A consultancy's website is a small thing, but it's also the easiest place to check whether a firm practices what it preaches. So we built ours the way we build for clients. Here's the design, and why each piece is there.
The application
The site is an ASP.NET Core application on .NET 10 using Razor Pages. Articles and case studies like this one are Markdown files in the repository, rendered at startup. There's no database to patch, back up or pay for—publishing an article is simply a commit.
We ship no third-party scripts, trackers or fonts from other domains, which lets us enforce a strict Content Security Policy and keeps pages fast and private.
Hosting
The site runs on Azure App Service, sharing a Premium v3 plan with our other properties. Sharing a plan is one of the simplest ways to keep Azure costs predictable: several low-traffic sites fit comfortably on one plan, and you pay once.
Every release goes to a staging slot first. The pipeline checks the staging site's health endpoint, then swaps it into production. The swap is instant, and if anything looks wrong we can swap straight back.
Infrastructure as code
Every Azure resource—the web app and its slot, Application Insights and alert rules—is defined in Bicep and deployed by the pipeline. Nothing is changed by hand, so the environment is repeatable, reviewable and documented by its own source code.
Delivery pipeline
Code lives in Azure Repos, and Azure Pipelines handles every change:
- Build the application and run the automated tests.
- Validate the Bicep templates.
- Deploy the infrastructure, then the application to the staging slot.
- Verify staging is healthy, then swap it into production.
Pull requests must pass the build and tests before they can merge.
No secrets to leak
The contact form emails us through Microsoft Graph. Rather than storing a password or client secret, the web app uses its managed identity, and Exchange Online's role-based access control allows that identity to send from one specific mailbox and nothing else. There is literally no credential in the code or configuration to leak or rotate.
The pipeline authenticates to Azure the same way, using workload identity federation instead of stored secrets.
Monitoring
Application Insights collects request, dependency and exception telemetry, and alert rules notify us if the site starts returning errors or fails its health check.
Built with AI, held to the same standard
This site was built over a single weekend with AI-assisted development, using our Claude AI licensing. AI accelerated every layer: the design, the application code, the tests, the Bicep templates and the pipeline. The standards didn't change. Every change still had to pass the automated tests and go through the same infrastructure-as-code and deployment practices described above.
That's how we use AI with clients too: as a force multiplier for experienced engineers, not a substitute for them.
Why this matters for you
Nothing here is exotic, and none of it is expensive. It's the baseline we think every business application deserves: automated, secure by default and observable. If your own systems are further from that baseline than you'd like, let's talk.