From prompt to production
Symboolic is building Bright Factory — what they call “Lovable for B2B.” Where Lovable spins up an app from a prompt, Bright Factory does it for companies: describe the workload, get a production-grade AWS deployment with security, tenancy and cost controls already wired in.
That promise only works if the platform underneath is genuinely production-grade. Selvatic is putting those foundations in place — across governance, tenancy, the Claude → Bedrock migration, FinOps with real unit economics, and AWS Partner activation.
“Bright Factory’s promise — describe a workload and get it running in production — sounds like marketing until you see what’s under it. Tenant isolation with dedicated KMS, account vending, FinOps per client: the actual architecture your project runs on. Customers don’t usually see this part, but it’s what makes the abstraction real. Selvatic built it before we knew in detail what we’d need, and their expertise is our guarantee of staying current — because production-grade means never lagging behind.”
— Giovanni Tardini, Founder at Symboolic
Foundations: governance, security, tenancy
Working alongside the Symboolic team, we put a Control Tower–aligned landing zone in place: a multi-account AWS Organization with dedicated Organizational Units (OUs) for customers, workloads, demo and security, each governed by scoped Service Control Policies (SCPs). Identity is federated through IAM Identity Center against Google Workspace. GuardDuty and Security Hub run org-wide with delegated admin and a central aggregator account — the AWS best practices these companies often defer until something breaks, switched on from day one.
Customer environments aren’t manually crafted — they’re stamped from canonical templates with security and tenant isolation baked in. Bright Factory writes onto that substrate; it doesn’t bolt on afterwards.
Identity and delivery: least-privilege by default
In an AI platform, the blast radius of a misconfigured credential is enormous — model spend, customer data, tenant isolation, all reachable from one wrong key. We’ve made that surface as small as possible.
- Identity flows through IAM Identity Center, federated against Google Workspace. Engineers receive scoped permission sets per role — platform admins, dev engineers, prod readers — with short session durations and named groups. No long-lived IAM users.
- EKS clusters are split: dev and prod run as separate clusters in separate Virtual Private Clouds (VPCs), with separate KMS keys and separate container registries. No peering between them by default. Access flows through EKS Access Entries with managed policies — not legacy
aws-auth. - Production is automated. Humans don’t push to prod; CI/CD pipelines do, gated by checks and approvals. Standing engineer access to production is read-only or none at all.
The pattern doubles as audit preparation: every change that reaches production has a commit, a build, and a reviewer attached to it.
The model layer: from Claude API to Amazon Bedrock
Symboolic was consuming Claude through Anthropic’s direct API. We’re migrating to Amazon Bedrock for three reasons:
- Cross-region inference. Requests route to the optimal region within an EU, US or global geography automatically. Resilience without client-side load balancers; traffic stays on the AWS backbone.
- Privacy and compliance. No data sharing with model providers, no training on customer data, customer-managed KMS, PrivateLink-reachable. For regulated EU customers, a real differentiator.
- Unified interface. The Converse API gives one integration across Claude, Nova, Llama, Mistral. Intelligent model routing — Opus for hard tasks, Sonnet/Haiku for the rest — becomes a config change. One of the strongest FinOps levers available right now.
Side effect: spend consolidates inside AWS, simplifying governance, attribution and Marketplace mechanics.
FinOps: real unit economics, not just the bill
In multi-tenant SaaS, “the AWS bill” means nothing on its own. The question that matters: what does customer X cost us per month, per request — and how does that compare to what they pay us?
- Tagging consistency enforced by policy.
- Cost allocation per tenant across shared resources — databases, model inference, control plane — with explicit methodologies by usage, storage or inference tokens.
- Margin-per-customer dashboards that feed product and pricing decisions, not just finance.
Continuous optimisation runs on top through Vantage: rightsizing, idle resources, Savings Plan gaps, Bedrock routing opportunities. Closed loop, not annual audit.
The AWS Partner path
We’re backing Symboolic’s journey as an AWS Partner and their broader relationship across the AWS ecosystem. Formal alignment with AWS unlocks distribution, co-sell motion and the credibility that matters disproportionately in enterprise B2B.
Persona + Bright Factory: closing the loop in regulated industries
The pattern we’re taking to market — starting at HIPTHER Baltics & Nordics in Tallinn this June — targets iGaming and financial services.
In regulated industries, compliance teams own the rules and engineering teams own the infrastructure. The translation between them is manual, slow, and rediscovered every time an operator enters a new jurisdiction.
- Persona lets engineering teams interrogate jurisdictional regulations through an architectural lens. Cited answers mapped to AWS patterns — not legalese.
- Bright Factory ships the result: reusable AWS blueprints per jurisdiction, delivered as infrastructure-as-code, validated against the regulation that drove them, operated by Selvatic against agreed Service Level Objectives (SLOs).
Compliance copilots stop at the answer. Engineering teams start from documents they don’t fully grasp. We close the loop: question → architecture → running workload. Every jurisdiction onboarded becomes a reusable factory line.
The Selvatic way of working
Deep AWS engineering, FinOps that maps to product economics, a clear path to AWS Partner distribution. Not slideware. Production foundations, shipped fast, owned end-to-end.
Building or running something serious on AWS?
