Capability map
Nothing here is a package. Each is a starting point for a scope built around one organisation’s systems, obligations and deadlines — which is why there are no prices on this page, and why the first step is always a conversation.
Systems designed for one organisation rather than configured from a template. Where the thing you need does not exist yet.
The work that starts when off-the-shelf software stops fitting: an operations platform shaped around how your business actually runs, a marketplace with its own matching and settlement logic, an integration layer between systems that were never meant to speak. Architected to be handed over, not to require us permanently.
What you end up holding
Interface work for organisations with more than one product and more than one team building them. A design system with real component contracts, accessibility built into the primitives rather than audited afterwards, and documentation a new engineer can act on without asking a designer.
What you end up holding
Moving analytics out of spreadsheets and prototypes and into systems people can rely on: instrumented pipelines, a warehouse with defined ownership, models with monitoring and a rollback path. The emphasis is on what happens on the worst day, because that is when a decision system is actually tested.
What you end up holding
Making an existing system survivable. Load and failure testing against real traffic shapes, observability that answers questions rather than producing dashboards, runbooks written before the incident, and a cloud bill examined line by line — which in our experience is where the fastest uncontroversial savings are.
What you end up holding
The layer between a language model and something an organisation can depend on. Most of this work is plumbing, evaluation and governance rather than prompting.
The context layer an organisation needs before any of this is useful: documents, tickets, code and operational data made retrievable with permissions intact, then agents given tools that reach the systems where work actually happens. Built with evaluation from the first week, because an agent without a test suite is a demo.
Model Context Protocol servers and equivalent tool layers over your own systems — CRM, ERP, ticketing, internal APIs — so an assistant can read and act inside them under real authorisation rather than through copy and paste. Scoped, audited access is the whole engineering problem here, and it is where most of the work goes.
Almost everyone shipping an agent is testing it the way they hope it will be used. This is the opposite: prompt injection, tool misuse, data exfiltration through retrieval, jailbreaks against your specific system prompt, and the failure modes that only appear under adversarial load. Delivered as findings with reproductions, then as a regression suite you keep.
Search is no longer the only way a buyer finds you. Generative engine optimisation is the technical work of being retrievable, quotable and correctly attributed inside AI answers — structured data, canonical claims, entity consistency and source authority — carried out alongside conventional technical SEO rather than instead of it.
Everyone is building things that can do work. Almost nobody is building the layer that answers for whether the work was any good. This is that layer.
Bring the application your team generated. We inspect it, fix it, and put our name on it.
Applications built with Cursor, Lovable, v0, Replit and their equivalents now run real workloads, and almost none of them have been reviewed by anyone. We audit security, performance, accessibility and data-protection exposure, remediate what is broken, and certify the result — with a defined warranty behind the certificate rather than a badge and a disclaimer.
Code, infrastructure, licences and IP reviewed before the money moves.
Diligence for transactions that are too small to interest a large consulting firm and far too large to take on trust. What the codebase actually is, what it depends on, which licences travel with it, who holds the accounts, and — increasingly the question that stalls deals — whether the seller can demonstrate they own what they are selling.
Source, keys, credentials and provenance held so the business survives a departure.
Most organisations cannot answer a simple question: if the person who set this up left tomorrow, could we get in? We hold source, credentials and the licence and authorship chain under structured escrow, with defined release conditions — so a resignation, a dispute or a death is an inconvenience rather than an outage.
Obligations with dates attached. This is the work that stops being optional on a specific day, and the calendar is already published.
India's Digital Personal Data Protection regime reaches every organisation that collects a name, a phone number or an email — there is no turnover threshold and no exemption for smaller companies. The work is technical: consent capture and withdrawal that actually propagates, retention and deletion that runs, a breach process that has been rehearsed, and records that survive being asked for.
Automated scanners find perhaps a third of real accessibility defects. The rest are keyboard traps, focus order, live-region behaviour and screen-reader semantics, and they need a person. We audit against WCAG, remediate the code rather than filing tickets, and leave the patterns in your component library so the same defects do not return next quarter.
Harvest-now-decrypt-later is a real threat model for anything with a long confidentiality horizon, and the post-quantum standards are finalised. The useful work today is inventory and agility rather than prediction: knowing every place cryptography is used, how it is configured, and how long a swap would take. Regulated sectors will be asked first.
Pixirain runs a delivery rail — escrowed milestones, assigned accountability, structured deliverables, a platform guarantee. These are the ways another organisation can run work over it.
Agencies and consultancies deliver under their own brand, on our rail, invisibly.
For firms that are capacity-constrained rather than demand-constrained. You keep the client, the brand and the relationship; delivery runs underneath on escrowed milestones with named accountability and a guarantee. The objection to offshore delivery is almost always about recourse rather than skill, and recourse is the part that is already built.
Making services and systems purchasable by software agents, with accountability intact.
The settlement and authorisation rails for autonomous agents became usable in 2026, and they handle discovery, authorisation and payment. None of them handle whether the purchased work was any good. We build the machine-payable surface — priced endpoints, proof of intent, escrowed settlement, verifiable delivery — for organisations that want to be buyable by an agent without giving up recourse.
16 capabilities · 5 practices · one scope at a time
We map what exists, what it has to become, and what would make the project fail. You keep that map whether or not you engage us.