Software engineering for regulated and data-heavy businesses.

Legacy system rewritesPlatform consolidationIntegration test harnessesTechnical leadershipMulti-tenant platforms

Recent work: an energy trading platform, a national government system rewrite, a threat detection backend.

Patterns we design with: CDN + cache-aside

Contract engineering and technical leadership for energy, finance, security and public-sector systems, proven by products we run ourselves.

Services

Legacy system rewrites

A system too old to change safely. A full rewrite to React and TypeScript, with pipelines, code review and end-to-end tests in place.

Platform consolidation

Separate applications running one business. One modular .NET monolith with a single role-based access model.

Integration test harnesses

Releases that depend on outside feeds you cannot call from a test. Container-based PostgreSQL tests with faked external feeds, plus architecture guard tests.

Technical leadership

A backend team that needs direction without a permanent hire. Design, code review, standards and mentoring inside your team.

Multi-tenant platforms

A product that serves many customers and must keep their data apart. Self-managed Kubernetes, single sign-on, messaging and tenant data isolation.

Evidence

Moon Cube client

Energy trading and supply company

Merging its trading application into the core energy platform; role-based access design; integration tests against faked market feeds. 2 applications merged into 1 platform, keeping every rule the old system enforced.

Before Moon Cube

Security software company

Backend team lead on a threat detection platform, leading 4 to 6 engineers.

Before Moon Cube

National government programme

Team leader on the rewrite of a legacy system to React 19 and TypeScript, with GitHub pipelines and end-to-end tests.

Before Moon Cube

Online trading platform

Angular development on a platform with millions of users.

Client names are withheld. Named references need written consent.

Products we run

Erevna

Surveys and forms

Katalogos

Online menus

Kefi

Event pages with custom domains

Our own products, live on one multi-tenant platform we operate.

How we run software

The same mechanisms run our own products.

Deploys from pushed commits

A deploy refuses uncommitted or unpushed code; an emergency override is recorded.

A recorded release lock per deploy

Each rollout records its commit and image digest, and one check confirms that what is live matches the record.

Staging rebuilt from git

One command rebuilds staging from git, measured 17 to 21 minutes from empty.

SLO alerts

Latency and error-rate objectives raise alerts on what users would notice.

PII-masked structured logs

JSON logs carry a correlation id, with personal data masked on every sink by default.

Security practices

Practices aligned with ISO/IEC 27001:2022 Annex A

Each control below names the mechanism behind it.

Organizational controls

  • 5.9
    Inventory of assets

    Credentials listed with an owner, a rotation cadence and the last rotation.

  • 5.15
    Access control

    Operations dashboards sit behind single sign-on, limited to one admin group.

  • 5.17
    Authentication information

    A rotation cadence per credential, a reminder 30 days before it is due and a weekly report.

  • 5.30
    ICT readiness for business continuity

    Staging rebuilt from empty, from git, measured at 17 to 21 minutes.

  • 5.34
    Privacy and protection of PII

    Personal data masked in logs by default, and one shared erasure contract.

Technological controls

  • 8.3
    Information access restriction

    A per-tenant query filter on tenant data.

  • 8.5
    Secure authentication

    Token issuer and signing key checked, rotating refresh sessions, fresh login before risky account changes.

  • 8.6
    Capacity management

    A staging deploy is refused when the server has under 3 GiB of free memory.

  • 8.9
    Configuration management

    Staging rebuilt from git with one command.

  • 8.12
    Data leakage prevention

    Secret scanning on commits.

  • 8.15
    Logging

    Structured logs with a correlation id.

  • 8.16
    Monitoring activities

    Alerts on latency and error-rate objectives.

  • 8.19
    Installation of software on operational systems

    Images pinned by digest and checked by a registry audit.

  • 8.24
    Use of cryptography

    Stored secrets in AES-256-GCM, webhooks signed with HMAC-SHA256, automatic TLS, encrypted backups of environment files.

  • 8.26
    Application security requirements

    Rate limits per caller, security headers at ingress, secure host-only session cookies.

  • 8.28
    Secure coding

    A service refuses to start with a weak secret in staging or production.

  • 8.31
    Separation of environments

    A rebuild targets production only with an explicit production switch.

  • 8.32
    Change management

    Deploys from pushed commits, each recorded with its image digest; emergency overrides are logged.

  • 8.33
    Test information

    Tests never write to or log in to a real customer tenant.

Who does the work

Leadership

Demetrios Loizides

Founder & CEO

MEng Mechanical Engineering, First Class, University of Sheffield. Certified Professional Ethical Hacker. Based in Nicosia, Cyprus; works remotely.

Alexander Loizides

Co-founder & Executive Director, Sales & Partnerships

Your first contact at Moon Cube: scopes the engagement, agrees terms and stays with you through delivery.

Book a call