M2 InfoTech is a UK consultancy that rebuilds the systems large organisations depend on. We migrate legacy databases, design cloud platforms, automate testing and codify infrastructure — for clients in government, banking and healthcare where a failed release makes the news.
We do not hand you a strategy deck and leave. Our engineers embed in your teams, work to your change process and stay until the thing runs in production without us.
Automated test suites that catch regressions before your users do, built into the pipeline rather than bolted on at the end of a sprint.
Landing zones, workload migration and day-two operations across the three major clouds, with cost controls designed in from the start.
Moving decades of data off systems nobody wants to touch, with rehearsal runs, integrity checks and a rollback plan you never need to use.
Reusable, peer-reviewed Terraform modules published to your private registry, so every environment is built the same way by anyone on the team.
Resilient, observable infrastructure built from the network up, plus the golden paths that let your product teams ship without raising a ticket.
Evidence-ready security posture for regulated industries, aligned to the frameworks your auditors and commissioners actually ask about.
Regulated sectors do not need generic engineers. They need people who have already been through the assurance gates, the change advisory boards and the audits.
Digital services built to the GDS Service Standard, from alpha assessment through to live. Experience of Crown Commercial frameworks and spend controls.
GDS Service Standard experienceClinical-adjacent systems where availability is a patient safety issue. DSPT-aligned infrastructure, NHS Digital integration and information governance.
DSPT-aligned deliveryTrading-adjacent platforms, core banking migration and the change controls that come with regulated financial infrastructure.
Zero severity-1 incidents at cutoverPCI-DSS scope reduction, tokenisation and cardholder data environment design, plus the testing evidence your QSA will ask for.
PCI-DSS v4.0 readyHigh-throughput network infrastructure, Kubernetes at scale and observability across estates measured in thousands of nodes.
Kubernetes and cloud infrastructureOperational technology meeting cloud, with segmentation, resilience planning and the safety cases that regulators expect.
NIS Regulations alignedClient names are withheld where commercial terms require it. Reference calls can be arranged under NDA during procurement.
A core savings platform ran on an Oracle estate three versions behind support, with a licence renewal due and no migration path agreed.
We ran repeated rehearsal migrations against production-shaped data, built row-level reconciliation for every table, and cut over on a Sunday morning using change data capture to keep the migration window short.
The bank retired the Oracle contract at renewal and now runs the platform on managed PostgreSQL.
A citizen-facing service released once every six weeks behind a two-week manual regression pass run by a team of contract testers.
We built an automated regression suite, wired it into the deployment pipeline with quality gates, and trained the department's own engineers to own and extend it.
The manual pass was retired. The service now deploys on demand and the in-house team has run it without us for over a year.
Cloud accounts had grown organically for five years. Nobody could say with confidence which workloads touched cardholder data, which made every audit a three-month exercise.
We rebuilt the estate as versioned Terraform modules with policy-as-code guardrails, clarified the cardholder data environment and automated the evidence collection the QSA needed.
Audit preparation is now a report, not a project.
Every engagement follows the same shape, whether it is a six-week discovery or a two-year programme. You always know what the next gate is and what it costs.
We map the estate, interview the people who keep it running and write down the risks nobody has written down before. You get a findings report whether or not you continue.
2–4 weeks · fixed priceA target design, a sequenced migration path and a cost model, reviewed with your architects and signed off before anyone writes production code.
3–6 weeks · fixed priceEngineers embedded in your squads, working to your change process, with fortnightly demos and a burn-down you can see. Rehearsals before every cutover.
Time and materialsRunbooks, training and a period of shadow support while your team takes the controls. Our measure of success is that you stop needing us.
4–8 weeks · fixed priceAll engineers are DBS checked, with SC clearance held or sponsored, so government work starts without a three-month vetting delay.
Pre-built onboarding runbooks, environment checklists and access templates mean day two is a working day, not a setup day.
Every engagement opens with discovery. We would rather tell you the migration is a bad idea in week two than in month nine.
Core team in the United Kingdom, with rotating out-of-hours support for systems that cannot wait until Monday.
Deep familiarity with the GDS Service Standard, the Technology Code of Practice and NHS information governance.
The engineers in the pitch are the engineers on the project. We do not sell senior people and deliver graduates.
They found two integrity problems in our data that had been there since 2011. Neither was in scope. They fixed both before cutover.
Head of Data Platforms, UK retail bank
The first thing they did was tell us the approach we had already agreed with another supplier would not pass assessment. That saved the programme.
Deputy Director, central government department
A year after they left, the suite they built is still green and our own engineers are extending it. That is the part most suppliers get wrong.
Engineering Manager, healthcare technology provider
Most overruns trace back to the same place: nobody rehearsed against production-shaped data until month six.
Read > Public sectorWhat assessors actually look for, and the evidence worth gathering long before the panel date.
Read > Infrastructure as codeVersioning, deprecation and the ownership model that keeps a module library from becoming the thing everyone forks around.
Read >Send a short note about the system, the deadline and the constraint. A senior engineer replies within one business day — not a sales development representative.