Lowp tae content
Leid: SCO-ULSTER
Menu

Hou we rin

We rin the company onwhit we sell.

Oor books, specifications, bill of materials an SBOM, commercial record an email a’ rin on systems we wrate an operate. The platforms we sell rins the companie first. A release that wud brek a set o books breks oors afore onie ither bodie's.

production databases, ilk ane owned by ae service
22
database hosts
4
countries
3
minutes recovery point on the managed fleet, at maist
5

Comparison

Whit we yaise fur ilka concern

We rin the systems ahin thir records oorsels an ir accountable whan a record is wrang.

ConcernUsually bocht inWe rin
The booksA subscription o accountsLedger
Specifications an chynge controlA hosted issue trackerTracker
Bill of materials and SBOMA spreadsheet, if onythingProvenance
The commercial record (CRM)A sales subscription, separate frae the accoontsTrace
Documentation an runbooksA documentation subscriptionKnowledge base
Company emailA mail an office subscriptionWebmail

Aal the systems abune ir biggit, deployed an rinning on databases o their ain. Checked 2026-09-09.

The systems

The sax systems

Oor systems covers the yin concern the piece, signs fowk in throu oor ain identity service an exports data in open formats frae separate databases.

  • The books

    Ledger

    Double-entry accoontin fur siller, credits an stock. It keeps oor beuks an is the service we sell.

    Biggit on
    Auth, PostgreSQL
    Data available as
    CSV and JSON

    Opent Ledger Ledger product page

  • Specifications an chynge control

    Tracker

    Chynges tae oor repositories stert wi a written speceefication an a ticket, an end wi a note o hoo they wur verified.

    Biggit on
    issuedb-cli + EARS, Identity
    Data available as
    JSON, an the ticket database committed in ilka repository

    Opent Tracker

  • Bill of materials and SBOM

    Provenance

    A asset register fur the hardware, an SBOM fur ilka software release we ship, an security findings trackit agin baith.

    Biggit on
    Auth, PostgreSQL
    Data available as
    CycloneDX, SPDX and VEX

    Opent Provenance Provenance product page Sign-in needit

  • The commercial record (CRM)

    Trace

    Customer relationship an revenue records, reckont agin the Ledger.

    Biggit on
    Ledger, Auth
    Data available as
    CSV an JSON

    Opent Trace Trace product page Sign-in needit

  • Documentation an runbooks

    Knowledge base

    Documentation fur the platforms on the haill IT seestem, includin the runbooks fur oor services.

    Biggit on
    Auth, TokenGate
    Data available as
    Markdown an JSON

    Opent Knowledge base Sign-in needit

  • Company email

    Webmail

    A mailbox interface ower oor ain mail platform that keeps companie correspondence on infrastructur we rin.

    Biggit on
    RODMENA Mail API, Identity
    Data available as
    IMAP an mbox

    Opent Webmail Sign-in needit

Inby

The Provenance register

Fower screens fae Provenance: the hardware asset register, the evidence pack pit thegither by control reference, the findings table wi VEX positions, an the component explorer.

Fower screens frae the Provenance bill-o-materials platform. An asset register that leets ilka device the company hauds wi its state, custodian an encryption status. An evidence export pack organised by control reference, wi sections fur Cyber Essentials an fur ISO/IEC 27001:2022 Annex A, ilkane statin whit the register evidences an whit it disna. A findings table that leets vulnerabilities by severity wi their CVSS score, the component an release affected, whether that release is deployed, an its VEX assessment. A component explorer that looks a component up across the hale estate by package URL.
Provenance, oor bill-of-materials platform, in uiss. We biggit it fur the evidence pack. Whan a buyer speirs whit components is in a release an whit advisories affects thaim, we answir wi an export.

Big or buy

Why we bigg oor ain

For maist o thir seestems, buyin ane in wad mak wee sense.

  • We already sell it

    The ledger that keeps oor buiks is yin o the products on this steid. Payin some ither bodie fer an equivalent wad be quare, an runnin it oorsels shaws us whit a release dis tae a workin set o buiks.

  • A register for oor ain estate

    We wanted a component inventory an security findins fer oor ain hale IT-seestems in CycloneDX, SPDX an VEX, unner oor ain haun, an biggit a register tae haud them.

  • We uise staunart foonds

    Ivrythin abuin runs on PostgreSQL, FreeBSD, Python, OpenID Connect an TLS wi public trust. We write the application layer but no oor ain databases, operating systems or cryptography.

Key-person risk

A companie that rins its ain systems haes tae thole whan the fowk wha biggit thaim is awa. Oor repositories haes runbooks, an chynges haes a specification an a ticket that records hoo they wur verified. Database migrations is stored inside the database they manage an bides safe throu a restore wi it. We test restores frae en tae en, an a published topology descrives the hale estate.

How we haud it safe How ye lea Trust Centre

Dependencies

Whit ilka system is biggit on

The raws show a concern, the system that haunles it, an the platforms frae oor ain catalogue that it rins on.

  1. The books

    Ledger

    Auth, PostgreSQL

  2. Specifications an chynge control

    Tracker

    issuedb-cli + EARS, Identity

  3. Bill of materials and SBOM

    Provenance

    Auth, PostgreSQL

  4. The commercial record (CRM)

    Trace

    Ledger, Auth

  5. Documentation an runbooks

    Knowledge base

    Auth, TokenGate

  6. Company email

    Webmail

    RODMENA Mail API, Identity

The richt-haun column comes frae oor ain product catalogue. We use the platforms we sell tae invoice, ship an keep oor records. See hoo the platforms fit thegither.

Arrange a walkthrough

We can tak ye throu ony o thae systems, or send the topology, policies an capability statement fur yer procurement pack.

Get in touch wi us Capability statement (PDF)