You bought your infrastructure, your auth, your payments, even your AI models. What did you actually build, and why is the split right?

The full executive answer

The split follows one rule: buy commodity, build differentiation — spend engineering only where it creates something a competitor cannot download. Bought, deliberately: hosting (Vercel), database platform (Supabase — though the database itself is standard open-source Postgres), identity (Clerk — because self-built auth is where startups create security incidents), payments (Lemon Squeezy/Stripe), email, error tracking, analytics. Every one of these is a solved problem where the market leader's product is better than anything a team our size could build, and every one is a swappable layer, as we discussed on lock-in.

Built, and this is where all 68 modules of engineering went: the governed AI decision layer that is the product. The diagnostic and scoring engines; the AI gateway with dual-provider failover, schema-validated outputs, corrective retry and guardrails; injection-neutralisation and PII redaction ahead of every model call; the hash-chained audit and provenance system that makes AI output defensible in front of a board; the event backbone, connectors and public API; and the evaluation harness that regression-tests AI behaviour in CI without spending a single model call. None of that is buyable — it is the moat.

In pace-layering terms: systems of record and infrastructure bought at commodity pace; the system of differentiation built and iterated fast on top. The result a digital officer should care about: a team this small ships a 414-endpoint enterprise platform because zero engineering hours go to reinventing hosting, auth or billing.