Technology
Built on the platforms your business already trusts, wired together properly.
I don't sell a proprietary platform. Where you already own something capable, such as Microsoft 365, Azure or your accounting system, I build on it through its real APIs, so the work keeps running long after the engagement ends. Where no platform covers the problem, I write the application myself. Both halves are listed below, along with what the AI can and cannot do with your data. This is the one page on the site written for your IT person rather than for you.
Copilot Studio & Dataverse
Agents built on Microsoft Copilot Studio, grounded in Dataverse as the single record. An answer about equipment or cost comes from the row that holds it, and names the system it came from, so you can check it rather than trust it.
Model Context Protocol
Where the off-the-shelf connectors cannot reach, I write a custom MCP server. That is what lets an agent read a SharePoint list, a document register, or a line-of-business system that was never designed to be queried, under an identity you control.
Identities, not passwords
Services authenticate as themselves wherever the platform allows it: managed identity inside Azure, workload identity federation elsewhere (the contact form on this site included), so there is no secret to leak. Where a secret cannot be avoided it lives in a key vault with an expiry date and an audit log, never in code. Agent write access is a named allow-list, one field on one record, and the role behind it holds no delete permission.
Microsoft Graph & Microsoft 365
SharePoint, Teams, Exchange and Intune automated directly through the Microsoft Graph API: client folders, dedicated Teams channels, mail workflows and device standards created and checked programmatically, with the tenant itself audited against published baselines.
Microsoft Entra ID
Organization-restricted single sign-on for every system I build, with phishing-resistant methods where the client's licensing allows. Access is tied to your real identity provider, not a separate username and password to manage.
Azure
Serverless compute and hosting (Static Web Apps, Functions, Container Apps) in the client's own subscription, with Key Vault for anything secret and Log Analytics for anything that needs an audit trail. Scales on its own; costs are visible per resource.
QuickBooks & accounting systems
Operational data is worth little if it never reaches the books. Invoices are created in QuickBooks and carry Pay Now for card and ACH, with the payment applied to the invoice it belongs to. Coded expenses post with idempotent writes, so a dropped connection cannot double-post. No card data ever touches my systems.
Custom applications & PWAs
Where no platform covers the problem, the answer is written from scratch: web applications, internal dashboards, client portals, and progressive web apps that install without an app store and keep working on a phone with one bar of signal. Public sites like this one are plain HTML with a strict content security policy and no third-party scripts.
Your data is not training data
Agents run inside your own accounts, under an identity you control, reading your live records. Nothing you feed an agent is used to train a vendor's next model, and nothing it learns about how you price, bid or operate leaves your business. If a tool cannot promise that, I don't put your data through it.
What "integrated" looks like
One real example: onboarding a new client end-to-end, automatically.
That example runs on Microsoft because that client already owned it, and spending their money twice would have been indefensible. The same flow gets built other ways when the situation differs: a custom application with its own database, wired into whatever they already run. The pattern is what matters.
No platform lock-in
I build on infrastructure you already own or can reasonably adopt, and write custom software where that falls short. Never a walled garden only I can maintain, and never a stack chosen because it's the only one I know.
Official APIs only
Every integration is built against the vendor's documented API. No screen-scraping, no unofficial workarounds. What's built today keeps working after the vendor's next update.
Security by default
Least-privilege access, organization-restricted sign-in, secrets out of source code, and the tenant checked against published standards before anything is built on it.
Built to be handed off
Documentation and access are structured so your team, or another vendor, could pick up the system if needed. It's your infrastructure, not mine.
Want to see what this looks like for your systems?
Tell me what you're running today and I'll map out what's possible.