings also let them change or end at any time, without notice.
At General Availability, a product is open to all customers, ready for production use and covered by a Google Cloud service level agreement where one applies.
Deprecated features are scheduled to be shut down and removed. For the products the Google Cloud terms of service list, its section on discontinuing services sets the notice before that happens, and each product’s deprecations page and release notes give the dates.
Names change too. The Vertex AI services are now part of Gemini Enterprise Agent Platform, and the Vertex AI Extensions service is set to shut down after November 26, 2026, with Gemini Enterprise Agent Platform as the way forward.
So we try Preview features on a branch, build live systems on generally available ones, and keep a list of what each system uses, checked against the release notes.
Start with what each project lets in
The review covers the organization, its folders and projects, and which project does which job; the organization policies in force, and which projects still run on their first settings; networks: the default network where it remains, firewall rules and the order they apply in, and which paths between services are open; identities: the service accounts, the roles each holds, and key files and where they’re used; pipelines that run outside your Google Cloud projects, and how they get their access; sensitive data, where it lives and whether a perimeter is around it; audit logs, and what they record; BigQuery datasets and Cloud SQL databases, their owners and limits, and the queries that read the most; budgets and alerts; products in Preview, and any renames or shutdowns that touch what you use; and what’s defined in code, and what was set up by hand.
The first step is one of these, each tried on a branch or a copy first: one pipeline moved from a key file to Workload Identity Federation; the default network replaced in one project, with rules written for what runs there; a perimeter around one project in dry-run mode, with what it would stop read before it’s enforced; a budget and alerts for each project; or one service moved to a Cloud Run service.
What you receive is a written review and a proposal for that first step.
Questions worth asking
Is it the right fit for what we run?
Often, where your data, your apps or your AI features fit Google Cloud services well, though it depends on the system and the team. We start from what the system does and what your team already knows, and we’ll tell you when it isn’t the best fit.
Can you work with the projects we already have?
Yes. We start with a review of what you have, then change one project at a time, each change tried on a copy first, and the projects stay yours throughout.
How do you keep access in hand without key files?
Each system works as an identity of its own, with only the roles its work needs, and pipelines that run outside your Google Cloud projects get their access through Workload Identity Federation instead of a key file. Where a key file still has to exist, it’s the exception, with an owner who knows where it’s used.
What does a line around our data change for the team?
Permissions still decide who may read or copy the data. The line decides where it can go: inside it, work goes on as before, and a copy to a project outside it is stopped unless a rule you wrote lets it through. We try it in dry-run mode first, which records what it would stop without stopping it, for the services it supports.
What will it cost to run?
That depends on what runs and how much your queries read: with on-demand pricing, each BigQuery query is charged for the bytes it processes. We set a budget and alerts for each project and daily query limits for each project and person, and go through the costs with you.
Can you work on our data and its queries?
Yes. We plan BigQuery datasets and Cloud SQL databases with the teams that own them, look at what the heaviest queries read, and set limits, the way our data engineering work does elsewhere.
Can our apps use AI models?
Yes. Apps can call Gemini models through Gemini Enterprise Agent Platform, under the same access and limits as the rest of the system, each feature reaching only the data it needs.
Where does our app’s back end fit?
If its sign-in, data and files live on the Firebase platform, our page for apps on it covers them, and this page covers the systems around it.
What happens when a product we use is renamed or retired?
For the products Google’s terms list, a shutdown comes with notice, and each product’s deprecations page and release notes give the dates. We keep a list of what each system uses, check it against the release notes, and move each part on a branch before its date.
What does it cost to work with you?
It depends on the work and where you’d like to begin. Before any work starts, you get a written proposal with the scope, the price or rate, and how you pay.
Can AI coding assistants work on our code?
Yes, as one way code gets written here. Every change an assistant drafts, to the app or to the code that defines your projects, is tested and reviewed by a person before it reaches a live project.
Can we hire developers for our own team?
Yes. Within 48 hours of your request, we introduce developers for Google Cloud services who work in your time zone, and you meet them before choosing who joins.
Google Cloud, BigQuery, Cloud Run, Firebase and Gemini are trademarks of Google LLC, and the other Google product names on this page may be too. Webair is independent of Google, and isn’t sponsored by, endorsed by or affiliated with it.
Let’s build it better
Tell us how your Google Cloud projects are set up and what they hold, and we’ll suggest where to begin, in a short call.
Thanks, we’ll be in touch soon.
{{ ctaStatus }}