I build apps and AI agents for everyday work. And I set up Microsoft 365 and Azure so that only the right people get in and your data stays in Switzerland.
Your data sits in Microsoft's Swiss data centres, and you can check at any time what is stored where.
Who is signing in, on which device and from where. A stolen password on its own is no longer enough.
Who changed what, and when, is written down. Any change can be rolled back.
Invoices, requests and reports go through on their own. Where it matters, a person makes the call.
AI assistants do only what you allow. Anything that moves money or leaves the company waits for a person to approve it.
I build apps, automations and AI agents, from the first version to running them in production. With Claude Code, Azure DevOps and the Power Platform.
See the apps and servicesI set up and run Microsoft 365 and Azure securely: Conditional Access as code, data kept in Switzerland, and Copilot without overshared files.
See the servicesThe outcomeAn app that solves your problem, built quickly and properly tested.
I work with Claude Code, an AI tool that writes, tests and refactors code. The architecture, security and quality stay my responsibility. Every change runs through automated tests and an Azure DevOps pipeline before it goes live.
What you get
I built these apps myself.
Court booking for tennis clubs: a grid per court, booking rules and quotas per membership, court closures, sponsoring and events. Several clubs on one platform, with double bookings ruled out in the database itself.
Web app · Next.js · PostgreSQL · Prisma
Time tracking for small firms: timer, day view, absences, reports and invoices.
Web app · TypeScript
A workshop app for a racket-stringing service: orders, customers, string stock, invoices and an AI assistant.
Web app · React · Firebase · Gemini
Financial planning for Swiss households: assets, pension fund, pillar 3a and scenarios up to retirement, with an AI adviser.
Web app · Next.js · TypeScript
Strength training with an AI coach: log sets, manage training load and adjust the plan when something hurts.
Mobile app (PWA) · React · Gemini
The outcomeYour Azure environment can be rebuilt from Git at any time.
I describe resources, permissions and networks in Terraform or Bicep instead of clicking them together in the portal. That is infrastructure as code. The code lives in your Azure DevOps. Every change starts a pipeline: it previews the change against what is running (plan or what-if), a named person approves it, and only then does it roll out. The pipeline signs in with workload identity federation, so there is no password or key anywhere for someone to steal.
What you get
The outcomeCopilot Studio, Power Automate and Power BI, properly run instead of growing wild.
Plenty of workflows do not need custom software. I build them with Microsoft’s Power Platform, right inside your Microsoft 365 environment. What matters is how they run: each solution lives in its own environment, moves from test to production through pipelines and has an owning team, so nothing depends on a single person.
Assistants and agents your staff can ask in Teams. They only know the sources you approve, such as SharePoint or your intranet, and can trigger workflows when needed.
Workflows for requests, approvals, notifications and keeping data in sync between your systems. With error handling and an alert when a run stalls.
Reports and dashboards built on your data, from your ERP, SharePoint or Azure. One shared data model, row-level security so everyone sees only their own figures, and scheduled refresh.
The outcomeAI runs inside fixed workflows and only gets room to act where it pays off.
Most AI tasks do not need a free-roaming agent. I build them as workflow as code: the sequence lives in code, and the model gets small, well-defined jobs, such as reading a document or drafting a reply. Every answer is checked against a schema before the next step runs. Where an agent does need to choose its own tools, it runs inside a harness, the control layer around the model. The harness gives it a fixed tool list, caps calls and run time, logs every step, and only lets it propose changes, which a person then accepts.
What you get
Three areas of work in Microsoft 365 and Azure. Pick one to start with and decide afterwards whether to go further. Whatever I set up belongs to you, and it is documented well enough for your own team and your auditors to follow.
The outcomeBefore Copilot goes live, you know which confidential files it would show your staff.
Copilot can draw on everything a user has access to. In most companies that is far more than it should be: payroll, board minutes, old project folders that were opened up to everyone by mistake. I find those gaps and close them before Copilot finds them.
What you get
The outcomeYour data stays in Switzerland, and you can prove it.
I configure Azure so that data can only be stored in Zurich or Geneva. Every other region is blocked.
What you get
Microsoft is a US company. I set out what that means for your data rather than paper over it.
The outcomeYour sign-in rules live as code in Git, and any drift in the tenant is caught within the hour.
Conditional Access decides, at every sign-in to Microsoft 365 and Azure, who gets in, on which device and from where. I run these rules with software I built for the job. The desired state lives as JSON in Git. A change only goes through a pull request and an Azure DevOps pipeline: a preview against the live tenant, automated checks with OPA rules, approval, deploy. Anyone who edits a policy in the portal creates drift. An hourly runbook finds it and rates every difference by risk. It is then rolled back or adopted through a pull request, never silently.
What you get
Microsoft is building its own drift monitoring with the UTCM API, still in preview: it checks every six hours and rolls nothing back. I use it as an extra control, not the only one.
Four stages, each at a fixed price. Every stage ends with something you can use, and you decide whether to carry on.
Tell me what you are planning and your timeline. I will tell you straight whether I am the right fit.
You getA short write-up and my suggested first step.
I look at what you have today: your workflows and tools, and in Microsoft 365 and Azure also user accounts, permissions and admin roles.
You getA report of the main risks in order of urgency, and a costed plan for each next step.
Step by step, with every change reviewed and documented. For public-sector clients I also write the required security documentation, the ISDS concept.
You getThe configured systems, the documentation and the runbooks.
I walk your team through everything on your own systems. After that you run it yourselves, or I stay on hand for support.
You getAn operations manual, trained administrators and, if you want one, a support contract.
Microsoft's data centres in Zurich and Geneva keep your data in Switzerland. Microsoft is still a US company. I tell you both, and I put in writing what each means for you.
For every organisation: a record of processing activities under the Swiss Data Protection Act and, where the risk is high, a data protection impact assessment.
For banks, insurers and asset managers: the outsourcing documentation FINMA expects, up to and including an exit plan.
For cantons, communes and federal offices: a protection needs analysis and an ISDS concept under the Information Security Act.
