ZSoftly
Talk to our team

Case Studies

Measurable outcomes from real partnerships. See how organizations cut cost, moved faster, and de-risked their infrastructure with ZSoftly.

Forward Deployed EngineeringDeveloper ToolsUnder 2 months

Runzivo Builds a Managed CI Runner Platform in Under Two Months

A ZSoftly forward deployed engineer worked inside the Runzivo team to take a managed GitHub Actions runner service from plan to a working platform.

Challenge

Runzivo set out to offer isolated CI runners for GitHub Actions, so software teams stop operating their own runner fleets. A team switches by changing one runs-on label. Runzivo needed the runner service, the customer portal and the operating tooling built in under two months.

Solution

ZSoftly placed one forward deployed engineer with the Runzivo team. The engineer worked in Runzivo repositories and planning, alongside Runzivo engineers. Together they built Linux runners from 2 to 32 vCPU in Ottawa and Montréal on ZCP. Each eligible job runs in a fresh Firecracker microVM, and Runzivo destroys the microVM when the job ends. The team also built a portal and the rzv CLI for job status and logs, and usage insights for duration, queue wait and minutes by runner size.

Results

Runzivo had a working platform in under two months and opened it in Early Access. A real pipeline has passed in a test environment, and production availability is next.

Key Metrics

Time to working platform
Plan to Working platform
Under two months
ZSoftly engineers
0 to 1 embedded
Embedded in the Runzivo team
Status
Plan to Early Access
Real pipeline passed in test

Business Impact

  • Working platform in under two months, now in Early Access
  • One ZSoftly engineer embedded in the Runzivo team
  • Single-use microVM isolation for every eligible job
  • Runners in two Canadian regions on ZCP
Zero Trust NetworkingRemote Work and IT OperationsNovember 2026

Zenphry Builds a Shared Dallas Office Connection for Remote Teams

A reusable, approved path lets remote employees use Dallas internet egress without extending head-office network access.

Challenge

Zenphry needed a reusable way for approved remote employees to use the organization’s Dallas internet egress from home or Wi-Fi. The design had to support employee laptops and equipment behind a managed router without a new VPN build for each person. Access to the internet exit had to remain separate from Dallas office LAN systems and private applications. The initial Ottawa connection validated the setup.

Solution

ZSoftly Professional Services designed and configured the foundation. ZSoftly Cloud Platform (ZCP) in Montréal hosts the self-hosted Headscale VPN control plane for Zenphry’s private Tailscale network, or tailnet. A dedicated Dallas Linux exit node provides approved outbound internet egress. Approved employee laptops join the company tailnet through Tailscale clients. A managed GL.iNet Beryl AX router provides the same path for connected devices without a per-device client. Staff use SSO and least-privilege identity groups, while the employee-router tag permits internet egress only. No Dallas office LAN subnet routes are advertised or approved. The work included device onboarding, access policies, DNS, persistent native NAT for forwarded LAN traffic, and a restored administrative SSH path before remaining DNS and forwarding changes.

Results

The Ottawa router validation confirmed DNS and HTTPS through the Dallas exit, with the observed public IPv4 address matching Dallas. The employee reported successful router-LAN use, but no independent LAN-client capture was taken. Additional approved employees can join the existing tailnet, receive the required egress policy, and select the Dallas exit through a Tailscale client. Connected devices can use a preconfigured router. Private applications remain separately approved and still require their own authentication.

Key Metrics

Validated path
Ottawa router connection to Dallas IPv4 and DNS confirmed
Router DNS and HTTPS path verified
Office LAN routing
Not approved to Not advertised
Egress permission remains separate
Reusable foundation
Remote access requirement to Shared tailnet and Dallas exit
Ready for approved onboarding

Business Impact

  • One company tailnet, reusable for approved employees and managed routers
  • Dallas internet egress separated from head-office network access
  • SSO-backed staff access and a restricted employee-router identity
  • Device onboarding and access policies managed as shared controls
  • Private-application permissions remain separate from internet egress
AWS CloudHealthcare Technology12 weeks

AWS Cloud Optimization & Security Enhancement

Healthcare Tech Company Cuts AWS Costs 52% While Achieving SOC 2 Compliance

Challenge

A rapidly growing healthcare technology company faced escalating AWS costs (180% YoY increase to $45K/month), failed SOC 2 Type II audit with 127 critical security vulnerabilities, poor application performance (8+ second response times), and risk of HIPAA violations with PHI data.

Solution

We conducted an AWS Well-Architected Review and implemented strategic optimization: eliminated unused resources, migrated to serverless architecture (EC2 to ECS Fargate), implemented S3 lifecycle policies, purchased Reserved Instances, enabled security monitoring (Security Hub, GuardDuty, Config), deployed multi-AZ architecture with network segmentation, and established IAM least-privilege access with MFA enforcement.

Results

Monthly AWS costs reduced from $45,000 to $21,400 (52% reduction). Critical security findings resolved from 127 to 0. Application response time improved from 8.2 seconds to 1.2 seconds (85% faster). System uptime increased from 97.3% to 99.95%. Successfully achieved SOC 2 Type II certification.

Client Comment

“Our AWS infrastructure was out of control. Costs spiraling, security issues mounting, and our SOC 2 audit failing. The team fixed our immediate problems and changed how we think about cloud infrastructure. We're now compliant, our costs are half what they were, and response times dropped from 8 seconds to 1.2 seconds. This engagement paid for itself in the first month.”
CTO, Healthcare Technology Company

Key Metrics

Monthly AWS Cost
$45,000 to $21,400
52% reduction
Critical Security Findings
127 to 0
100% resolved
Application Response Time
8.2 sec to 1.2 sec
85% faster
System Uptime
97.3% to 99.95%
+2.65%
SOC 2 Compliance
Failed to Passed
100%

Business Impact

  • Annual savings: $283,200
  • ROI: 843% (payback in 1.4 months)
  • Achieved SOC 2 Type II certification
  • Prevented $2M ARR churn
  • Enabled $3.5M in new enterprise deals
SecurityE-Commerce / Retail20 weeks

Cloud Security & Compliance Implementation

E-Commerce Company Achieves PCI-DSS Level 1 Compliance and Prevents $500K+ in Fines

Challenge

A rapidly growing e-commerce company ($180M annual transactions) failed their PCI-DSS compliance audit with 793 security findings (89 critical, 158 high-risk), including publicly accessible S3 buckets with customer data, unencrypted databases storing cardholder information, and blocked $8M in enterprise sales requiring SOC 2 certification.

Solution

We implemented a full security overhaul: disabled root account access and enforced MFA, secured all S3 buckets and enabled encryption, implemented AWS Organizations with multi-account strategy, deployed AWS SSO with RBAC, created separate PCI-compliant CDE, implemented network segmentation, deployed AWS WAF, Network Firewall, GuardDuty, and passed QSA audit for PCI-DSS Level 1.

Results

Achieved full PCI-DSS Level 1 compliance. Security findings reduced from 793 to 0 critical findings. Successfully passed SOC 2 Type II audit. Prevented $500K+ in potential fines. Unblocked $8M in enterprise sales.

Client Comment

“We were days away from losing our ability to process credit cards. The security transformation saved our business and positioned us for enterprise growth. We went from failing audits to passing with zero critical findings. The $8M in enterprise deals we can now pursue will change our trajectory.”
CEO, E-Commerce Company

Key Metrics

Security Findings
793 (89 critical) to 0 critical
100% resolved
PCI-DSS Compliance
Failed to Level 1 Certified
Full compliance
Enterprise Sales
$8M blocked to $8M unblocked
100% enabled
SOC 2 Status
Not certified to Type II Certified
Achieved

Business Impact

  • Prevented $500K+ in potential fines
  • Achieved PCI-DSS Level 1 compliance
  • Passed SOC 2 Type II audit
  • Unblocked $8M in enterprise sales
DevOpsFinancial Services (FinTech)16 weeks

DevOps Transformation & Automation

FinTech Startup Achieves 1,200% Increase in Deployment Frequency with Zero-Downtime Releases

Challenge

A fast-growing fintech startup faced slow software delivery with 4+ hour manual deployments requiring 3 engineers at 2 AM, 40% failure rate, only 2 deployments per week possible, 12 production incidents per month, and 40% developer turnover.

Solution

We implemented comprehensive DevOps transformation: migrated to Git with protected branches, built automated CI pipeline with testing and security scanning, implemented blue-green deployment for zero-downtime releases, converted infrastructure to Terraform, and implemented Datadog APM with automated alerting and incident response.

Results

Deployment duration reduced from 4 hours to 8 minutes (97% faster). Deployment frequency increased from 2/week to 25/week (1,150% increase). Production incidents reduced from 12/month to 0.7/month (94% reduction). Developer turnover dropped from 40% to 8%.

Client Comment

“Before this transformation, our engineering team was drowning in manual work and firefighting production issues. Deployments were terrifying 4-hour ordeals at 2 AM. Now, we deploy 25 times a week with confidence. Our developers build features instead of babysitting infrastructure. We ship faster than competitors twice our size. Developer turnover dropped from 40% to 8%.”
CTO, FinTech Startup

Key Metrics

Deployment Duration
4 hours to 8 minutes
97% faster
Deployment Frequency
2/week to 25/week
1,150% increase
Production Incidents/Month
12 to 0.7
94% reduction
Deployment Success Rate
60% to 98%
+63%
Mean Time to Resolution
6.2 hours to 22 minutes
94% faster
Developer Turnover
40% to 8%
80% reduction

Business Impact

  • Annual value delivered: $1.2M+
  • Feature velocity: +285%
  • Time to market: 75% faster
  • Saved $450K in recruiting and training costs
DevOpsTechnology / SaaS4 weeks

GitHub Actions CI/CD Pipeline Optimization with Cloudflare R2

Tech Startup Eliminates CI/CD Downtime and Achieves Near-Zero Cost Pipeline

Challenge

A fast-growing tech startup hit GitHub Actions artifact storage quota limits. All builds halted for 24 hours. The team temporary workaround stored build artifacts in GitHub Releases, which violated best practices and could not scale.

Solution

We migrated artifact storage from GitHub Actions to Cloudflare R2, built custom GitHub Actions for seamless integration, and provisioned infrastructure using Terraform. The result was a production-grade foundation built for scale at $0/month.

Results

Eliminated CI/CD downtime from 24 hours to zero. Reduced monthly artifact costs from quota-blocked to $0 (free tier). Deployment reliability improved from quota-blocked to 99.9% uptime. Time to recovery improved from 24+ hours to under 5 minutes.

Client Comment

“We were dead in the water when GitHub quota limits hit us. Almost a full day without deployments. The team was desperate, so we hacked together a solution using GitHub Releases to keep moving. We knew it was terrible, but we had no choice. What impressed us about ZSoftly was they didn't slap on a band-aid fix. They took the time to understand our business goals, our growth trajectory, and where we wanted to be in 12 months. Over 4 weeks, they transformed our CI/CD from a liability into a competitive advantage. Now we have unlimited artifact storage, it costs us nothing, our pipeline is faster and more reliable than ever, and everything is infrastructure-as-code. They set us up with production-grade best practices from day one. That's the kind of foundation a startup needs.”
Engineering Lead, Tech Startup

Key Metrics

CI/CD Downtime
~24 hours to 0 hours
100% uptime
Monthly Artifact Cost
Quota blocked to $0 (free tier)
Free forever
Time to Recovery
24+ hours to <5 minutes
99% faster
Artifact Storage Limit
Org quota shared to 10GB per project
Unlimited projects
Bandwidth Cost
N/A to $0 (unlimited)
Zero egress fees

Business Impact

  • Eliminated 24-hour CI/CD outage risk
  • Saved $2,400/year in GitHub Actions costs
  • Enabled unlimited scaling without cost concerns
  • Infrastructure-as-code: fully reproducible and documented
SecuritySaaS / Enterprise Software14 weeks

Multi-Cloud Zero Trust Security Transformation

SaaS Company Eliminates Bastion Hosts, Protects Exposed Sites, and Achieves Zero-Trust Security

Challenge

A growing SaaS company managed 23 bastion hosts across 15 AWS accounts, 70+ SSH keys scattered across developer laptops, and 12 internal sites that were publicly accessible with no authentication. Their SOC 2 audit identified 24 security findings.

Solution

We replaced their bastion host architecture with JumpCloud for identity and device trust, AWS IAM Identity Center for federation, SSM Session Manager for server access, and Cloudflare Zero Trust to protect 12 exposed internal applications. We also deployed ZTiAWS for instant SSO access across all AWS accounts.

Results

Reduced bastion infrastructure costs by 91% from ~$1,400/month to ~$120/month. Eliminated all 23 bastion hosts and 70+ SSH keys. Protected 12 exposed internal applications with Cloudflare Zero Trust. Reduced SOC 2 findings by 96% from 24 to 1.

Client Comment

“We were burning engineering time managing bastion hosts and drowning in SSH keys nobody could track. We had staging sites and internal tools sitting on public subdomains with no authentication. Our SOC 2 audit came back with 24 findings. We were stuck. ZSoftly transformed our entire security model. They replaced 23 bastion hosts across 15 AWS accounts with Zero Trust architecture. They eliminated every SSH key. They put all our exposed internal sites behind Cloudflare Zero Trust. The ZTiAWS tool they deployed changed how our engineers work. No more copy-pasting credentials between accounts. One command and they are authenticated to any of our 15 AWS accounts. We passed SOC 2 with only 1 minor documentation finding. This was not an incremental improvement. This was a complete transformation of how we think about security.”
CTO, Enterprise SaaS Company

Key Metrics

Infrastructure Cost Reduction
~$1,400/month to ~$120/month
91% reduction
Security Findings
24 findings to 1 finding
96% reduction
SSH Keys
70+ keys to 0 keys
100% eliminated
Annual Savings
~$16,800/year to ~$1,440/year
~$15,000 saved
Exposed Applications
12 sites open to 0 sites open
100% protected

Business Impact

  • Eliminated 23 bastion hosts across 15 AWS accounts
  • Protected 12 exposed internal sites with Cloudflare Zero Trust
  • Achieved ~$15,000 annual savings
  • Freed 10+ engineering hours weekly from access management tasks
Private CloudData Analytics & Visualization / Fintech6 months

Apache CloudStack Private Cloud for Data Analytics Platform

Data Visualization Platform Eliminates $23K Monthly AWS Bills with CloudStack

Challenge

A data analytics and visualization platform company burned $23,000 monthly on AWS. Their workloads required flexibility to run multiple Kubernetes distributions, traditional VMs, and storage without vendor lock-in. VMware Broadcom pricing was unpredictable and proprietary.

Solution

We deployed Apache CloudStack on bare metal in Toronto colocation. CloudStack enabled them to run any Kubernetes distribution as VMs, traditional VMs for databases, and Ceph S3 for object storage, all on a single open-source platform with zero licensing fees.

Results

Reduced monthly infrastructure costs by 91% from $23,000 to $2,000. Achieved hardware payback in 2.4 months with $250,000+ net savings in year 1. Enabled any Kubernetes distribution without vendor lock-in.

Client Comment

“ZSoftly showed us CloudStack was the answer: no VMware licensing trap, no AWS lock-in. We can run RKE2, EKS Anywhere, or K3s depending on customer needs. VMs for PostgreSQL. Ceph S3 for data lakes. $55K hardware replaced $23K/month AWS bills. Broadcom would have cost us 10x more. CloudStack gave us infrastructure freedom we could not get anywhere else.”
CTO, Data Visualization Platform Company

Key Metrics

Monthly Infrastructure Cost
$23,000/month to $2,000/month
91% reduction
Annual Savings
$276,000/year to $24,000/year
$252,000 saved
Hardware Payback Period
N/A to 2.4 months
ROI in 10 weeks
Year 1 Net Savings
N/A to $250,000+
After $55K capex
Kubernetes Flexibility
Locked to EKS to RKE2, EKS Anywhere, K3s
Any distribution
VMware Alternative
Broadcom licensing trap to Open-source CloudStack
Zero licensing fees

Business Impact

  • Eliminated $23,000 monthly AWS infrastructure costs
  • $55,000 hardware investment with 2.4-month payback period
  • $250,000+ net savings in year 1 after capex
  • Avoided VMware Broadcom unpredictable licensing and pricing