1 of 26

Vibe Coding

Enterprise Infrastructure.

EU Data Compliant

Secure. Private. In your own cloud.

Guntis Čoders · THEO Growth / LEVERAGE AI

Uldis Karlovs-Karlovskis · MoonMoon

2 of 26

Who's talking

Guntis Čoders

Business · sells the speed

THEO Growth / LEVERAGE AI

Uldis Karlovs-Karlovskis

DevOps · makes it true

MoonMoon

3 of 26

Who this is about

400+ CONTRACTS

car leasing, companies and private customers, across the Baltics

MICROSOFT SHOP

365, Entra ID, and an ERP holding every contract and vehicle

DATA THAT CAN'T MOVE

customer records and contracts - EU residency isn't negotiable

4 of 26

The obvious answer

Lovable/Vercel → lawyer → NO.

Your app - and your data - on someone else's cloud.

5 of 26

Then the lawyers read it

Data-protection counsel's review of the vendor's terms · January 2026

Where does the data physically live - and who else touches it?
How does your breach clause square with GDPR's 72-hour notification rule?
You charge for data export. GDPR says you can't.
You “isolate” data instead of deleting it. Define isolate.

6 of 26

Both options were wrong.

SOMEONE ELSE'S CLOUD

fast - and your data lives there

SOC 2 certified or not: never your tenant

DO IT PROPERLY

compliant - and unusable at speed

8-12 tools to ship one service

“Speed with no audit trail - or an audit trail nobody can move at.”

7 of 26

“The goal of the project is to build a secure platform, compliant with EU data-residency requirements, on which AlphaLane can rapidly build internal applications using AI tools.”

Same speed. Their cloud. The auditor answered by construction.

8 of 26

DevOps for AI:�A Case Study

How we let a company vibe-code on its own data, safely.

Uldis Karlovs-Karlovskis

Founder/CTO of MoonMoon

9 of 26

What if anyone in your company could build software, as fast as they could imagine it?

10 of 26

AlphaLane Business

Authorities

With a “Fine” problem

Leased Cars

Fine

Fleet Business

Customer Data

Fine

Customer

11 of 26

They already had the ingredients

A modern foundation, and years of data sitting idle underneath it.

Microsoft o365

ERP System

Customer Records

Identity + Mailbox

Vehicle + Contract Data

Years of Data

12 of 26

improve this speed?

What if WE could

13 of 26

Vibe-code on our own data.

Build fast with AI

14 of 26

Problems with AI

No isolation

One wrong line lands on the live business, no undo.

Data residency

Once AI touches it, where does the data actually live?

Data egress

Their data, sent to an AI service they don't control.

15 of 26

Inside their Own Infrastructure

Our Proposal

A safe place to vibe and build

(Staging + Testing environments)

Live business

(Production environment)

IDEA

Single click of a button

16 of 26

Connected Fleet

One application connects people, fleet data, AI services, identity, and notifications

TRAFFIC AUTHORITY

Issues traffic fines

FLEET MANAGER

Manages fines and fleet

DRIVER

Receives fine alerts

APPLICATION DB

AZURE POSTGRESQL

Fines, users, and application data

FINE APP

NEXT.JS 16

Fine processing, fleet management, notifications, and staff access

DIRECTO SYNC

NODE.JS

Pulls fleet data from Directo every 15 minutes

SYNC DB

AZURE POSTGRESQL

Stores Directo synchronization state

AZURE AI

Classifies fine emails

MICROSOFT 365 EMAIL

Fine inbox + driver notifications

ENTRA ID

Staff authentication

DIRECTO ERP

Fleet data source

AI FLEET MANAGEMENT SYSTEM

MICROSOFT SERVICES

FINE EMAIL

BROWSER · HTTPS

FINE ALERT · EMAIL

SQL

REST API

SQL

HTTPS · JSON

GRAPH API

OIDC

HTTPS · XML

17 of 26

The Result

PUSH

TRIGGER

PROVISION

VIBE CODER

git push

GITHUB ACTIONS

BUILD.YML

Image → ACR

DEPLOY.YML

Migrate · deploy · smoke

CI-ENV.YML

Ephemeral env · TTL

OIDC · no long-lived secrets

TERRAFORM · IaC

terraform apply · state in Azure Storage

AlphaLane AZURE TENANT

Private Vnet + Peering · no public endpoints

AZURE CONTAINER REGISTRY

Versioned application image

CONTAINER APPS ENVIRONMENT

APP + JOBS

migrate · cron

PRISMA MIGRATE

POSTGRESQL

Flexible Server · private

LOG ANALYTICS + AZURE MONITOR

MANAGED IDENTITY + OIDC

Customer-owned infrastructure · provisioned and operated privately

DEPLOY

PUSH IMAGE

So how is that actually built? Under the hood, This is how it looks, so a vibe coder pushes the changes, CI/CD is GitHub Actions: push code, and build.yml builds an image into Azure Container Registry; deploy.yml runs Terraform, applies the Prisma migrations, ships to Azure Container Apps, and smoke-tests itself before it's allowed to pass; and ci-env.yml spins up throwaway environments on demand and tears them down. ��Everything is Infrastructure-as-Code, Terraform, so the whole environment is reproducible and version-controlled, with state kept in Azure Storage. �The database is a private PostgreSQL inside their own VNet, no public endpoint, and GitHub talks to Azure through a managed identity over OIDC, so there are no long-lived secrets anywhere.��That's the full machinery. But strip it back, and it really comes down to four ideas that make it safe.

18 of 26

Four things make it work

1

2

3

4

SANDBOX

Isolated, Production Equivalent, Ephemeral environments

GUARDRAILS

Gated destructive operations

ONE-BUTTON RELEASES

Automated, self-verifying CI/CD

DATA NEVER �LEAVES

IaC + private networking, no egress

19 of 26

What changed

We built the guardrails so they could build fast, safely and without ever handing over their data.

	BEFORE	NOW
SHIP A CHANGE	weeks	hours
TRY AN IDEA	on production / locally	isolated ephemeral production equivalent environment
GO LIVE	manual, error-prone	automated, self-verifying pipeline
WHERE DATA LIVES	external / uncertain	100% inside their private network, no egress
WHEN IT BREAKS	a customer reports it	alerting + automated rollback

20 of 26

21 of 26

Result #1

22 of 26

I built it both ways.

Consumer platform first. Then this one.

Same speed. Same tools.

What changed is that I stopped being the risk.

23 of 26

12

WEEKS

5

WEEKS

APP #1

contract signed to real fines flowing

APP #2

same syncs, same contracts. In build now.

24 of 26

Not a delivery. A working session.

The next environment — without the engineer.

the working session - together

repeated on their own

25 of 26

The platform -

not the app - is the asset.

OWN TENANT · ORG IDENTITY · VAULT · EU-RESIDENT AI · CONNECTORS BUILT ONCE

26 of 26

Thanks!

Guntis Čoders · theleverageai.com

Uldis Karlovs-Karlovskis · moonmoon.ai