Engineering Excellence, by Default

Overview

The RAD platform lets you deploy production-grade industry solutions — content and commerce platforms, ERP, healthcare, learning systems, banking, AI assistants, workflow automation, and more — in hours rather than weeks.

What sets RAD apart is not only speed. Every solution is built on the same hardened foundation, encoding the engineering principles and practices that the world's leading technology companies rely on to run software securely, reliably, and cost-effectively at scale. You do not assemble these practices yourself, and you never touch infrastructure internals: you configure each solution through a guided set of variables, and the platform applies the proven engineering underneath.

This document summarises the outcomes RAD delivers across six dimensions — security, compliance, cost, developer productivity, modernisation, and enablement — and the time-tested practices behind each one.

---

The principle: proven practices, applied automatically

Most teams know what good engineering looks like — zero-trust security, least privilege, defence in depth, supply-chain integrity, elastic and right-sized compute, full observability, auditable change, and self-service developer experience. Few have the time to implement all of it correctly for every application, every time.

RAD does it once, to a high standard, and applies it to every deployment. The practices below are enabled by default; the most consequential ones are exposed as simple switches and sizing options you control through each solution's configuration. The hard engineering is already done — the way the best in the industry do it.

---

1. Security & Zero Trust

Practices applied: Zero Trust access, least privilege, defence in depth, secure-by-default, software supply-chain integrity.

• Identity-aware access replaces the VPN. Every request is authenticated against your organisation's Google identities before it reaches the application — no VPN client, no open firewall ports. Access is granted or revoked by identity and fully logged. Configure with enable_iap, iap_authorized_users, iap_authorized_groups.
• Protection at the edge. A global web application firewall with managed DDoS protection blocks OWASP Top 10 attacks (SQL injection, XSS, path traversal), applies adaptive rate limiting against bots and abuse, and restricts administrative paths to known networks. Configure with enable_cloud_armor, admin_ip_ranges.
• Secrets are never in plaintext. Passwords, API keys, and tokens are held in a managed secret store and delivered to the application only at runtime — never visible in configuration, logs, or images. Credentials can rotate automatically to shorten their validity window. Configure with enable_auto_password_rotation.
• A trusted software supply chain. Only container images carrying a valid cryptographic signature are allowed to run; unsigned, unscanned, or tampered images are rejected before they start. Configure with enable_binary_authorization.
• Short-lived workload certificates. Where a service mesh is enabled, each workload's mutual-TLS certificate is issued and rotated automatically on a short validity window, and a customer-managed root certificate authority can back the mesh for environments that require their own PKI.
• Data-exfiltration prevention. A service perimeter around your cloud APIs stops data from being copied out of the project — even by a compromised credential — and keeps each tenant's data isolated. A safe observation mode lets you validate the perimeter before enforcing it. Available in a project you bring yourself; it is not offered in a RAD-managed project, where the perimeter would sit in RAD's own organisation. Configure with enable_vpc_sc, vpc_sc_dry_run.
• Least privilege as standard. Each deployment runs under a dedicated, narrowly-scoped identity rather than a broad default, uses keyless workload identity (no long-lived key files to leak), and encrypts data at rest with customer-controlled keys. Misconfigurations are caught and blocked before anything is provisioned.
• Continuous posture visibility. Centralised security findings and project-wide audit logging give you a single, durable view of your security state.

---

2. Compliance & Governance

Practices applied: auditable change management, segregation of duties, evidence-as-configuration, automated drift correction.

• Every change is reviewed, attributable, and reversible, and every deployment is recorded and reproducible — the change-management evidence auditors expect, without manual collection.
• Controls are configuration, not screenshots. The platform's controls map directly onto the common audit families behind SOC 2, ISO 27001, HIPAA, and GDPR — identity and access, secret management, data residency and network isolation, supply-chain integrity, network controls, audit logging, backup, and tenant isolation.
• Segregation of duties is built in through clearly separated operational roles (administrator, user, partner, agent, finance, support, trainer) — the structural evidence auditors look for.
• Drift can be corrected by re-applying. Re-applying a deployment's known-good configuration (an update) reverts unauthorised changes, and validation blocks misconfigurations before they ever take effect.
• Per-tenant compliance is supported through isolated perimeters (when deploying into your own project), dedicated identities, and per-tenant cost and resource boundaries.

Area	Manual approach	With RAD
SOC 2 / ISO 27001 audit prep	Manual evidence collection	Pre-assembled control-evidence map; controls are configuration
Audit trail	Assembled from scattered logs	Every change and deployment recorded, attributable, and exportable
Secret rotation	Manual or bespoke scripting	Automated on a schedule
Control drift	Periodic manual review	Re-apply reverts drift; validation blocks misconfiguration before apply

---

3. Cost Optimisation

Practices applied: FinOps — elasticity, right-sizing, lifecycle automation, and cost transparency.

• Scale-to-zero compute. Set the minimum instance count to zero and idle applications cost nothing; you pay per request and per second, and the platform scales automatically with demand. Configure with min_instance_count, max_instance_count, cpu_limit, memory_limit.
• Spot compute for interruptible work. Selected GKE reference deployments (such as the banking demonstrations) run their nodes on Spot capacity for roughly 60–90% lower node cost, in exchange for occasional short-notice preemption.
• Automated storage lifecycle. Old application revisions and container images are pruned automatically, and object storage transitions to cheaper tiers over time — so storage cost does not creep upward unattended.
• Content delivery offload. Serving cacheable content from the global edge reduces compute and egress on read-heavy applications. Configure with enable_cdn.
• Cost allocation and chargeback. A consistent resource-naming convention flows into billing labels, enabling per-tenant and per-application cost reporting with no manual tagging.
• Tier-configurable services. Every expensive shared service exposes a cost/performance choice — database machine sizes, standard vs high-availability cache, storage tiers, and the option to omit a shared file system entirely (enable_nfs).
• Cost/performance patterns — Low Cost (scale to zero), Low Latency (keep a warm instance) and Balanced — are sensible starting points you apply through the sizing options above.

---

4. Developer Productivity

Practices applied: platform engineering and internal developer platforms — paved roads, self-service, and convention over configuration.

• A catalogue of ready-to-run solutions. A growing library spans content management, ERP and business systems, healthcare, education, banking, search, AI and LLM tooling, workflow automation, and application frameworks — most available for both serverless (Cloud Run) and Kubernetes (GKE) runtimes. Teams deploy a proven solution instead of building one.
• Self-service configuration. A guided form organises every option into logical groups with clear ordering and help text, so a non-specialist can deploy a complex, secure stack confidently — without writing or maintaining any infrastructure.
• Opinionated, single-switch defaults. Substantial cross-cutting capabilities — identity-aware access, edge delivery, image attestation, service perimeters (when deploying into your own project), disruption budgets — are each a single setting away, pre-integrated and consistent.
• Convention over configuration. Every solution follows the same shape and the same option names, so once a team learns one, they know them all.
• A fast, safe path to production, with automated build-and-deploy and consistent validation on every change.

---

5. Application Modernisation

Practices applied: incremental modernisation — lift-and-shift, then replatform, then refactor — with managed-service substitution.

• A landing zone for lift-and-shift. Bring an existing VMware estate into Google Cloud with a turnkey private-cloud environment and secure connectivity — no refactoring required as a first step.

• Replatform without rewriting. Replace hand-built virtual-machine stacks with managed, auto-scaling solutions from the catalogue — WordPress, wikis, Odoo ERP, Moodle, OpenEMR, Cyclos, Ghost, Strapi, and more — keeping the application while shedding the operational burden.

• Managed-service substitution. Self-hosted dependencies are replaced with managed equivalents that are more secure and require less upkeep:

  Self-hosted	Managed replacement
  Database on a VM	Managed SQL (private networking, point-in-time recovery, HA)
  Redis on a VM	Managed in-memory cache
  File server on a VM	Managed network file storage
  Self-hosted image registry	Managed artifact registry
  Self-hosted CI/CD	Managed build and delivery
  Self-hosted secrets vault	Managed secret store
  Self-hosted monitoring	Managed monitoring and logging
  VPN for admin access	Identity-aware access

• Refactor to serverless to remove the last pre-provisioned compute, paying only for what runs.

• Security uplift comes for free. Modernised deployments inherit private networking, identity-aware access, image attestation, edge protection, and customer-managed encryption automatically.

• Migration tooling handles the data cutover (export, import, and database initialisation) so moving live data is routine.

---

6. Education & Enablement

Practices applied: learning tied to real, running systems.

• Certification-aligned learning. Seven Google Cloud certification tracks — Associate Cloud Engineer, Professional Cloud Architect, Professional Cloud Developer, Professional Cloud Database Engineer, Professional Cloud Network Engineer, Professional Cloud DevOps Engineer, and Professional Cloud Security Engineer — are tied directly to working solutions, so learners explore concepts hands-on rather than in the abstract.
• Hands-on labs walk a professional through deploying, operating, observing, and troubleshooting each solution on the platform.
• Role-based operating guides for administrators, users, partners, agents, finance, support, and trainers make responsibilities and procedures clear.
• Rapid onboarding. Structured guides and reference solutions get a new contributor productive in hours instead of days.

Area	Without RAD	With RAD
Certification preparation	Separate training; abstract study	Tracks tied to running infrastructure; hands-on exploration
Developer onboarding	Days of unstructured docs and tribal knowledge	Structured guides and reference solutions; productive within hours
Security knowledge transfer	Ad-hoc, expert-dependent	A repeatable security review

---

Outcomes at a glance

Dimension	Proven practice	What you get	Headline result
Security & Zero Trust	Zero trust, least privilege, defence in depth	VPN-free access, WAF/DDoS, encrypted secrets, signed images	Whole classes of attack eliminated by default
Compliance & Governance	Auditable change, segregation of duties	Evidence-as-configuration for SOC 2 / ISO 27001 / HIPAA / GDPR	A pre-assembled control-evidence map
Cost Optimisation	FinOps — elasticity, right-sizing	Scale-to-zero, lifecycle automation, edge offload, chargeback	Idle applications cost nothing; storage cost does not creep
Developer Productivity	Platform engineering, self-service	A catalogue of secure, ready-to-run solutions	Deploy a proven solution instead of building one
Modernisation	Lift-and-shift → replatform → refactor	Landing zone, managed substitutions, migration tooling	Move and modernise without rewriting
Education & Enablement	Learning on real systems	Certification tracks, labs, role-based guides	New contributors productive in hours

---

You stay in control

Best practice is the default — but it is yours to tune. Each solution is shaped entirely through configuration variables, with no infrastructure code to write or maintain. A few of the levers you control:

• Security posture: enable_iap, enable_cloud_armor, enable_binary_authorization, enable_vpc_sc (when deploying into your own project), enable_auto_password_rotation, admin_ip_ranges.
• Cost and performance: min_instance_count, max_instance_count, cpu_limit, memory_limit, enable_cdn, enable_nfs, and per-service tier choices.
• Access and delivery: iap_authorized_users, iap_authorized_groups, custom domains, and content delivery.

---

In summary

Because the engineering discipline is already built in, every RAD deployment is secure, compliant, cost-efficient, and production-ready from the first day — not after months of hardening. You get the outcomes the world's leading technology companies engineer for, delivered through a simple, guided experience, and tuned to your needs with nothing more than configuration.