Selected work.

Brand & editorial siteOperating
Off-market deal-sourcing networkOperating
Client portal for live acquisitionsOperating
Portal CRM & client report engineOperating
Fail-closed AML/CTF identity gateOperating

GRM LAW

Legal

Compliance & operations portalLive
Portal identity & design systemLive
Role-based access & hardened CSPLive
Append-only audit ledgerLive
Xero bank-feed connectionLive

Aurii

Clinical software

iOS, Android & web appsLive
Azure stack with tenant row-level securityLive
Marketing site, brand & onboardingLive
Tamper-evident audit trailsLive

Restart Recruitment

Recruitment

Brand & editorial siteLive
Screening & scorecard flowsLive
Outreach engine & recruiter portalLive
Row-level security & TOTP sign-inLive

Stone Leaf Capital

Capital markets

Brand & public siteLive
Staff portal behind Entra sign-inLive
AML & KYC verification, fail-closedLive
Document register synced to SharePointLive
Compliance audit log, sealed monthlyLive
Windows desktop app & update channelLive
Xero bank-feed connectionLive

Fox Valuations

Property valuation

Brand & identity systemLive
Public site, tools & insights engineLive
Valuation report template systemLive
M365 tenant, mail & ICT operationsLive
Hardened static delivery & CSPLive
ValuFlow valuation platform, taken over & rebuiltIn cutover

Zenith Cardiology

Cardiology, Gold Coast and Brisbane

Nineteen-page clinical website: locations, cardiologists, investigations and fees, referrals, GP resourcesLive
Domain and DNS moved off Squarespace onto Cloudflare, Google Workspace mail preserved through the cutoverDelivered
Search footprint carried across the move: a 56-URL redirect map, Search Console, sitemapDelivered
Website analytics with call, referral, map and enquiry event trackingLive
Hosting, ICT management and security under an ongoing engagementOperating

PowerSync

Software

External attack-surface monitoring on Assay, with per-subject report delivery by emailOperating

Sentry

Server infrastructure, named by its project

Security posture review and remediation: backup restore verified, monitoring and alerting fixed, hardening roadmap issuedDelivered

Unnamed by agreement

Security engagements where the client identity stays confidential

In depth.

Open a case study for the technical implementation and current operating position.

Operating

Bold Property Group

Buyer’s advocacy

Brand, website, deal-sourcing infrastructure and client portal for a buyer’s advocacy business.

The problem: A new buyer’s agency needed an operating stack it could iterate on weekly: brand, marketing site, deal-pipeline tooling, and a private portal for clients tracking an active acquisition.
What we built: We designed the identity, shipped the editorial site, built the agent-network data layer for sourcing off-market opportunities, and stood up the client portal, with CRM and operating playbook on the same data model.
How it is secured: Compliance is enforced in code, fail-closed: the portal will not let an engagement letter be signed or a property address be revealed until verification of identity is recorded.
What it does now: Bold Property Group is operating. Black Shard runs the platform it works on: the brand, the marketing site, the deal-sourcing infrastructure, the staff command centre and the client portal, hardened in September 2026 across security, workflows and deploy gates.

Live · private portal

GRM LAW

Legal

A legal operations and compliance platform covering intake, conflicts, matter management and compliance workflows.

The problem: A Brisbane law firm needed a system that could sit over the practice tools it already used and run day-to-day: secure intake, conflicts checks, a matter register, AML/CTF readiness, and the audit trail behind them.
What we built: We built the operations and compliance portal: secure intake, conflicts checks, the matter register, and AML/CTF readiness.
How it is secured: Role-based access over a hardened content-security policy, with an append-only audit ledger enforced on every state change.
What it does now: The firm operates from the portal. We ship to it weekly under an ongoing engagement, and the build evolves with the workflow.

Aurii

Clinical software

Clinical software spanning mobile, web, speech processing, OCR and a multi-tenant data platform.

The problem: Australian private-hospital specialists were typing their own clinical notes, letters and billing. The workflow needed software that drafts them from the spoken consult, inside the practice framework already in use.
What we built: We built the stack: the iOS and Android apps, the web app, the speech and OCR pipelines, the multi-tenant data layer with PostgreSQL row-level security, and the clinical messaging gateway, on Microsoft Azure in the Australia East region.
How it is secured: Tenant health data isolated with PostgreSQL row-level security, tamper-evident audit trails, and rate limiting, on Azure in Australia.
What it does now: Aurii is live. Black Shard operates it in production, with the clinical and privacy frame designed for Australian obligations.

Restart Recruitment

Recruitment

Recruitment workflows covering candidate intake, screening, scoring and outreach.

The problem: An executive search firm needed an internal stack that judges every brief the same way: recruiter dashboard, pipeline, and structured scorecard screening.
What we built: We built the brand, the editorial site, the candidate intake and screening flows, the scorecard model, and the outreach engine over Outlook OAuth behind them.
How it is secured: Tenant data behind forced Postgres row-level security on eight core tables, TOTP two-factor sign-in, and eleven invariant tests (TOTP replay, OAuth timing, webhook input caps) pinning the security model.
What it does now: The platform is complete: portal, outreach engine and screening flows ready to run the first searches end to end.

Stone Leaf Capital

Capital markets

Internal systems and compliance tooling for an Australian capital-markets business.

The problem: An Australian capital-markets firm (funds management, capital raising, corporate advisory for wholesale clients) needed the technology it operates on: the brand, the public site, and the staff portal underneath.
What we built: We built the brand and public marketing site, and the staff portal that is the operational backbone: critical-event tracking and policy modules.
How it is secured: A compliance audit log captures actor, action, and before-and-after state on every change, sealed monthly into hash-manifested archives. Sign-in is Microsoft Entra; retention purges are provenance-guarded.
What it does now: The public marketing site is live. We ship to the portal under an ongoing engagement, structured around the firm’s AFSL perimeter and retention obligations.

Fox Valuations

Property valuation

Technology work for an independent property valuation practice.

The problem: An independent valuation practice needed everything around the valuer's signature: a brand, a public site, designed report templates, and the practice's mail and ICT foundations.
What we built: We built the identity (the leaping fox, rust on warm paper), a static public site with working calculators and a valuation insights library, the designed report template system, and the Microsoft 365 tenant and custom-domain mail underneath.
How it is secured: The public site is hardened static delivery: a strict Content-Security-Policy, no dynamic surface beyond the request pipeline, served through Cloudflare.
What it does now: Live at foxvaluations.com.au under an ongoing ICT and growth engagement: hosting, mail, search foundations and the document pipeline run on infrastructure we operate.