Technology · 05 Cloud & Infrastructure
AWS, Microsoft Azure and Google Cloud, plus Vercel and Cloudflare where a smaller footprint fits. Canadian regions by default, infrastructure as code, backups you can actually restore, and monthly costs sized to the site or app you really run.
Updated September 2026 You own everything Reply within one business day
$oldevs deploy --env production
✓Build passed · 212 tests · 0 warnings
✓Migrations applied · postgres 16
✓API v2 healthy · 142ms p95
→Rolling out to 3 regions…
OlDevs, a full-stack studio in Vancouver, runs client infrastructure on AWS, Microsoft Azure or Google Cloud, choosing Canadian regions such as Montréal, Calgary or Toronto by default when data residency matters.Every environment is defined in Terraform or OpenTofu, backed up with tested restores, and watched with logs, metrics and traces. Clients own every account, and a corporate site is sized very differently from a multi-tenant app.
Key facts
05 · Cloud & Infrastructure
Each card says when the pattern is the right call and what it will cost you in effort and attention once the launch is behind you.
The right choice for data-heavy web apps and anything that must stay in Canada: ca-central-1 in Montréal and ca-west-1 in Calgary give two domestic regions for failover. The later cost is mostly people: IAM, networking and billing need someone who reads the console every month.
Right when the organisation already runs Microsoft 365, Entra ID and Windows workloads; Canada Central in Toronto and Canada East in Québec City keep data domestic. Expect licensing and reserved-capacity decisions to need a review each year, and budget for someone who knows Azure policy.
Best fit for analytics, BigQuery and machine learning workloads, with Montréal and Toronto regions for residency, and Cloud Run makes container hosting simple. The later cost is a smaller Canadian hiring pool than AWS, so we document more and keep the footprint conventional.
Ideal for marketing sites and small Next.js apps with a small team: deploy previews, a global edge and almost no operations work. Later, usage pricing climbs with traffic and a few features tie you to the vendor, so we keep the app portable and revisit hosting once traffic grows.
Worth it for a multi-tenant product with several services, background workers and predictable scaling needs, on EKS, AKS or GKE. The ongoing cost is real: cluster upgrades a few times a year and an engineer who understands networking. For a single app, Cloud Run, App Runner or ECS on Fargate is cheaper to own.
Right for spiky or low-traffic work such as forms, webhooks, scheduled jobs and APIs that sit idle most of the day, using Lambda, Azure Functions or Cloud Functions. Spend stays near zero until traffic arrives; the later cost is cold starts, per-request pricing at high volume and harder local debugging.
Stack
Concrete tools, current at the time of writing; confirmed for your project at scoping.
Cloud platforms
Compute and containers
Infrastructure as code and delivery
Edge, CDN and protection
Observability
Backups, secrets and compliance
What changed
What moved in this area and what it means for your build.
2026
Federal privacy reform stalled when Bill C-27 died in early 2025, so PIPEDA, Québec's Law 25 and provincial public-sector rules still govern. Buyers ask where data sits before they ask what it costs, and a Canadian region answers that question in one line of your proposal.
2026
GPU capacity in Canadian regions remains limited and reservation-based across the three major clouds, current at the time of writing. If your product calls a hosted model, we plan for API spend and rate limits rather than renting GPUs, which keeps the infrastructure simple.
2025
EKS, AKS and GKE all bill extra for clusters left on versions past standard support, and Kubernetes ships three releases a year. For a client, this turns cluster upgrades from a nice-to-have into a scheduled budget line, and it strengthens the case for Cloud Run or Fargate on smaller apps.
2025
OpenTofu kept pace with Terraform through 2025, adding state encryption and provider features Terraform lacks, while staying compatible with most modules. Clients get a choice: HashiCorp's licence and cloud tooling, or an open-source fork with no licence risk. We write modules that run on either.
2025
Vercel's Fluid Compute model, current at the time of writing, bills active CPU time rather than wall-clock time for functions, and Cloudflare Workers keeps expanding storage and queue services. Small apps with I/O-heavy functions now cost less at the edge, which changes the break-even point against a plain VM.
2025
CDN providers reported the largest volumetric attacks on record during 2025, many aimed at small and mid-sized sites rather than banks. We no longer treat Cloudflare or an equivalent WAF as an upgrade; every public hostname we launch sits behind one from day one.
How we choose
If your team has no cloud engineer, we choose managed services and fewer moving parts, even when a self-hosted option is cheaper on paper. A platform nobody understands costs more than one that bills a little higher.
Health, legal, public-sector and education clients usually need Canadian residency, so we start with Montréal, Calgary or Toronto regions and only add US regions for global edge caching of public content.
We ask how often the product will change. A site that ships quarterly can live on a managed platform; a product shipping daily needs pipelines, preview environments and infrastructure as code from the first sprint.
A brochure site can tolerate an hour of downtime; a booking system or tenant portal cannot. We size redundancy, backup frequency and recovery targets to what an outage would actually cost the business.
Committed spend agreements, Microsoft licensing, Google Workspace or an existing Entra ID tenant often decide the platform before any technical argument, and we respect that rather than fighting it.
We prefer services with an obvious exit: containers over proprietary runtimes, PostgreSQL over vendor-only databases, open telemetry over a single monitoring vendor. If you leave, the code, state files and accounts leave with you.
Who it's for
Whether the audience is a customer, a member, a citizen, or your own team, the choice has to hold up under real use.
Multi-region AWS or Azure landing zones with SSO, separate accounts per environment, audit logs retained for your policy period and a monthly cost report your finance team can read.
Canadian data residency, bilingual sites served from a CDN, WCAG 2.2 AA front ends and SOC 2-ready operations documented so a procurement or privacy review passes without a scramble.
One platform serving many locations: shared infrastructure, per-location content and forms, central WAF and backups, and a rollout process that adds a new site without a new project.
Start small on Vercel, Cloud Run or a single AWS account with credits, keep everything in Terraform, and grow into Kubernetes only when a second engineer and real traffic justify it.
Related technology
Every OlDevs project ships with threat modelling, OWASP ASVS checks, encrypted data, single sign-on and audit…
Explore03Seven runtimes, three API styles and the plumbing around them: sign-in, queues, caching, file storage, email…
Explore01Modular monolith or microservices, queues or direct calls, one tenant or many: the shape of a system decides…
ExploreFAQ
AWS is our default because it has two Canadian regions, the broadest service catalogue and the largest local hiring pool. We recommend Azure when a client already lives in Microsoft 365 and Entra ID, and Google Cloud when the product centres on analytics or machine learning. The choice follows your team and contracts, not our preference.
Yes. AWS offers ca-central-1 in Montréal and ca-west-1 in Calgary, Azure offers Canada Central and Canada East, and Google Cloud offers Montréal and Toronto. We keep databases, backups and logs in those regions and use a CDN only for public, cacheable content. Support access and vendor sub-processors are documented for your privacy review.
Always. Accounts, domains, DNS zones, certificates and billing are created in your organisation's name from the first day, and our engineers work through roles you can revoke. When the engagement ends you keep the accounts, the Terraform code and the state files, with nothing routed through OlDevs.
Every server, database, network rule and DNS record is written as Terraform or OpenTofu code, reviewed in a pull request and applied by a pipeline. You can see the history of every change, rebuild an environment from scratch after an incident, and hand the whole setup to another team without a knowledge transfer meeting.
We tag every resource by environment and product, set budget alerts before launch, right-size instances after the first month of real traffic and use reserved or committed pricing only once usage is predictable. You receive a plain-language cost summary each month with the reasons behind any change.
Backups are automated, encrypted and copied to a second region, and we restore them on a schedule to prove they work. For each system we agree a recovery time and recovery point target with you, then design to it: a corporate site may rebuild from code in an hour, while a tenant application may run active-standby across two regions.
We build to SOC 2-ready operations: single sign-on with MFA, least-privilege roles, encrypted storage, centralised logging, change management through pull requests and documented incident response. Evidence flows into Vanta or Drata if you use them. The audit itself is done by an accredited firm, and we support you through it.
Let’s connect
Tell us what you’re building. We’ll reply within one business day with recommended platforms, structure and a tailored quote — no obligation.