Cloud

If you are a platform engineer, CTO, or infrastructure architect at a financial services firm operating in Europe, DORA is no longer something your compliance team handles in a spreadsheet. As of January 2025, the Digital Operational Resilience Act imposes legally binding technical requirements that reach into your cloud architecture, your incident response runbooks, and your vendor contracts. Non-compliance carries penalties of up to 2% of global annual turnover, and the 19 critical ICT third-party providers — AWS, Azure, Google Cloud, and others — are now under direct regulatory oversight for the first time. What is striking is how few engineers at regulated firms understand the technical depth of what DORA actually demands. It reads like a regulation, but it lands like an architecture review. ...

Running cloud infrastructure for regulated financial services is not the same as running cloud for a SaaS startup. Every resource must be auditable. Every network path must be justified. Every configuration change must be traceable to an approved change request. This guide covers the architecture patterns, compliance frameworks, and operational practices we have used to build cloud platforms at HSBC, Credit Suisse, Deutsche Bank, and NatWest Markets. ...

The operational overhead of managing physical or virtual servers—ranging from patching OS vulnerabilities to manually configuring scaling groups—has long been a persistent bottleneck for engineering teams. The fundamental problem being solved by serverless architecture is the decoupling of infrastructure management from application delivery. By abstracting the hardware layer and scaling on demand, teams can focus strictly on core application logic. In this article, we’ll examine the primary solutions across modern hyperscalers, detailing the differences between event-driven Functions-as-a-Service (FaaS) and serverless container deployments. ...