We build the software and infrastructure your business quietly depends on.

SPELL BOOK AND CANDLE LTD operates as a focused technology company. We assemble small, senior teams around each engagement and remain accountable for the systems we build long after they enter production. Our clients are organisations whose operations, revenue, or reputation rely on software behaving correctly under real conditions.

We work across the full lifecycle: architecture, delivery, operations, and continuous improvement. The company was structured to avoid the typical trade-offs between consulting-style breadth and product-team depth — we bring the discipline of a product organisation to work delivered under a services model.

Every engagement begins with discovery: we sit with the people who will use and operate the system, map current workflows, and agree on the outcomes that will define success. From that shared understanding we produce a working architecture, a delivery plan with visible milestones, and a working environment within the first two weeks.

We deliver in short, reviewable increments. Code is written test-first where the domain allows, subject to peer review, and shipped through automated pipelines. Nothing enters production without instrumentation, rollback, and a named owner. When priorities change — and they will — we replan openly rather than absorb the change silently.

Security is designed into systems, not applied afterwards. We conduct threat modelling during architecture, harden defaults, review dependencies continuously, and align controls to recognised frameworks such as ISO 27001, SOC 2, NIST CSF, and the OWASP ASVS. Identity, secrets, logging, and access review are treated as core deliverables.

For organisations without an in-house security function, we run structured programs: posture assessment, remediation planning, monitoring, tabletop exercises, and readiness for third-party audits. For established security teams, we provide additional engineering capacity where it is needed most.

• Senior teams, throughout

  The engineers who plan the work stay on the work. We do not staff with juniors under a senior badge.

• Written accountability

  Decisions, risks, and trade-offs are recorded. There is always a document that explains why the system is the way it is.

• Operational realism

  We consider the second year of a system before we ship the first. Runbooks, cost, and evolution are part of the design.

• Independent by design

  We are not a reseller of any vendor's stack. Recommendations reflect what suits the problem, not a partnership tier.

• Clear communication

  No status theatre. Progress is demonstrated, risks are named early, and estimates are revised in the open.

• A long-term horizon

  We build with the assumption that we, or the client's team, will be maintaining the system in five years.

Our approach to quality begins with the definition of "done" and ends only when a change has been observed to behave correctly in production. We combine unit and contract tests for internal correctness, integration and end-to-end tests for user-facing behaviour, and targeted performance and resilience tests where the system's obligations demand them.

Test suites are part of the delivered product. They run on every commit, gate every deployment, and are maintained with the same care as the code they cover. Where the domain justifies it, we add exploratory testing, accessibility review, and structured user acceptance sessions with the people who will operate the system.

We deliberately keep our list of concurrent engagements small. Each client is assigned a technical lead and a delivery lead who remain constant across the work; escalation paths are known from day one. This structure is what allows us to keep decisions coherent as systems grow and priorities shift.

Whether the engagement is a discrete build, an embedded team alongside your engineers, or a longer-term operational partnership, the principle is the same: fewer, better relationships, sustained over time.