01
SOC 2 and ISO 27001
Both certifications held, with the audit trail to match.
How it works
In that order, on every engagement. Each layer covers the failure mode of the one next to it — that is the whole design.
The stack
Our own engine walks every repository and records what is actually there — dependencies, entry points, data flows, dead code, and the relationships that cross repository boundaries. Run it twice on the same commit and the map comes back the same, which is what makes it checkable rather than impressive.
Agents apply patterns that have already been verified, across however much code the engagement covers. Because they work from the analysis rather than from a sample of the source, the thing that normally breaks at scale — a confident guess about code the model never read — has nowhere to start.
Engineers who have done this before review what comes out, add the knowledge that was never written down anywhere, and catch the cases no tool can infer. This is the step automated modernization skips, and it is why the output survives contact with the people who own the system.
The engine
The engine is deliberately boring: it reads the code and records what is there. Dependencies, entry points, data flows, dead code, duplication, and the relationships that cross repository boundaries where most tools stop looking.
The point is that you can check it. Run it twice on the same commit and the map comes back the same, which is what makes it usable as ground truth for everything downstream — the agents, the specification and the migration itself.
Security posture
Both certifications held, and a deployment model for whatever your security review requires.
Both certifications held, with the audit trail to match.
Deployable inside your perimeter, including environments with no outbound network.
Point the engagement at your own LLM endpoints. Your code and your inference stay yours.
More than a hundred million lines have been through the analysis engine.
COBOL, JCL and PL/I alongside the modern stack, in one map.
The understanding is refreshed as the codebase moves, not frozen at hand-off.
In their words
They handed us a map of the application and our own analysts checked it line by line. It held up. Every detail the business side had been asking for was in there.
Executive Director
Mainframe platform, top-five US bank
Questions
Start with one codebase
The Assessment is scoped to the smallest piece of the estate that will produce real evidence.
Book a scoping call