- From
- Blue Pen Solutions
- To
- Series A & B founders, CEOs and CTOs
- Re
- Technology leadership, on call
The technology leader who also builds.
Hands-on technology leadership for Series A and B companies. We set the strategy, draw the architecture and write the code, leading your team or building alongside you.
On your team when you need us. Off the clock when you don’t.
- Done: Roadmap agreed with the CEO
- Done: Architecture drawn, estimate attached
- Done: First release in production
- Done: SOC 2 controls mapped
- Crossed out:
Six-month contract, billed hourly
Back in for the next release
§ 01
Services
Every service runs the same way: we step in for the work, step out when it ships, and step back in when you need us. The work comes and goes. The partnership doesn’t. See § 02.
A leader and a builder, in one seat.
Most growing companies need two things at once: someone to set direction, and someone to get it built. We do both. Start with leadership, or with a single project.
-
Fractional technology leadership, hands-on key offer
Senior capacity without a full-time executive hire.
We own technology the way a CTO would: strategy, roadmap, architecture, budget and the conversation with your board. Then we open the editor and build. No handing a slide deck to someone else.
You have a team
We lead it and make it more effective: clear priorities, sound practices, AI-first workflows, and coaching for your leads.
You don’t, yet
We are the hands. We build the first version ourselves, then help you hire the team that takes it forward.
You get One seat that covers the plan and the code.
-
Architecture & planning
Plan through architecture.
A good plan is a drawing before it is a date. We map the system you have and the one you need, then build the roadmap and the estimates from that drawing, so timelines come with reasons.
What we do
- A 3–12 month technology roadmap tied to business goals
- Architecture and cloud review, including technical debt
- Estimates built from the architecture, not guesses
- A path from early-stage code to a platform that scales
You get A plan your board and your engineers can both read.
-
AI-first project delivery & team enablement
Focused work, shipped fast. A team that keeps the speed.
For a defined project, we scope it tight, build it AI-first and ship it in small releases you can see. For your team, we make AI-first development the daily practice, not a pilot.
What we do
- Ship full-stack features and products: web, mobile, backend, data
- Set up Cursor, Claude Code and the workflow around them
- Add AI code review to every pull request
- Pair with your engineers on real work, not demos
You get Working software, and a team that builds faster with AI.
-
SOC 2 & HIPAA compliance flagship
The report your enterprise customers ask for, without a security team.
We own the whole program, from choosing the tools to closing out the audit, and leave your team able to run it.
What we do
- Policies, controls and evidence
- Compliance automation with Vanta
- Auditor selection and remediation
- HIPAA readiness planning for healthcare products
-
Technical due diligence
Walk into the raise with answers ready.
Investors will look hard at your architecture, security and team. We have led technical due diligence through fundraising, and we prepare you the same way.
What we do
- Prepare the architecture and security documentation
- Find and fix the weak spots before investors do
- Walk investors through the platform
- Answer the technical questions as they come in
You get Confidence in the room that your platform will scale.
§ 02
How we engage
Your right hand, on call.
No 6- or 12-month contract. No retainer for idle time.
The Standing Seat
On the team. Off the clock.
We keep a seat on your team. When there is work, we step in and do it. When it ships, we step out and the billing stops. When the next project comes, we step back in, already knowing your architecture, your people and your decisions.
-
Step in
We join for a defined piece of work: a launch, a re-architecture, an audit, a raise. You pay for that work.
-
Step out
When it ships, billing stops. We stay reachable and keep the architecture notes and decisions on record.
-
Step back in
Next project, we pick up where we left off. No re-hiring, no onboarding from zero.
-
Always
The context stays with us: why the system is built the way it is, and what we would do next.
| Question | Full-time hire | 6–12 month contractor | The Standing Seat |
|---|---|---|---|
| Commitment | Permanent | 6 to 12 months, signed up front | One project at a time |
| You pay for | Salary, equity and benefits, every week | Every hour they’re booked, busy or not | The project work |
| Between projects | Still on payroll | Still billing, or gone | No bill. Still reachable. |
| Context | Stays, as long as they do | Leaves when the contract ends | Kept. We know your system. |
| Restart | A search, then ramp-up | A new contract, then onboarding | Pick up where we left off |
§ 03
Compliance
Our flagship practice.
We don’t issue SOC 2 reports. Independent CPA firms do. We get you ready and run the process with them.
SOC 2 and HIPAA, without a security team.
Enterprise customers and investors want proof you take security seriously. Compliance gets done when someone owns it. We own it, from choosing the tools to closing out the audit, and we have done it at SaaS companies with no dedicated security team.
| No. | The work | You walk away with | Status |
|---|---|---|---|
| 01 | Plan. Pick the scope, the trust criteria and the compliance platform. | A plan with owners and dates. | |
| 02 | Policies. Write the policies: security, access, change management, risk, continuity. | Policies that match how your team really works. | |
| 03 | Controls. Put access controls, audit logging and change management in place in your cloud. | Controls mapped to real systems, not a spreadsheet. | |
| 04 | Automation. Roll out Vanta to monitor controls and collect evidence across your cloud accounts. | Evidence that collects itself. | |
| 05 | Continuity. Design and validate disaster recovery for your platform. | A recovery plan built for your real architecture. | |
| 06 | Audit. Hire the auditor, act as their main contact, and drive every finding to closure. | Findings closed on time. | |
| 07 | Handoff. Document the recurring work and train the people who will own it. We stay on call for the next audit cycle. | A program your team runs day to day. |
Building for healthcare?
We plan HIPAA readiness the same way. We map the Security Rule’s administrative, physical and technical safeguards to your systems, find the gaps, and hand you a prioritized plan your engineers can work from.
§ 04
How we work
Get clear. Stay focused. Architecture is the plan.
Most surprises in software come from fuzzy goals and plans nobody can see. So we get clear on the business goal, keep the work focused on it, and draw the system before we commit to a date. Then we tell you where things stand in plain business terms.
-
A written plan
One page: the goal, what’s in, what’s out, the risks and the date. Agreed before work starts.
-
Estimates from the architecture
We sketch the system first, then estimate from the sketch. Every date comes with its reasons.
-
Tradeoffs you can decide on
When there is a choice, you get the options with their cost, time and risk, plus our recommendation.
-
Status in plain language
A short, regular note: what’s done, what’s next, what’s at risk, and what we need from you.
-
Small releases, shipped often
Small, meaningful releases beat a big reveal. You see progress as it happens.
- Done
- Checkout flow is live for all customers.
- Next
- Admin reporting, then a load test before the sales push.
- Risk
- The payment vendor’s test environment is slow. Could cost two days.
- Decide
- Launch reporting to everyone, or to a small group first? We recommend the small group.
§ 05
Capabilities
Grouped by the problem it solves. The tools are listed underneath for your engineers.
The full index.
Everything we can take on, from the board meeting to the build pipeline.
A Leadership & strategy
- Technology strategy and a roadmap tied to business goals
- A partner to the CEO, and a clear voice in the board room
- Technical due diligence for fundraising
- Technology budgets owned and spent where they count
- Hiring, and R&D organized into focused product teams
- Distributed teams led across time zones
- Engineers coached into leads and managers
- An acquired product brought onto your stack and security posture
Agile · Scrum · SAFe · Jira · ClickUp · Miro · Figma
B Architecture & platforms
- Early-stage code turned into a consistent platform that scales
- Legacy systems moved to the cloud, dozens of services at a time
- Microservices and event-driven systems
- Multi-tenant and white-label products run from configuration, not forked code
- Feature-flag platforms for staged, targeted rollouts
- Database migrations, like SQL Server to PostgreSQL
- Systems designed for availability and transaction volume
Microservices · Event-driven APIs · REST · GraphQL · Serverless · YAML/JSON configuration
C AI engineering
- AI-first development as daily practice, not a pilot
- AI code review on every pull request
- Manual data work automated away
- AI-assisted parsing of messy third-party documents
- Data architecture that serves AI, analytics and BI as one asset
Cursor · Claude Code · ChatGPT · Bolt AI
D Cloud & DevOps
- Multi-account AWS with security boundaries and cost separation
- Environments created automatically, with infrastructure as code
- CI/CD pipelines that make releases routine
- Containers and Kubernetes, or serverless where it fits
- Cloud spend you can trace to a product and a budget
AWS (Lambda, EC2, RDS, CloudFront, CloudWatch, Cognito, CloudFormation) · Azure · Google Cloud · Terraform · Pulumi · Kubernetes · GitHub Actions · GitLab CI/CD · Vercel
E Security & compliance
- SOC 2 from first policy to closed audit
- HIPAA readiness planning
- Access controls and audit logging
- Change, risk and access management processes
- Disaster recovery designed and validated
- Compliance monitoring that runs itself
SOC 2 · HIPAA · Vanta · AWS security services
F Product engineering
- New SaaS products taken from zero to one
- Full-stack web applications
- Mobile apps, consumer and in-the-field
- Backend services and APIs
- Data models and databases built to grow
- Team standards for coding, testing, branching and review
Next.js · React · React Native · TypeScript · Node.js · Python · C#/.NET · ASP.NET Core · Entity Framework Core · Java · Kotlin · PostgreSQL · SQL Server · MongoDB · Redis
G Integrations
- Bank transaction ingest, automated
- Payment integrations
- Third-party and vendor APIs connected in production
- Many interdependent services kept working through a migration
Plaid · Payments · REST & event-driven APIs
H Observability
- A logging and metrics strategy that sees more without costing more
- Application health and security monitoring
- Errors and user sessions you can actually debug
Sentry · New Relic · Splunk · LogRocket · CloudWatch
§ 06
About
Led by Tom Krueger.
Blue Pen Solutions is led by Tom Krueger, a technology leader with more than 20 years of building and shipping software, including CTO roles where he stayed hands-on the whole way.
Today we build AI-first and bring that practice to every team we work with.
Most founders don’t need another vendor. They need a technical partner they can count on, someone who can set the strategy, lead the team, or write the code, and who knows which one the moment calls for.
§ 07
Contact
Tell us what you’re building.
A short note is plenty: where the company is, what needs to get built or fixed, and when. The first call is a conversation, not a pitch.