Technology
AWS for Software Companies and Product Teams in Colombia
Production, testing and one developer's experiment all live in the same account, deployments are manual and nobody knows what each customer costs. CloudTing puts your AWS in order: one account per environment, automatic deployments and the cost of everything in plain sight.
What we solve
- Continuous delivery: every change is tested and released with no manual steps
- One account per environment (development, test, production), with rules nobody can skip
- The same container image in every environment, scanned for known flaws
- MFA and role-based access, with no old access keys on laptops
- Cost per environment and per customer, with spending alerts
- Evidence ready for the customer who asks for ISO 27001 or SOC 2
Who it is for
- Software houses that build custom software and deploy for several clients
- Startups that grew fast and never organized their AWS accounts
- Product teams that deploy by hand and are afraid to touch production
- Companies selling software to customers who ask for security evidence
What your customers usually ask for
- If you store personal data belonging to your customers' customers, you are a data processor under Colombia's Law 1581 of 2012, with your own security and confidentiality duties.
- Many customers ask for ISO 27001 or a SOC 2 report. AWS publishes its own reports in AWS Artifact; what runs on top (your application, your access, your data) is yours to prove.
- One account per environment, MFA and audit logs are the controls those questionnaires ask about most. With this architecture they are in place, with evidence.
If you are a startup
- AWS Activate gives startups credits: USD 1,000 in the Founders tier for self-funded companies, and up to USD 200,000 in the Portfolio tier if you are backed by an AWS partner accelerator or fund.
- We help you set up the architecture from the start so the credits do not disappear into forgotten resources.
What we do not do
We do not give legal advice or certify compliance. We put the technical controls in place and leave the evidence (logs, configurations, recovery tests) so your legal team, compliance officer or auditor can confirm what applies to you.
Reference architecture
A typical pattern for a software company: every change in Git starts CodePipeline, CodeBuild compiles and tests, the image is stored in ECR and deployed first to the development accounts and then to production, where it runs on ECS Fargate with Aurora and ElastiCache. Control Tower separates the environments, Inspector scans the images and Cost Explorer shows what each one costs.
How we start
- 1Free review: we look at access, encryption, backups, cost and what evidence exists today
- 2Report with prioritized risks and a proposed AWS architecture
- 3Migration or fixes in stages, without stopping operations
- 4A real recovery test, with RPO and RTO measured
- 5Ongoing operations and support, if you need it
Frequently asked questions
Why one AWS account per environment?
Because a mistake in development must not take production down, and because each environment then has its own permissions and its own cost. AWS Control Tower creates the accounts with shared rules, so nobody has to remember to configure them.
Do we have to leave GitHub or GitLab?
No. CodePipeline connects to the repository you already use. We can also keep deployments in GitHub Actions or GitLab CI if your team already works that way; what matters is that there are no manual steps.
How do we know what each customer costs us?
With tags on resources and separate accounts, Cost Explorer shows spending per environment, project and customer. That lets you adjust prices or spot the customer who costs more than they pay.
Will this help with a large customer's security questionnaire?
Yes. We document the controls (accounts, MFA, encryption, logs, backups) with their evidence, which is what those questionnaires ask about. Formal certification, if you need it, comes from an auditor.
Next step
AWS for Software Companies and Product Teams in Colombia