Tech roadmap

From funded startup to enterprise-grade — without a rewrite.

The stack changes in three stages, each triggered by what clients demand rather than by fashion. What never changes is what makes the journey cheap: open data formats, infrastructure as code and provenance on every number from the first commit.

Choose a stage

Team

CTO + 3–5 engineers, 1 scientist; partners for UI build-out

Customers

2–3 design-partner banks or insurers, on sample data

Moves to the next stage when

A paid pilot needs vendor due diligence, or portfolios pass ~100k assets.

The stack, layer by layer

What we run at each stage.

NewUpgraded

Cloud & accounts

New

AWS Singapore (ap-southeast-1)
Separate dev and prod accounts
Infrastructure as code (CDK) from the first commit

Upgraded

Landing zone: security, log-archive, data and workload accounts
Single sign-on with MFA for all staff

Upgraded

Dedicated account per tier-1 client (silo)
Sydney region for Australian clients
Deployable into a client’s own AWS

Data storage

New

S3: COG rasters, Zarr cubes, GeoParquet results
Postgres + PostGIS for assets

Upgraded

Iceberg tables for result history (“as of” queries)
Versioned cubes (Icechunk) and a STAC catalogue
Multi-AZ database

Upgraded

Per-client encryption keys
Write-once audit storage
Cross-region replication and retention policies

Pipelines

New

Python jobs on Fargate
Dagster (open source) as the scheduler
Provenance record written by every job

Upgraded

Dagster partitions and data-quality checks
Step Functions fan-out for large portfolios
OpenLineage events

Upgraded

Highly available orchestration with SLAs
Golden-portfolio regression gate in CI
Formal restatement workflow

Geospatial compute

New

rasterio, xarray, exactextract
DuckDB for analysis
Open hazard layers (WRI, JRC, CMIP6)

Upgraded

AWS Batch on Spot for backfills
Precomputed cubes for on-demand scoring
H3 aggregation

Upgraded

Licensed flood and cyclone models in production
Insurer event sets (Oasis)
Millions of assets per run

Risk & science

New

Hazard sampling with explicit no-data states
Simple damage curves
Methodology v0.1 versioned with the code

Upgraded

Curves per asset class; NGFS scenarios
Validation pack v1
Model registry (MLflow)

Upgraded

Support for independent model validation
Backtesting against observed events
Governed model-change process

AI & LLM

New

Managed models in-region (Bedrock)
RAG prototype over TNFD / ISSB
Evaluations from day one

Upgraded

LLM gateway: logging, redaction, quotas
Tool calling — numbers only from the platform
Eval suite in CI

Upgraded

Disclosure copilot with human review
AI inventory aligned with MAS AIRG
Red-teaming; per-client retrieval isolation

API & integration

New

FastAPI REST
CSV / GeoParquet export

Upgraded

Versioned public API (OpenAPI)
Bulk delivery to client S3; webhooks
Client SSO (SAML / OIDC)

Upgraded

Per-client SLAs and rate limits
Data shares (Snowflake, Databricks)
Private connectivity (PrivateLink)

Web app

New

TanStack Start + MapLibre
Hosted on Cloudflare Workers

Upgraded

Design system; role-based access
Generated report packs

Upgraded

Option to serve from AWS for single-cloud vendor reviews
Accessibility and localisation
Audit trail in the UI

Tenancy

New

Pool: shared infrastructure, tenant ID on every row, Postgres row-level security

Upgraded

Bridge: separate schema, bucket and keys for larger clients

Upgraded

Silo account per tier-1 bank
In-client-cloud package for residency-bound clients

Security & compliance

New

SSO + MFA, least-privilege IAM, secrets manager
Dependency and container scanning
SOC 2 readiness started

Upgraded

SOC 2 Type I, then the Type II observation window (typically 6–12 months)
Independent penetration test
MAS TRM / outsourcing and APRA CPS 234 questionnaires

Upgraded

Annual SOC 2 Type II; ISO/IEC 27001
Tested incident response
Trust portal for due-diligence packs

Reliability

New

CloudWatch + OpenTelemetry traces
Cost tagged per pipeline run

Upgraded

Service-level objectives and alerting
On-call rotation

Upgraded

24/7 cover and a status page
Disaster recovery tested against client recovery targets (e.g. 4-hour RTO for a bank’s critical systems)

What it costs

The bill, line by line — and where every price comes from.

Download the full model (Excel)

S$1.41m

annual run-rate · stage 1 (funded startup)

S$117,296

monthly burn

82%

of cost is people (6 FTE)

S$421.47

non-people cost per 1,000 assets screened

Annual cost by stage (default inputs) · colours as in the tiles below

People

S$1,154,669/yr

Cloud compute

S$1,208/yr

Database

S$1,353/yr

Storage & network

S$2,405/yr

AI models

S$329/yr

Security & observability

S$2,288/yr

Tooling

S$4,656/yr

Compliance & audit

S$49,050/yr

Data licences

S$7,665/yr

Office & hiring

S$183,926/yr

Show all 51 line items, formulas and sources

Line item	Quantity	Unit price	Confidence	Per month
Web/API — Fargate ARM vCPU Cloud compute · api_tasks * api_vcpu * hours_month * regions	730 vCPU-hours	USD 0.04source	price list api	S$38
Web/API — Fargate ARM memory Cloud compute · api_tasks * api_gb * hours_month * regions	1,460 GB-hours	USD 0source	price list api	S$8
Orchestrator — Fargate ARM vCPU Cloud compute · orch_tasks * 1 * hours_month	730 vCPU-hours	USD 0.04source	price list api	S$38
Orchestrator — Fargate ARM memory Cloud compute · orch_tasks * 4 * hours_month	2,920 GB-hours	USD 0source	price list api	S$16
Risk batch runs — Fargate Spot ARM vCPU Cloud compute · assets_month * vcpu_s_per_asset / 3600	27.78 vCPU-hours	USD 0.01source	official page	S$0
Risk batch runs — Fargate Spot ARM memory Cloud compute · assets_month * vcpu_s_per_asset / 3600 * gb_per_vcpu	55.56 GB-hours	USD 0source	official page	S$0
PostgreSQL/PostGIS — db.t4g.medium, single-AZ Database · hours_month	730 instance-hours	USD 0.1source	price list api	S$95
Dedicated client databases — db.r7g.large, Multi-AZ Database · silo_clients * hours_month	0 instance-hours	USD 0.57source	price list api	S$0
Database storage — gp3, single-AZ Database · db_storage_gb	100 GB-months	USD 0.14source	price list api	S$18
Object storage — S3 Standard Storage & network · storage_tb * 1000	2,000 GB-months	USD 0.03source	price list api	S$64
Object reads — S3 GET Storage & network · assets_month * reads_per_asset / 1000	2,000 1,000 requests	USD 0source	price list api	S$1
Object writes — S3 PUT Storage & network · assets_month * writes_per_asset / 1000	0.5 1,000 requests	USD 0.01source	price list api	S$0
NAT gateways — hours Storage & network · nat_gateways * hours_month	730 hours	USD 0.06source	price list api	S$55
NAT gateways — data processed Storage & network · nat_gb	200 GB	USD 0.06source	price list api	S$15
Open data into Singapore (US → ap-southeast-1) Storage & network · interregion_gb	500 GB	USD 0.02source	price list api	S$13
Data delivered to clients (internet out) Storage & network · egress_gb	100 GB	USD 0.12source	price list api	S$15
Load balancers — hours Storage & network · albs * hours_month	730 hours	USD 0.03source	price list api	S$24
Load balancers — capacity units Storage & network · albs * lcus * hours_month	730 LCU-hours	USD 0.01source	price list api	S$7
Website hosting — Cloudflare Workers Paid Storage & network · 1	1 account	USD 5source	official page	S$6
Claude Sonnet 5 on Bedrock, in-region Singapore — input AI models · ai_questions_month * tokens_in_per_q / 1000000	6 million tokens	USD 2.2source	price list api	S$17
Claude Sonnet 5 on Bedrock, in-region Singapore — output AI models · ai_questions_month * tokens_out_per_q / 1000000	0.7 million tokens	USD 11source	price list api	S$10
Embeddings — Titan Text Embeddings V2 AI models · embed_mtok	20 million tokens	USD 0.03source	price list api	S$1
Logs — CloudWatch ingestion Security & observability · logs_gb	30 GB	USD 0.7source	price list api	S$27
Encryption keys — KMS Security & observability · kms_keys + silo_clients * 5	3 key-months	USD 1source	price list api	S$4
Secrets Manager Security & observability · secrets	10 secret-months	USD 0.4source	price list api	S$5
Threat detection — GuardDuty runtime monitoring Security & observability · (api_tasks * api_vcpu + orch_tasks) * regions	2 vCPU-months	USD 1.85source	price list api	S$5
Configuration audit — AWS Config Security & observability · config_items	2,000 items	USD 0source	price list api	S$8
Error tracking — Sentry Team Security & observability · 1	1 org	USD 26source	official page	S$33
Monitoring — Grafana Cloud Pro Security & observability · 1	1 org	USD 19source	official page	S$24
Monitoring — metric series Security & observability · metric_series_k	5 thousand series	USD 6.5source	official page	S$42
Code hosting — GitHub Team Tooling · team_size	6 seats	USD 4source	official page	S$31
CI minutes — GitHub Actions (Linux, 2-core) Tooling · ci_minutes	3,000 minutes	USD 0.01source	official page	S$23
Chat — Slack Pro Tooling · team_size	6 seats	USD 7.25source	official page	S$56
Email & docs — Google Workspace Business Standard Tooling · team_size	6 seats	SGD 18.8source	official page	S$113
Issue tracking — Linear Basic Tooling · team_size	6 seats	USD 10source	official page	S$77
Password management — 1Password Business Tooling · team_size	6 seats	USD 8.99source	official page	S$69
Design — Figma Professional Tooling · designers	1 seats	USD 16source	official page	S$20
Compliance automation (Vanta-class), median contract Compliance & audit · 1	1 year	USD 20,000source	indep	S$2,129
SOC 2 readiness consultant (one-off) Compliance & audit · 1	1 engagement	SGD 22,500source	community	S$1,875
Cyber insurance — S$1m limit Compliance & audit · 1	1 policy	SGD 1,000source	official page	S$83
Google Earth Engine — Basic (exploration) Data licences · 1	1 plan	USD 500source	official page	S$639
Co-working — WeWork All Access Office & hiring · team_size	6 members	SGD 374source	official page	S$2,244
Laptops — MacBook Pro 14 (M5 Pro), depreciated Office & hiring · team_size / laptop_months	0.17 laptops	SGD 3,499source	official page	S$583
Recruitment fees on new hires Office & hiring · new_hires_year * recruit_salary_basis	750,000 SGD of first-year salary	0.2source	community	S$12,500
AWS Business Support+ (tiered % of AWS usage) Security & observability · tiered % of AWS usage	34.03 USD	USD 1source	price list api	S$43
CTO People · 1 FTE × base × (1 + on-costs)	1 FTE	SGD 210,000source	official	S$22,050
Senior software engineer (Python backend) People · 1 FTE × base × (1 + on-costs)	1 FTE	SGD 129,960source	indep	S$13,646
Full-stack engineer (TypeScript) People · 1 FTE × base × (1 + on-costs)	1 FTE	SGD 129,960source	indep	S$13,646
Geospatial data engineer (data-engineer band) People · 1 FTE × base × (1 + on-costs)	1 FTE	SGD 128,088source	indep	S$13,449
ML / LLM engineer People · 1 FTE × base × (1 + on-costs)	1 FTE	SGD 167,640source	indep	S$17,602
Climate / hazard scientist (data-scientist band) People · 1 FTE × base × (1 + on-costs)	1 FTE	SGD 150,756source	indep	S$15,829

USD prices convert at S$1.2775 per USD (MAS daily exchange rate (noon), 23 Oct 2026). Quantities are assumptions for an illustrative platform and are all editable in the Excel model.

Never changes

Six decisions on day one that make every later stage an upgrade, not a rewrite.

Open formats

COG, Zarr, GeoParquet, STAC — data never needs migrating out of a vendor format.

Infrastructure as code

Every environment reproducible; new regions and client accounts are a deploy, not a project.

Provenance per output

Run ID, methodology version and input versions on every number, from the first job.

Python ↔ TypeScript contract

A generated API client between the science and the product, enforced in CI.

Licence manifest

Every delivered layer knows which data licences it inherits.

Evaluations for AI

No LLM feature ships without an evaluation set — the suite just grows.

What moves us forward

Clients set the pace, not the roadmap.

When this happensWe do this

A bank asks for a SOC 2 reportStart the Type II observation window immediately; it, not the audit, sets the timeline.

Portfolios pass ~100k assetsMove sampling to partitioned batch fan-out; on-demand reads precomputed cubes only.

First Australian clientStand up the Sydney stack from the same code; APRA CPS 234 / CPS 230 evidence.

Tier-1 bank, material outsourcingSilo account, dedicated keys and audit trail; tested DR against their recovery targets.

Client won’t let data leave its cloudShip the engine and versioned hazard data into their AWS as signed artefacts.

Credit or underwriting use, not just disclosureLicense a commercial flood model; run old and new in parallel and publish a change note.

Deliberately not yet

What I would refuse to build early.

Kubernetes
Fargate and Batch cover the workload until a team exists to run a cluster.
Microservices
One well-structured Python service and one web app until team boundaries demand more.
Multi-region active-active
Multi-AZ plus tested restore meets early client targets at a fraction of the cost.
Training our own foundation models
Use published geospatial models and embeddings; spend on validation instead.
A proprietary risk score
Physical quantities and losses first; scores are a display layer, if ever.

← How I’d build it See the demo →