# Sakura Sky: Cloud, Data, Security

> Sakura Sky engineers the cloud platforms, data foundations, and security that organisations run on, and the same engineers operate what they build.

This is the `llms.txt` index for https://www.sakurasky.com/: a plain-text map of the site's main content for LLM crawlers and AI search products. See https://llmstxt.org for the format.

Last updated: 2026-10-07

## About

Sakura Sky engineers the cloud platforms, data foundations, and security that organisations run on, and the same engineers operate what they build.

- Website: https://www.sakurasky.com/
- Organization: Sakura Sky
- Founded: 2011
- Contact: hello@sakurasky.com
- [Who We Are](https://www.sakurasky.com/who-we-are/): We have engineered cloud, data, and security platforms since 2011, for startups and for large enterprises in regulated industries.
- [Partners](https://www.sakurasky.com/partners/): We partner with the cloud and security providers our clients rely on most. Each one was chosen for what it lets us deliver, and each gives our engineers deeper …
- [Our Customers](https://www.sakurasky.com/our-customers/): Sakura Sky engineers cloud, data, and security platforms for clients in regulated finance, the public sector, media, sport, and industry.

## How the site is organised

- Capabilities are our three practices: Cloud, Data & AI, and Security. Each page lists its core services, what we deliver, and how each part is designed, built, managed, and governed.
- Solutions are frameworks and programmes built on those practices: Accelerate, Enclave, Sentinel, and Praxis.
- Services are the ways to work with us: Professional Services (design and build), Managed Services (run), and Managed GRC Services (governance, risk, and compliance).
- Case studies show past client work. Insights (blog, white papers, and podcasts) is our published writing.

## Capabilities

- [Cloud](https://www.sakurasky.com/cloud/): Cloud platforms on AWS, Google Cloud, and Azure that stay up under load and inside budget: architecture, migration, landing zones in code, and cost control.
- [Data & AI](https://www.sakurasky.com/data/): Data platforms your team can run, trust, and explain to a regulator: pipelines, governance, lineage, and reporting, with AI built on that foundation.
- [Security](https://www.sakurasky.com/security/): Security that starts with your data: data protection, identity for people, services, and agents, a hardened cloud baseline, detection, and AI guardrails.

## Solutions

- [Accelerate](https://www.sakurasky.com/accelerate/): Focused sprints that deliver production-ready cloud, data, or security solutions, jointly built in your environment with senior engineering depth.
- [Enclave](https://www.sakurasky.com/enclave/): Building secure, multi-project cloud organisations with governance and policy enforced at the core, driven by Infrastructure as Code from day one.
- [Sentinel](https://www.sakurasky.com/sentinel/): Governing data and AI security across agentic systems, with runtime monitoring, policy-as-code, drift detection, and verifiable audit trails.
- [Praxis](https://www.sakurasky.com/praxis/): Engineering compliance as running controls and continuous evidence, across regimes such as GDPR, the EU AI Act, the EU Data Act, and MiCA. The productised core of our Managed GRC Services.

## Services

- [Professional Services](https://www.sakurasky.com/professional-services/): Senior cloud, data, and security engineers embedded in your platform work to design, build, and hand over modern enterprise systems your team can run.
- [Managed Services](https://www.sakurasky.com/managed-services/): Running CloudOps, DataOps, MLOps, and security operations as a managed service across cloud, data, and AI platforms, open source and commercial alike. SLAs, observability, continuous improvement.
- [Managed GRC Services](https://www.sakurasky.com/grc/): Managed governance, risk and compliance operated as running controls and continuous evidence, engineered by the team that builds your cloud, data, and security. We cover the regulatory frame you …

## Case studies

- [Migrating a Live Real-Time Communications Platform from AWS to Google Cloud](https://www.sakurasky.com/case-studies/11sight-gcp-migration/) (11Sight): Sakura Sky migrated 11Sight's real-time voice and video platform from AWS to Google Cloud using a compute-first hybrid strategy, with under five minutes of user-facing downtime and zero data loss.
- [Immersive Simulation on Google Cloud](https://www.sakurasky.com/case-studies/orbx-gke-bigtable/) (Orbx): Orbx unified its fractured multi-cloud environment into a 100% cloud-native architecture, achieving a 400% increase in release velocity.
- [Innovation at Speed: How Xapo Bank Achieved 85% GenAI Adoption](https://www.sakurasky.com/case-studies/innovation-at-speed-how-xapo-bank-achieved-genai-adoption-in-just-8-weeks/) (Xapo Bank): Xapo Bank hit 85% GenAI adoption in 8 weeks by turning to Google Gemini and frictionless governance.
- [Standardising Enterprise Scale: A Global API Governance Framework for SSG](https://www.sakurasky.com/case-studies/ssg-api-governance/) (SkillsFuture Singapore (SSG)): Sakura Sky architected a comprehensive API governance framework for SSG to achieve business agility, technical consistency, and industry-leading security.
- [Enabling Player Data for the National Rugby League](https://www.sakurasky.com/case-studies/nrl-game-analytics-data-platform/) (National Rugby League (NRL)): Sakura Sky built a Google Cloud data platform for the National Rugby League that brings player statistics, data, and dashboards together for the league and for each club.
- [Helping Cobalt Move from Heroku to Kubernetes on Google Cloud](https://www.sakurasky.com/case-studies/cobalt-heroku-gcp-migration/) (Cobalt): Sakura Sky and Google ran a three-day workshop series with Cobalt's engineers in Berlin to help Cobalt move its platform from Heroku to Kubernetes on Google Cloud.
- [Starting the San Francisco Giants' Move to Google Cloud](https://www.sakurasky.com/case-studies/sf-giants-sports-data-platform/) (San Francisco Giants): Sakura Sky ran an eight-day Accelerate programme with the San Francisco Giants to start moving their baseball data system, built in the early 2000s, to Google Cloud.
- [Scaling Data Engineering: A Google Cloud Platform Case Study for Craveable Brands](https://www.sakurasky.com/case-studies/our-work-with-craveable-brands-featured-as-a-google-cloud-platform-case-study/) (Craveable Brands): Sakura Sky designed and built the Google Cloud Platform data engineering platform for Craveable Brands, unifying operations across 570+ quick-service restaurants and reducing data costs by 75%.
- [Migrating Carousell from DigitalOcean to Google Cloud](https://www.sakurasky.com/case-studies/carousell-gcp-migration/) (Carousell): Sakura Sky designed and planned Carousell's move from DigitalOcean to Google Cloud in 2016, to make the platform more robust and reliable. The move went live on time and on budget.
- [Bringing Underground Camera Feeds to the Browser for APC Global Systems](https://www.sakurasky.com/case-studies/apc-global-ip-cameras/) (APC Global Systems): Working from Sydney, Sakura Sky built a remote security and monitoring application, delivered over the web, for APC Global Systems' rugged IP cameras at an underground copper operation in Zambia, on …

## White papers

- [The CTO Playbook for Agentic Systems](https://www.sakurasky.com/white-papers/cto-playbook-for-agentic-systems/): A leadership, architecture, and organisational blueprint for AI-native companies: what changes when software reasons, decides, and writes the software that …
- [The Managed Provider Scorecard: Supplier Assurance Under NIS2 and the UK Cyber Security and Resilience Bill](https://www.sakurasky.com/white-papers/managed-provider-scorecard/): A seven-question scorecard for evaluating managed service providers against NIS2 and the UK Cyber Security and Resilience Bill, with side-by-side reporting …
- [The Autonomous Horizon](https://www.sakurasky.com/white-papers/autonomous-horizon/): A strategic white paper for executive teams. The operating model, the architecture, and the leadership decisions that will define the next decade of autonomous …
- [Signal-to-Noise: A Checklist for Evaluating AI Security Tools](https://www.sakurasky.com/white-papers/signal-to-noise-checklist/): A 24-question evaluation framework for security teams procuring AI-driven discovery and remediation tooling. Built around the four-stage funnel from finding to …
- [GATE: The Governed Agent Trust Environment](https://www.sakurasky.com/white-papers/gate/): An open framework defining 20 controls across four layers for governing AI agents in production. The deterministic perimeter that wraps the probabilistic model …
- [The Trustworthy Agentic AI Blueprint](https://www.sakurasky.com/white-papers/trustworthy-agentic-ai-blueprint/): A comprehensive architectural blueprint defining the 16 missing primitives required to move from experimental AI to scalable, production-ready enterprise …
- [The Executive AI Playbook](https://www.sakurasky.com/white-papers/ai-playbook/): A practical leadership framework for governing AI, aligning it to business outcomes, and moving from isolated pilots to durable enterprise impact. Updated June …

## Podcasts

- [Podcasts](https://www.sakurasky.com/podcasts/): Conversations with engineers and practitioners about cloud, data, security, and AI.

## Blog

The full blog index (223 articles) is at https://www.sakurasky.com/blog/, and every page is listed in https://www.sakurasky.com/sitemap.xml.

### Recent posts

- [The Loyalty Backend Is a Data Engineering Problem](https://www.sakurasky.com/blog/qsr-retail-engineering-part-1/), 2026-10-07: Loyalty points are a balance-sheet liability as well as a marketing tool. Following one point through enrolment, earning, accrual, redemption, expiry, and …
- [Patient Data Across Boundaries](https://www.sakurasky.com/blog/pharma-healthcare-engineering-part-3/), 2026-10-06: Which privacy rules govern a multi-country trial's data depends on where each participant enrolled, what they agreed to, and who holds each copy. A set of …
- [Your Lab Notebook Is a Data Product](https://www.sakurasky.com/blog/pharma-healthcare-engineering-part-2/), 2026-10-05: When a licensing partner's diligence team asks for the data behind a preclinical programme, many research organisations find the evidence spread across …
- [Chain of Custody for Trial Data](https://www.sakurasky.com/blog/pharma-healthcare-engineering-part-1/), 2026-10-02: One revised LDL-C result shows where custody of clinical trial data breaks: at the handovers between laboratory, CRO, and sponsor. What 21 CFR Part 11, ICH …
- [Legacy Modernisation That Meets the Audit Bar](https://www.sakurasky.com/blog/government-engineering-part-3/), 2026-10-01: A modernised government system can work perfectly and still leave its auditors short of evidence, because the history the old system kept was lost in the move. …
- [API Governance Done Properly](https://www.sakurasky.com/blog/government-engineering-part-2/), 2026-09-30: Follow one eligibility API through a public sector programme twice: first governed by a review board and a spreadsheet, then by the platform it runs on. Well …
- [Sovereign Cloud Is an Architecture, Not a Procurement](https://www.sakurasky.com/blog/government-engineering-part-1/), 2026-09-29: A sovereign cloud contract usually covers the platform, while keys, identity, data rules, telemetry, and testable contract terms decide whether sovereignty …
- [Audience Telemetry as a Strategic Asset](https://www.sakurasky.com/blog/media-engineering-part-3/), 2026-09-28: Most broadcasters and streamers already collect real-time audience signals, but on the streaming side those signals are usually split between the player, the ad …
- [The CTO Playbook for Agentic Systems](https://www.sakurasky.com/blog/cto-playbook-for-agentic-systems/), 2026-09-18: A 71-page operating manual for engineering leaders whose software has started to reason, decide, and write the software that carries out those decisions. …
- [A 150B MoE on a Developer Laptop: An Upper Bound on What Faster Storage Buys You](https://www.sakurasky.com/blog/expert-streaming-laptop-moe-bottleneck/), 2026-09-16: A 150-billion-parameter mixture-of-experts model streamed from NVMe on an ordinary developer laptop with no usable GPU. Across a 200-token generation the drive …
- [Tollgate v0.2.3: What Long-Context Pricing Does to a Spend Cap](https://www.sakurasky.com/blog/tollgate-v0-2-3/), 2026-09-11: Some models bill the whole request at a higher rate above a size threshold. What that does to a spend cap, and what changed in Tollgate between v0.1.1 and …
- [Evidence That Looks Like Closure: Fuzzing, Fault Injection, and the GATE PARTIAL Checks](https://www.sakurasky.com/blog/gate-closing-partial-checks/), 2026-09-03: gate-fuzz v1.0.0 emits an artefact filed under Check15 that does not close Check15. Working out why is a useful way into which conformance PARTIAL results …
- [Tollgate: Open-Source Hard Limits for LLM Spend](https://www.sakurasky.com/blog/tollgate-launch/), 2026-08-31: Tollgate is an open-source AI gateway and spend-control proxy. It prices every LLM request by token, reserves budget before the call, and refuses over-budget …
- [GATE v1.5 Roadmap](https://www.sakurasky.com/blog/gate-roadmap-v1-5/), 2026-08-31: A preview of the next GATE release: a per-control ISO/IEC 42001 mapping with the asymmetry written down, streaming-aware output validation, an end-to-end ADK …
- [Your System Prompt Is Not a Trust Boundary](https://www.sakurasky.com/blog/system-prompt-is-not-a-trust-boundary/), 2026-08-18: A text-to-SQL agent's system prompt cannot enforce a data rule. sql-guard v0.2.0 puts the rule in a parser instead, and closes eight bypasses found in our own …
- [Protecting the IP in a Generative World](https://www.sakurasky.com/blog/media-engineering-part-2/), 2026-08-18: A studio can find its back catalogue inside a public model's training data and discover it cannot prove, from its own systems, when the work was made or that …
- [GATE v1.4: Output Validation, a Rust Companion, and the Conceptual Layer as OKF](https://www.sakurasky.com/blog/gate-v1-4-release/), 2026-08-18: GATE v1.4 adds C20 output validation at the delivery boundary, formalises break-glass as a signed contract, adds informative mappings to OWASP AISVS, MITRE …
- [Your Managed Providers Are About to Be Regulated. Here Is What to Ask Them.](https://www.sakurasky.com/blog/questions-for-your-managed-provider-nis2-uk-bill/), 2026-08-11: The UK Cyber Security and Resilience Bill and NIS2 both regulate managed service providers directly, wherever they are established. Seven questions every …
- [Launch Day Is Every Day](https://www.sakurasky.com/blog/media-engineering-part-1/), 2026-08-11: Subscription and on-demand media platforms still spend their engineering effort preparing for the scheduled launch, while the traffic that breaks them arrives …
- [Arkhe: An Ontology Language for AI Systems](https://www.sakurasky.com/blog/arkhe-ontology-language-for-ai-systems/), 2026-07-23: Two weeks ago I argued that your ontology is the asset and you should own it in a neutral, versioned form. Arguing is cheap. Arkhe v0.2 is the language I meant: …

### Browse by category

- [Engineering](https://www.sakurasky.com/categories/engineering/): 42 articles
- [News](https://www.sakurasky.com/categories/news/): 72 articles
- [Opinion](https://www.sakurasky.com/categories/opinion/): 106 articles
- [Solutions](https://www.sakurasky.com/categories/solutions/): 3 articles

## Crawling guidance

- All public content under https://www.sakurasky.com/ is allowed for AI crawling, training, and citation. See `/robots.txt`.
- Citations: please cite the canonical URL in each page's `<link rel="canonical">`.
- Publish date, last-modified date, author, and categories are in each article's JSON-LD `Article` block.
- Sitemap: https://www.sakurasky.com/sitemap.xml
- RSS: https://www.sakurasky.com/index.xml