060 279 5587 info@sitect.co.za 139 Davies Street, Doornfontein, Johannesburg, 2001 Gauteng, SA
Software · Cloud Infrastructure & DevOps

Reliable hosting, predictable deploys, calm pagers.

We design and run the cloud infrastructure your product depends on — AWS Cape Town first, defined in code, with CI/CD that ships safely, monitoring that pages you before customers do, and disaster-recovery that's been actually tested.

From R10k · set-up 1–3 weeks typical AWS af-south-1 · POPIA-friendly
Topology · production All systems normal
CloudflareWAF · CDN
ALBHTTPS · af-south-1
ECS · web3 tasks · healthy
ECS · api3 tasks · healthy
ECS · queue2 tasks · healthy
RDS · PostgresMulti-AZ
ElastiCacheRedis · cluster
S3Media · backups
CloudWatchLogs · metrics
Healthy node Active traffic 9 nodes · 1 region · 99.97% uptime · 30d
Observability · live SLO 99.9%
Request rate
1.42k req/min
+8.4% · last hour
Error rate
0.02%
Well under SLO
p95 latency
142ms
Inside budget · 200ms
CPU usage
62%
Auto-scale ready
Uptime · 30d99.97%
Deploys this week14
Mean time to deploy4m 12s
Deploy succeeded · web service · v2026.05.17-1
2 min ago
Auto-scale event · web · 2 → 3 tasks
14 min ago
Backup verified · RDS daily · 4.2 GB
3 hr ago
Where infrastructure breaks businesses

The 4 patterns that turn hosting into a liability

Hosting is invisible — until it isn't. By the time you notice it's a problem, the cost has been compounding for months. Here's how it goes.

Pattern 01

"It runs on Vusi's laptop and a Hetzner droplet."

Nobody knows quite how it got configured. There's no infrastructure-as-code, no documented runbook, no second person who knows where the keys live. The day Vusi goes on leave, every deploy becomes high-risk theatre.

What it costs: change paralysis, key-person dependency, weekend-call rotations dressed up as "ownership".
Pattern 02

Deploys happen by FTP at 2am on a Sunday.

No CI/CD, no test-gate, no rollback path. So changes get batched, ship rarely, and when they do ship they take down the site for the half-hour it takes to figure out what broke. Every deploy is a hold-your-breath event.

What it costs: slow shipping, scared engineers, customers caught in mid-deploy errors, fragile release weekends.
Pattern 03

You only learn about outages from a customer email.

No monitoring, no alerts, no on-call. The site has been down for 47 minutes before anyone notices. Or worse: the homepage is up but checkout is broken, and the bleed runs for hours before someone happens to test it.

What it costs: lost revenue, lost trust, post-mortems run on "we don't actually know what happened".
Pattern 04

The "backup" is a tarball someone ran in 2024.

You think you're backed up. You're not — at least not in any way you can actually restore. Or the backups exist but nobody has ever tested a restore. The day you need them, you discover none of it works.

What it costs: business-ending risk pretending to be "we'll figure it out when we need to".
Our 6 non-negotiables

The 6 pillars every Sitect infra ships with

Six things that are not optional, ever. They're what separate "running on the cloud" from "production-grade infrastructure that lets you sleep at night".

1. Infrastructure as code

Every resource defined in Terraform. No "click in the console" changes. The infrastructure is reproducible, reviewable, and rollback-able.

  • Terraform with state in S3 + locking
  • PR-reviewed infra changes
  • Multiple environments from one codebase

2. CI/CD pipelines

Every push triggers tests, then a deploy through dev → staging → prod with manual gates. Rollback is one click. Bad deploys never reach customers.

  • GitHub Actions / GitLab CI
  • Blue-green / canary deploys
  • Automated db migrations

3. Observability

Metrics, logs, traces, and SLOs from day one. Sentry for errors, Datadog/Grafana for APM. When something goes wrong, you know first.

  • Per-endpoint p95 + error tracking
  • SLO-driven alerts to on-call
  • Structured JSON logs

4. Security & secrets

Secrets in AWS Secrets Manager (never in env files or repos), WAF on the edge, IAM least-privilege, key rotation enforced. POPIA-friendly from day one.

  • Secrets Manager + rotation
  • Cloudflare WAF + DDoS
  • IAM least-privilege roles

5. Backups & DR

Automated daily backups, retained 30 days, tested quarterly. Documented disaster-recovery runbook with RTO + RPO targets you can actually meet.

  • Daily DB + S3 backups
  • Quarterly restore drills
  • Cross-region replication option

6. Auto-scaling & cost control

Auto-scale on real signals (CPU, queue depth, request rate). Right-sized instances, reserved capacity for baseline, spot for batch. Monthly cost dashboards.

  • Real-signal auto-scaling
  • Reserved / spot mix
  • Cost-by-service dashboard
Cloud platforms

We work on the cloud that fits — not the one we sell

AWS is our default for SA-hosted production workloads. But the right choice depends on your stack, scale, compliance needs, and team. Here's the honest breakdown.

Amazon Web Services

Our default · af-south-1 Cape Town

Most mature SA region (af-south-1), best service breadth, mature Terraform support. Default for production SaaS, e-commerce, and anything compliance-sensitive.

ECS FargateRDSS3CloudFrontSecrets Mgr

Google Cloud Platform

Best when · ML/AI heavy + BigQuery

Strongest data-warehouse story (BigQuery), best managed-Kubernetes (GKE), and great fit for ML workloads. We deploy here when data + AI are the centre of gravity.

Cloud RunBigQueryGKECloud SQL

Microsoft Azure

Best when · M365 / AD integration

When your customers live in the Microsoft ecosystem, when SSO via Entra ID matters, or when on-prem AD integration is a hard requirement. We default here for enterprise sales-led products.

App ServiceAzure SQLEntra IDFunctions

DigitalOcean

Best when · simple stacks + tight budgets

Cleaner UX, predictable pricing, fewer services to choose from. Great for early-stage products, internal tools, and clients who want lower monthly cost than AWS.

App PlatformManaged DBSpaces

Hetzner

Best when · cost-sensitive · EU latency OK

Aggressively cheap dedicated servers + cloud, EU-hosted. Excellent for non-SA-data-resident workloads, internal tools, batch jobs, anywhere a R600/month AWS bill should be R150 instead.

CloudDedicatedObject Storage

Vercel · Netlify · Cloudflare

Best when · static + edge frontends

Pure-frontend deployments (Next.js, Nuxt, Astro). Edge functions, global CDN, zero ops. Almost always paired with a separate AWS/GCP backend.

VercelCloudflareNetlifyEdge
Our default toolchain

The DevOps stack we ship every time

Boring, well-supported, well-documented choices — not the latest shiny thing. You hire us for engineering, not novelty.

Infrastructure

TF
TerraformInfrastructure as code
ECS
ECS FargateContainerised workloads · serverless
RDS
RDS Postgres / MySQLManaged databases · Multi-AZ
EC
ElastiCache RedisCache · queues · sessions
CF
CloudflareCDN · WAF · DNS

CI/CD & deploy

GH
GitHub ActionsDefault CI/CD pipeline
GL
GitLab CIWhen team already on GitLab
DC
DockerContainerise everything
EV
Envoyer / DeployerLaravel zero-downtime deploys
VC
Vercel · NetlifyFrontend & edge

Monitoring & logs

SE
SentryError tracking + alerts
DD
DatadogAPM + dashboards · SaaS
GR
Grafana + PromSelf-hosted alternative
CW
CloudWatchAWS-native logs + metrics
UR
BetterStack · UptimeRobotExternal uptime checks
The deploy pipeline

What "good" looks like when code ships

From `git push` to `200 OK on production` — here's what every deploy goes through on Sitect-built infrastructure. Bad code never reaches your customers.

1. Commit

Branch + PR opened, linked to ticket

GitPR

2. CI checks

Unit + integration + lint + types

TestsLint

3. Review

Code review + preview deploy

PR reviewPreview

4. Staging

Merge → deploy → smoke tests

StagingSmoke

5. Prod canary

5% traffic for 10 min, watched

CanarySLO watch

6. Full rollout

100% · auto-rollback armed

RolloutAuto-rb
What you walk away with

Everything in the handover package

You own the code, the credentials, the dashboards, the runbooks. We design for hand-off — your team or any competent agency should be able to take over.

Terraform infrastructure

Every AWS resource defined in code, env-specific configs, state in S3 with locking, PR-reviewed changes. Bring up a fresh environment with one command.

CI/CD pipelines

GitHub Actions / GitLab CI workflows for tests, build, deploy. Auto-migrate, canary rollout, auto-rollback on SLO breach.

Monitoring dashboards

Sentry, Datadog (or Grafana), CloudWatch — pre-configured dashboards for every service, SLO definitions, alert routing to your on-call.

Runbooks & playbooks

Incident-response runbook, deploy-procedure playbook, common-failures cheat-sheet, on-call rotation template. All in your repo.

Backup & DR tested

Daily automated backups, 30-day retention, cross-region replication, RTO/RPO targets documented and tested with a live restore drill.

Security & secrets

Secrets in AWS Secrets Manager, IAM least-privilege roles, Cloudflare WAF tuned, audit logs to CloudTrail, POPIA data-flow document.

What "wired right" earns

The compounding gains of proper DevOps hygiene

Indicative metrics across SA infrastructure engagements, measured 90 days post-handover. The biggest gains are the ones you don't see — incidents that never happened.

99.97%
Uptime · year 1
Across active workloads
~4 min
Mean time to deploy
Down from 45 min manual
−63%
Cloud bill optimisation
Right-sizing + reserved + spot
0
Lost-restore incidents
Tested backups on every workload
Indicative pricing — ZAR, ex VAT

Three engagement shapes

One-off audits, one-off set-up engagements, and ongoing managed retainers. We can also augment your in-house DevOps engineer on a fractional basis — POA.

Infrastructure Audit

Review existing setup + 90-day roadmap
R5 000 · once-off
5 working days · graded report
  • 60-point infrastructure scorecard
  • Security & compliance review
  • Cost-optimisation recommendations
  • Disaster-recovery readiness check
  • 60-min handover & Q&A
  • Audit fee credits if you sign for set-up
Order an audit

Managed DevOps

Ongoing retainer · we run it for you
R7 000 /mo · ex VAT
3-month minimum · monthly thereafter
  • On-call coverage business hours
  • Weekly patch + dependency updates
  • Monthly cost-optimisation review
  • Quarterly DR restore drill
  • 4h SLA on incidents
  • 8h/mo dev-ops capacity included
Talk to us about Managed
FAQ

The questions we get asked most

Honest answers about cloud choices, AWS lock-in, monthly costs, on-call, and when you don't yet need this work.

Should I be on AWS af-south-1 or elsewhere?
If your customers are in SA and POPIA-driven data residency matters, AWS Cape Town (af-south-1) is the right default — sub-30ms latency to most SA users and SA-resident data. If your customers are global or EU/US-heavy, AWS eu-west-1 or us-east-1 may make sense. We'll tell you honestly during the audit.
Won't this lock me into AWS?
Some, but less than people fear. We deliberately use standard primitives (containers, Postgres, Redis, S3) that have analogues on every cloud, and define everything in Terraform so a hypothetical re-platform is doable. We avoid AWS-only lock-ins like DynamoDB or SQS for primary data — we use them where they're genuinely better, not by default.
What will my monthly cloud bill be?
Highly dependent on traffic, data, and services used. Rough bands for af-south-1: small SaaS / e-commerce R1 200–R3 500/mo, mid-size R4 500–R12 000/mo, busy multi-tenant SaaS R15 000–R40 000+/mo. We forecast in the audit and right-size during set-up. Cost-by-service dashboards mean no surprises.
Do I need on-call coverage?
Depends on what your customers will tolerate when you're down. A B2B SaaS used 9-to-5 can defer alerts to next-business-day if downtime < 4h is acceptable. A consumer e-commerce site or trading-hours-dependent product probably needs after-hours coverage. Our Managed retainer is business-hours by default; 24/7 add-on is POA.
Can you migrate us from our current host?
Yes — about half our set-up engagements are migrations. We plan parallel-run, test thoroughly in staging, run DNS cutover in a low-traffic window with documented rollback. Common sources: shared hosting (Afrihost, Cloudways), Heroku, DigitalOcean, Google Cloud, Azure, bare-metal Hetzner. We don't lose data.
Do I need Kubernetes?
Almost certainly not. We default to ECS Fargate (or DigitalOcean App Platform / Vercel) for workloads up to ~30 services — way simpler, fewer moving parts, less to maintain. We use EKS / GKE for clients with genuine multi-team, multi-region, polyglot needs — usually 50+ engineers. If anyone is recommending K8s for a small team, they're probably wrong.
How do I know my backups actually work?
By restoring them. Every Sitect set-up includes a documented restore drill — we tear down a staging environment and rebuild it from backup as part of handover. Managed retainers run quarterly drills. "We have backups" without a tested restore is the same as not having backups.
What about compliance — SOC2, ISO27001, POPIA?
Our default stack is POPIA-friendly out of the box: SA data residency, encryption at rest, secrets in Secrets Manager, audit logging, customer-data export/delete flows. SOC2 / ISO27001 are bigger commitments — we'll set you up audit-ready (controls in place, evidence collected) but a SOC2 auditor still needs to certify. We've helped clients pass both.

Tell us about your current infrastructure — we'll come back with a teardown.

Share your current setup (or the chaos you're escaping). We'll come back with a 45-min review call, a graded scorecard, and an indicative price for a set-up or managed retainer.