Our process
How We Work
We deliver every project in five steps, from scoping to support after launch. AI assistance runs only inside bounded workstreams, with independent review and integration gates, and a person is accountable for every merge. Security is part of the architecture from the first decision, not a final check.
How does a project go from idea to release?
Every project follows the same five steps. The detail changes with the stack and the size of the job; the order does not.
-
Discovery and scoping
We start with your goals, your existing systems and the constraints that matter: budget, deadlines, integrations and data. The result is a scope with a timeline and cost, so you know what is being built before work begins.
-
Architecture and planning
We pick the platform and architecture that fit the project. We map every integration and break the build into small workstreams that can be reviewed and released on their own.
-
Build and integrate
Work ships in small increments you can see and comment on. Integrations with payments, shipping, ERP, email and other systems are built and tested in the same cycle.
-
Test and release
Before go-live we test the critical paths end to end, run performance checks, test across devices, and release through a repeatable pipeline.
-
Support and improve
Launch is the start of the relationship. We monitor the system, apply updates and fixes, and keep shipping improvements, the way we do for our long-term clients.
How do we use AI in delivery?
AI assistance is a delivery method, not a shortcut. It works inside the same engineering controls as code written by hand.
Bounded workstreams
Each piece of AI-assisted work has a defined scope, inputs and expected output, so it can be checked against a clear target.
Independent review
Output is reviewed separately from the work that produced it, against the requirements and our own standards.
Integration gates
Automated tests, linting and builds must pass before anything is merged, whoever or whatever wrote the change.
A human accountable for every merge
A person on our side approves each merge and answers for it. Automation assists; it never signs off.
How we use AI always depends on the project, client agreements and legal requirements.
How do we keep what we build secure?
Security starts with how a system is built. These are the practices behind work we have already published.
Signed supply chain
Every build of our open-source Docker images is scanned with Trivy, and a vulnerability finding fails the build. Images are signed with Cosign keyless signing and ship with an SBOM and build provenance. Most are rebuilt weekly and built for both amd64 and arm64, and third-party GitHub Actions are pinned to full commit SHAs.
Multi-region infrastructure
Citimarine Store runs on containerized, multi-region infrastructure with its own monitoring, operated by us end to end.
Privacy by architecture
In Hushscript, compatible video is prepared in the browser and only the audio the service needs is sent. The audio is deleted as soon as the transcript is ready. Privacy is a property of the design.
Typed contracts
The Hushscript Rust backend and Vue app share typed contracts, so a changed endpoint fails type-checking before anything ships.
Led by our founder, Vasilii Dementev, whose 15+ years in industry shape how we scope, build and review every project.
Questions about how we work
Who is accountable for the code we receive?
A person on our side approves every change before it is merged and answers for it. Tests, builds and review must pass first, so accountability stays with a person.
Do you use AI on our project?
Where it fits. We use AI assistance as a delivery method inside our usual controls: bounded workstreams, independent review, integration gates and a person accountable for every merge. How we use AI always depends on the project, client agreements and legal requirements.
How do you keep our systems secure?
By building security into the architecture and the pipeline: signed and scanned builds for our open-source images, privacy by design in Hushscript, typed contracts between front end and back end, and monitored infrastructure for the store we run.