Approach

A delivery method designed for accountable organisations.

Our method is built for clients who must justify decisions, protect data, and keep systems running long after the project ends. It is deliberately structured: gated phases, written outputs, and decision points where you can adjust course or stop.

Phases

Seven phases, each gated by a reviewable output.

Phases may be compressed for small projects or run iteratively for larger programmes, but the sequence and the outputs stay the same.

  1. 01

    Discovery

    Understand the workflow, the people, the data, and the constraints.

    Activities: stakeholder interviews, process observation, systems and data inventory, review of policies and compliance requirements, definition of success measures.

    Outputs: problem statement, current-state map, constraints register, success criteria, options and recommendation, phased estimate.

    Gate: client confirms scope and approach, or decides not to proceed.

  2. 02

    Design

    Agree what will be built before building it.

    Activities: target architecture, data model and flows, interface wireframes and design, security and privacy design, definition of human oversight points for AI components, test strategy.

    Outputs: architecture document, design specifications, data protection assessment where required, acceptance criteria.

    Gate: design sign-off by client stakeholders, including security or data protection functions where applicable.

  3. 03

    Build

    Develop iteratively, with regular working demonstrations.

    Activities: development in short cycles, automated testing, code review, demonstrations on realistic scenarios, continuous documentation.

    Outputs: working software in a staging environment, test reports, updated documentation, change log.

    Gate: features accepted against agreed criteria at each demonstration.

  4. 04

    Integrate

    Connect to the systems and data that make it real.

    Activities: interface development against existing systems, identity integration, data migration or synchronisation, controlled testing with real data under agreed safeguards.

    Outputs: interface specifications, migration and reconciliation reports, integration test results.

    Gate: system owners confirm integrations behave as specified.

  5. 05

    Test

    Verify function, security, accessibility, and AI behaviour.

    Activities: user acceptance testing, security review and remediation, accessibility audit, performance testing, AI evaluation against the agreed test set, pilot operation where appropriate.

    Outputs: test and evaluation reports, known issues register, go-live readiness checklist.

    Gate: go/no-go decision for launch.

  6. 06

    Handover

    Transfer ownership completely.

    Activities: deployment to production, credentials and infrastructure transfer, administrator and user training, documentation review.

    Outputs: source code and infrastructure definitions in client-owned repositories, architecture and operations documentation, runbooks, training materials.

    Gate: client confirms it holds everything needed to operate, extend, or re-procure the system.

  7. 07

    Support

    Keep it secure, current, and useful.

    Activities: monitoring, incident response, security and dependency updates, periodic review of usage and AI evaluation results, improvement backlog.

    Outputs: service reports, update logs, improvement recommendations.

    Gate: regular review of the support arrangement; the client may end or transfer it at any time.

Governance and security

Practices that hold on every engagement.

We adapt to the client's own frameworks and policies. Where a client has none for a given area, these are the defaults we bring.

Project governance

A named client sponsor and project lead on both sides; written scope and change control; regular progress reporting; risks and decisions logged and visible.

Security by design

Threat consideration at design stage; least-privilege access; encryption in transit and at rest; secure development practices; dependency and vulnerability management; security review before launch.

Privacy by design

Data minimisation; purpose limitation; retention rules; data protection assessment for sensitive processing; compliance with Rwanda's data protection and privacy legislation and client policies.

Working within client environments

We operate within client infrastructure, identity systems, and security policies where required, including on-premises or in-country hosting and client-controlled credentials.

Documentation

Documentation is produced during the project, not after it: architecture decisions, interface specifications, operational runbooks, user guides, and an AI model card for each AI component.

Procurement and compliance

We support tender processes with clear technical proposals, realistic timelines, and the documentation evaluation committees need. We state our assumptions and exclusions explicitly.

Inclusive service design

Built for the people who actually use the service.

Multilingual by structure

Content models, interfaces, and AI components designed for Kinyarwanda, English, French, and Swahili from the outset, not translated as an afterthought.

Accessible by default

WCAG 2.1 AA as the working standard for public-facing interfaces, with testing using assistive technology and documented exceptions where they exist.

Realistic about connectivity and devices

Interfaces that work on modest phones and intermittent connections, with offline tolerance where field use demands it.

Working together

Planning a project that needs this level of structure?

We are glad to walk through the method in detail, adapt it to your governance, and provide sample deliverables from previous phases.