THEKROLL LTD is an independent engineering company based in Cyprus, operating worldwide. We architect, rescue and operate production systems where downtime, data loss or compliance failure are not acceptable outcomes.

Our work covers three core domains:

• Hybrid-Intelligence SaaS — AI-accelerated implementation under human architectural governance. Strict compliance, rigorous review, certified output.
• Sovereign Kubernetes — Self-hosted clusters on bare metal (K3s / RKE2). Full lifecycle ownership, predictable cost, no vendor lock-in.
• Applied Deep Tech — Custom PyTorch models, scalable RAG pipelines and distributed compute. Real engineering, not API wrappers.

In addition we accept Interim CTO and Emergency Leadership mandates: stabilising failing projects, restructuring teams and enforcing technical discipline under pressure.

1. Resilience First — We assume failure. Networks lag, disks rot, services crash.
2. Synthetic Code, Human Governance — AI generates syntax; we architect logic and audit output.
3. Critical Path Defense — We build automated "Iron Domes" around core business logic and data integrity.
4. Speed Is Security — Rescue protocols deploy in minutes, not days.

We publish a small set of hardened OSS supply-chain tools that we run in production for our own internal mirrors. Public repos are provided as a reference, with no SLA. Production users should fork and operate their own copy; the intent is to make the practice visible, not to run a managed service.

The pipeline now runs in production across multiple upstream shapes with very different runtime constraints. That diversity forced us to formalise distinct hardening approaches instead of pretending one Dockerfile pattern fits everything. The table below maps each fork to its path.

Where the mirror pipeline above gates container images on known CVEs, Fathometer covers the other side of the same problem: the handful of plain root servers you own, which spit out hundreds of findings almost none of which are exploitable in your setup. Each finding is scored on two axes — is it reachable / does this host run the vulnerable code path / can the preconditions be met and what's the damage — landing it in one of four tiers (Escalate / Act / Watch / Noise). CVSS, EPSS and KEV feed in as weights, never as the verdict, and every downgrade states which condition is missing so you can check the call. Verdicts are cached, so you only pay the LLM for new findings — typically cents per day on an OpenAI-compatible endpoint you bring yourself.

Flask / PostgreSQL 17 / HTMX, server-rendered, self-hosted single-user, no external CDN dependencies. Reference software, no SLA — run your own copy.

Engineering principles for everything we publish: distroless or hardened base images · digest pinning · reproducible builds · CycloneDX SBOM per release · continuous CVE scanning with Trivy on built artifacts · supply-chain transparency.

Scope: enterprise SBOM & CVE audit. This pipeline gates every release on known CVEs in third-party dependencies that survive into the artifact. Source-level bugs in upstream codebases that never reach CVE/GHSA stay in the upstream project's tracker. We mirror, we don't fork. The signal we care about is what lands in the public vuln DBs that Trivy consumes.

AI-assisted code review, led by Anthropic's Claude Security (Enterprise preview, rolling out to Claude Code users), is about to widen the funnel feeding those DBs significantly. More issues found earlier in major OSS projects, a meaningful fraction disclosed and assigned a CVE ID. The CVE volume an enterprise has to triage is going up, not down.

That is what this pipeline is for: making rising CVE volume manageable. Automatic issue filing per finding, waivers with a git-tracked audit trail, scheduled rescans of already-published images so newly-disclosed CVEs surface without a rebuild, gated releases on every nightly. We don't try to find the bugs ourselves. The moment someone else does, you know about it on your own images, with SBOM and audit trail attached.

• Sovereign Document Engine — GDPR-hardened legal document generation platform with decoupled, pixel-perfect PDF rendering. Data residency in Germany. → docs101.com
• Heavy Transport Operations Grid — Unified TMS / ERP / CRM for heavy-haulage logistics. Real-time geospatial route optimisation. → heavylogix.com.cy

We accept a limited number of mandates per quarter. Typical engagements: technical due diligence, architecture reviews, disaster recovery, interim technical leadership, and long-term platform partnerships.

→ thekroll.ltd  ·  info@thekroll.ltd

_{THEKROLL LTD · Registered in Cyprus · Founded 2024 · Architecting scalable SaaS, mastering emergency ops & AI.}