AWS, in an account with your name on it.
The application runs on App Runner, the record on RDS Postgres, documents on S3, builds in ECR, all in an AWS account the client opens and owns. KYN holds an operator role the client can remove.
- The agent reads
- Nothing of yours outside the account: the system is the account
- The agent writes
- Deployments from a clean build through ECR to App Runner
- Schema migrations to RDS, versioned and reversible
- Backups and exports on the schedule you set
- A person approves
- Any change to IAM roles or policies
- Deleting a database or a bucket
- Changing the region
Setting it up.
| Account | Opened by the client with the client’s card and root email; MFA on root; KYN added as an IAM role with a permission boundary. | |
| Region | ap-southeast-1 (Singapore) by default. | |
| Egress | A NAT instance with an Elastic IP where a bank or partner whitelists by address. | |
| Cost | Hosting at cost, billed by AWS to the client; typically S$0 to 60 a month per system at SME volumes. | |
Builds that use it.
Eleven systems to three, one AWS account →Inventory trackers and withdraw kiosk →One ledger with bank statement parsers →Build library →
Questions buyers ask
Who pays AWS?
- You, directly, on your own account and card. KYN never bills hosting through; the invoice from AWS is yours and so is the account.
What happens if we stop working with KYN?
- Remove the operator role. Everything stays running in your account; the code is in your repository; the runbooks are in the system.
Can you run on Google Cloud instead?
- Yes. The same pattern on Cloud Run, Cloud SQL and Cloud Storage; see the Google Cloud page. The choice usually follows where the client’s other systems already live.
Is the data backed up?
- RDS automated backups, 35 days by default, in the same region; restore tested on handover. Longer retention or a second region on request at the client’s cost.