Engineering choices judged at six in the morning

Our customers do not experience availability as a monthly average. They experience it at 6.20 on a Tuesday, when a crane booking, a concrete delivery and forty workers depend on a sign-in screen. I therefore set objectives by time of day: the weekday hours from six to eight carry a stricter availability objective and a shorter recovery objective than the afternoon. Releases avoid those hours, alerts start at 5.30, and failover rehearsals now happen on weekday mornings with customers informed. I also insist that site managers have a paper fallback they have actually practised, because no engineering design removes every failure. Our reporting to the board shows morning availability separately, so directors see the figure that customers feel rather than one flattered by quiet nights and weekends.

Three state infrastructure agencies and about forty builders have contracts requiring that their data is stored and processed in Australia, including backups and support tools. I keep a register that maps each obligation to the systems involved, from the main database to error reporting and email delivery. Several of our early suppliers sent diagnostic data overseas without anyone noticing, so we replaced two of them in 2023. Our general counsel interprets the contracts; my team establishes the facts about where data actually flows. When a cheaper architecture conflicts with a commitment, I state that conflict in the decision paper rather than let the price comparison speak alone. A board cannot weigh a residency promise that it has never been shown, and a buyer cannot rely on one we have not verified.

We hold personal details for tens of thousands of construction workers whose employers chose our software for them. That makes separation between customers the first security property I care about. Every query now carries an account context that the database itself enforces, uploaded documents are encrypted with keys held per customer, and each release runs automated attempts to cross between accounts. For our own systems we work towards the Essential Eight mitigation strategies published by Australia's Signals Directorate, and I report our maturity honestly, including where we fall short. I also keep incident roles clear: engineers establish what happened, our general counsel advises on obligations under the Privacy Act, and the chief executive decides what we tell customers and when we tell them.

Cloud costs used to arrive as a monthly surprise. I now report them per active site and per thousand sign-ins, because those units connect spending to the service a builder buys. Photographs were the largest driver: every diary entry and defect record carries images, and builders keep projects for years after handover in case a defect claim arrives. We moved images untouched for two years to archive storage, resized our compute and committed to a baseline of capacity in return for lower rates. Each product team now estimates the storage and compute cost of a feature in its design note. Those estimates are often wrong, but the conversation they start is cheaper than discovering the cost a quarter later.

With fifty-eight people, every rebuild competes directly with features a customer is waiting for. I protect about a fifth of each quarter for maintenance and debt reduction, and I publish a short register of the debts we are carrying, the risk each creates and the date we intend to address it. The permits module is the largest item: it was written in 2015 for a single state's paperwork and now serves five. We deferred its rebuild by two quarters to fund the Melbourne standby, and I told the board so at the time. I prefer replacing a component in stages behind a stable interface to a single cutover, because our customers cannot pause a working site for a weekend while we migrate their records.