Context
StockAmbit S.A. is a regulated fintech operating under the supervision of the Polish Financial Supervision Authority (KNF). We held the CTO role there, accountable for technology strategy, architecture, building and developing the team, DevOps culture and regulatory compliance. The starting point was an empty repository: the crowdfunding platform was built from zero and had to reach production on Azure.
Problem
A technology startup and a supervised entity optimise for two different things. A startup buys time with shortcuts, ship, measure, fix, and write the documentation once it is clear what survived. A supervised entity has no such option: it must be able to demonstrate how it operates, on the basis of records created at the time the operation happened. Compliance cannot be backfilled, because the evidence is the trail rather than the statement.
The naive framing is MVP first, compliance layer later. It does not hold, because two decisions from the first week are effectively irreversible. The first is the personal data model and the boundaries of its processing. The second is how the system records events, if the log is not accountable and immutable from the start, every later question about who approved what ends in reconstruction from memory. The cost of reversing either grows faster, week by week, than the cost of doing it properly at the outset.
Approach
We inverted the usual sequence of work. We began with the elements that are most expensive to change later rather than those that demonstrate best: identity and access control, accountability of operations, the data model and the lawful basis for processing it, and only then product features, built on a foundation that already existed.
Choosing public cloud inside a supervised entity is not an infrastructure decision but a compliance decision. We designed the Azure architecture against the supervisory requirements for processing information in the cloud: information classification before service selection, explicit data location and encryption, a defined exit scenario. That narrowed the catalogue of services available to us, deliberately at the cost of some of the convenience managed cloud offers.
We treated DevOps as an evidential mechanism, not as culture in the declarative sense. A deployment that passes through a CI/CD pipeline, with a record of what reached production, when, and on whose approval, is simultaneously an engineering practice and material that can be presented. In an organisation like this, a manual production deployment is not a convenient shortcut, it is a gap in the record.
We treated hiring as part of the architecture, because in a small team the distribution of skills determines directly which designs are maintainable. A team with nobody accountable for security will always build a system in which security is a configuration option.
The cost of this ordering was real: the first visible product features arrived later than they would have without a regulatory regime. That is not a price open to negotiation, it is the condition of entry to this market.
Outcome
The crowdfunding platform went from zero to production on Azure under KNF requirements, with the team and the delivery practice built over the same period. Compliance was a property of the architecture rather than a separate project running alongside development.
What it taught us
Compliance by design only means something when it describes the order of work rather than a paragraph in a document. In practice it reduces to one question asked at every decision: a year from now, will we be able to demonstrate how this worked, from records that are being created today.
The second lesson is less obvious: a supervisory regime can be an advantage for a young organisation. It forces identity, accountability and data questions to be settled while nothing is yet entrenched, which is when settling them is cheapest.