Per-Client Production Environments for Regulated ISVs by Dedicatted

Regulated software companies selling to enterprises and regulators: regulatory reporting and financial data platforms, fintech and regtech providers, and security and risk platforms whose clients' data is bound to a jurisdiction. The buyer is the VP Engineering or Head of Platform, with the client onboarding lead who owns the go-live date, at mid-market and enterprise ISVs in Canada, the United States and Europe.

Each new enterprise client or regulator brings the same three demands: an isolated environment with its own residency, networking and audit controls; the client's existing pipelines re-architected to feed it by a contractual date; and a procurement package (security questionnaire, SSO, SLA) a self-serve platform was never built to answer. Built by hand, each onboarding is a bespoke project that drifts from the last, absorbs the platform team and risks the go-live date.

Blueprint and isolation design. Account model (an account per client or jurisdiction under AWS Organizations), network design with Amazon VPC, AWS Transit Gateway and AWS PrivateLink, an AWS KMS key hierarchy with per-tenant keys, Amazon Cognito SAML and OIDC federation with the client's identity provider, residency and audit controls, and a control map to the client's security questionnaire.

Per-client or per-jurisdiction environment. Deployed from your Terraform or AWS CloudFormation code on Amazon EKS, with Amazon RDS or Aurora PostgreSQL, Amazon MSK and Amazon MemoryDB where your platform uses them, AWS CloudTrail trails in Amazon S3 with Object Lock, AWS Config conformance packs, AWS Backup and Amazon CloudWatch.

Client pipeline migration wave. The client's Azure or on-premises pipelines re-architected onto your platform with AWS Database Migration Service and AWS Application Migration Service, a parallel run, a rehearsed cutover with rollback, go-live on the contractual date and hypercare.

Enterprise readiness evidence pack. Questionnaire answers, isolation and encryption attestations, AWS Config and Security Hub control reports, RTO and RPO per tier, and the SLA schedule.

Run option. Monthly operation under Dedicatted Cloud & Platform Managed Services, plus an optional add-on for Amazon Bedrock inference with Guardrails, reached privately from a client's environment.

Engagements start with about two weeks of design; further environments, Regions and waves are repeat units.

Amazon EKS, Amazon VPC, AWS Transit Gateway, AWS PrivateLink, Amazon Cognito, AWS KMS, Amazon RDS for PostgreSQL, Amazon Aurora PostgreSQL, Amazon MSK, Amazon MemoryDB, AWS Database Migration Service, AWS Application Migration Service, AWS CloudTrail, Amazon S3, AWS Config, AWS Security Hub, AWS Organizations, AWS Backup, Amazon CloudWatch, Amazon Route 53 and, optionally, Amazon Bedrock.

• A new client, regulator or AWS Region becomes a deployment from the same infrastructure as code, so environments do not drift apart.
• Tenant isolation you can show: separate accounts and VPCs, per-tenant keys, private connectivity and tamper-evident audit trails, mapped to the client's questionnaire.
• Enterprise procurement unblocked: SSO with the client's identity provider, documented RTO and RPO, a support SLA and a named operations team.
• The client's pipelines run on your platform by the contractual date, after a rehearsed cutover.

Since 2025 Dedicatted has delivered this pattern repeatedly for a US-regulated financial reporting SaaS platform: production environments on Amazon EKS for new regulatory jurisdictions, one of them in a new AWS Region; dedicated environments for new enterprise clients, including banks; and the migration of newly signed clients' Azure and on-premises pipelines onto the platform with Amazon MSK, Amazon EKS and AWS Application Migration Service. Dedicatted also runs managed operations and support for that platform.

Dedicatted is an AWS Premier Tier Services Partner in Toronto and Montreal, Canada, the first Canadian partner with both AWS AI Competencies and the only Canadian AWS Partner with the AWS Digital Sovereignty Services Competency. We deliver across Canada, the United States and Europe in English and French, with Canadian data residency in AWS Canada (Central) and Canada West (Calgary). Designs take account of OSFI B-13, Quebec Law 25 and the GDPR where they apply.

This service provisions resources in your AWS account that AWS bills to you: EKS clusters and nodes; RDS or Aurora, MSK and MemoryDB clusters; VPC endpoints and Transit Gateway attachments; KMS keys; CloudTrail and S3 storage; AWS Config and Security Hub evaluations; AWS Backup storage; migration replication servers; and Amazon Bedrock usage where the add-on is chosen. We work through a cross-account IAM role you create, removed at handover unless the monthly service continues.