# Tenchi

> Tenchi DWC-LLC is a firm based in Dubai, UAE, working internationally, with two practices: secure platform development (designing, building and operating SaaS platforms with AI-assisted development and security from the first commit) and cyber security consultancy (certification readiness, security leadership, cloud and pipeline security, resilience and AI governance for platforms that carry regulated data). Tenchi built and operates Aikaya (https://aikaya.net).

Contact: info@tenchi.biz
Book a call: https://calendly.com/goran-pizent-tenchi/30min
Website: https://tenchi.biz/
Product: Aikaya — https://aikaya.net (built and operated by Tenchi)
Languages: English
Delivery: remote-first, international. Clients across Europe, the United Kingdom and the Gulf.
Experience: 20+ years of information security leadership, spanning internal IT audit in banking, penetration testing and forensics, secure software engineering, DevOps and DevSecOps leadership, and company-wide security ownership at a cloud platform serving regulated EU financial institutions.

## Practice 1: Secure platform development

- **Secure SaaS, end to end** — product and platform architecture with the threat model written first, AI-assisted implementation with human review on security-relevant paths, authentication, tenancy isolation, secrets and audit logging designed in, payments, subscriptions and media delivery on proven providers, delivered on a compliance-ready cloud footprint and operated after launch if required.
- **Reference: Aikaya** (https://aikaya.net) — Tenchi's own platform: software for yoga, breathwork and meditation teachers to sell recorded classes from their own storefront. Private video upload and transcoding, payments through each teacher's connected Stripe account, tiered subscription plans, consent-based cookies.

## Practice 2: Cyber security consultancy

- **Certification readiness** — SOC 2 Type 2 and ISO 27001 run end to end: gap analysis, policy set, control design and implementation, evidence readiness, auditor coordination and remediation through to opinion.
- **Fractional CISO** — security leadership on retainer: strategy and roadmap, enterprise risk register, risk assessments and treatment plans, executive and board reporting, vendor risk, and assurance for regulated customers.
- **Cloud and platform security** — architecture and configuration review across AWS, GCP and Kubernetes; identity and access design, secrets management, workload isolation, central logging, detection and alerting.
- **DevSecOps and secure SDLC** — threat modelling, architecture and code review, SAST/SCA/DAST selection and tuning, build integrity, artefact provenance, dependency control, and software-supply-chain controls to SLSA levels 1 and 2 with in-toto attestation.
- **Incident response, BC/DR and ransomware resilience** — incident response plans, severity models, SIRT roles and escalation, business continuity and disaster recovery planning with achievable RTO/RPO, immutable backup strategy, tested restore, tabletop exercises, root-cause analysis and corrective actions.
- **AI security and governance** — AI-system inventory and risk classification aligned to the EU AI Act and the NIST AI Risk Management Framework (govern, map, measure, manage), acceptable-use and accountability models, human oversight, security and privacy controls for model access and data flows, and vendor assessment for AI providers.

## Engagement models

- Product build — AI-assisted delivery of a secure SaaS platform, end to end.
- Fractional CISO retainer — monthly, named accountability, ongoing ownership.
- Fixed-scope assessment or audit — defined scope, fixed price, written findings and a plan.
- Programme delivery — the programme is built and handed over running.
- Advisory hours — a block of time for architecture calls, reviews and second opinions.

## Selected work (client names confidential)

- Regulated fintech platform: company-wide security strategy, SOC 2 Type 2 and ISO 27001 through external audit, enterprise risk register, incident response and BC/DR governance, EU AI Act-aligned AI governance.
- Global blockchain network: CI/CD security, build integrity, artefact handling and dependency control for one of the largest blockchain implementations in the world.
- Enterprise supply chain: secure build pipelines using SLSA concepts and in-toto attestation, demonstrated to enterprise clients.
- Banking IT audit: CobiT, ITIL and ISO 27001 audits, with findings reported to a management board.
- Securing IoT platforms: security ownership for a connected-device platform — authenticated device access and credential lifecycle, segmented device-to-backend communication, hardened infrastructure with baselines enforced in code, and central logging for detection across the fleet.
- Aikaya (https://aikaya.net): Tenchi's own SaaS platform, designed, built and operated end to end with AI-assisted development.

## Who Tenchi works with

- Founders and companies that need a SaaS platform built securely and ready for a security review.
- Regulated SaaS, fintech, blockchain and enterprise platforms that need SOC 2 Type 2 or ISO 27001, a fractional CISO, or security engineering.
- Clients in the EU, the United Kingdom, the UAE and the wider GCC, and further afield.

## How to engage

1. Book a 30-minute call: https://calendly.com/goran-pizent-tenchi/30min
2. Or email info@tenchi.biz with what the platform does, what is forcing the timing, and what is already in place.
Enquiries receive a reply within two working days.

## Technology

AWS, GCP, Kubernetes, Docker, Terraform, Ansible, Jenkins, GitHub Actions, GitLab CI/CD, Linux, HashiCorp Vault, CrowdStrike, Graylog, PostgreSQL, MongoDB, SAST, SCA, DAST, SLSA, in-toto, threat modelling, vulnerability management, penetration testing, CobiT, ITIL.

## Pages

- [Home](https://tenchi.biz/): positioning, service overview, engagement models, track record.
- [Services](https://tenchi.biz/services.html): both practices in detail, with deliverables.
  - [Secure platform development](https://tenchi.biz/services.html#platforms)
  - [Cyber security consultancy](https://tenchi.biz/services.html#security)
  - [Certification readiness](https://tenchi.biz/services.html#certification), [Fractional CISO](https://tenchi.biz/services.html#ciso), [Cloud & platform security](https://tenchi.biz/services.html#cloud), [DevSecOps](https://tenchi.biz/services.html#devsecops), [Incident response & BC/DR](https://tenchi.biz/services.html#resilience), [AI security & governance](https://tenchi.biz/services.html#ai-governance)
- [About](https://tenchi.biz/about.html): background, selected work, how the practice works.
- [Contact](https://tenchi.biz/contact.html): book a 30-minute call or email info@tenchi.biz, and what to include.
- [Aikaya](https://aikaya.net): Tenchi's own platform for teachers selling recorded classes.

Last updated: 2026-10-29