The questions a CTO asks before the CEO gets to say yes.
What we build with, how it connects, who holds the keys, and what you are left owning when we stop. If something here does not answer your question, ask it directly — an unanswered architecture question is a stalled deal, and we would rather lose the week than the trust.
What we build with
Vendor-neutral by construction. We sell no platform, which is the only durable reason to trust a recommendation.
- Licence floor
- MIT or Apache 2.0 across the stack. If a component cannot be licensed that way it needs a written reason, and the reason goes in the handover.
- Two alternatives per layer
- Every layer we introduce has at least two viable replacements identified before it is adopted. Rendering, storage, graph, simulation, model provider — none of them is a one-way door.
- Runs where the asset is
- Edge-native and local-first where the data is sensitive or the link is unreliable, sync-later where it is not. A twin that stops working when the connection drops is not a twin of an operating plant.
- Geospatial anchoring
- Models are anchored to real coordinates rather than to a file format, so the same method works across sites and survives a change of tooling.
How it connects to what you run
We read from the systems you already pay for. Up to 99% of what a first twin needs already exists somewhere in your estate.
- Read-first
- Initial integrations are read-only. Nothing writes back to a production system until you have seen the same change rehearsed in the model and explicitly approved the write path.
- Reality as the join
- ERP, historian, BMS, drawings and sensors are anchored to the physical thing they describe rather than to each other. Ten systems stop being forty-five point-to-point integrations.
- Your data stays yours
- We do not require data to leave your environment to be useful. Where a model must run centrally we say so, name what crosses the boundary, and put it in writing.
- Swap test
- Change one input — a source file, a sensor, a vendor — and the pipeline still works, or it was never a method. We apply that test to our own work before handover.
Security and data handling
Stated as posture and practice, not as a certification we do not hold.
- What we do not have
- WINNIIO is not ISO 27001 or SOC 2 certified. Saying so first is the point: an uncertified supplier that tells you plainly is a smaller risk than one that lets you assume.
- Least privilege, named access
- Access is requested per system, per person, time-boxed, and revoked at phase end. We ask for the narrowest scope that does the job, and we would rather be slowed down than over-privileged.
- Secrets never in the repo
- Credentials live in your vault or the platform's secret store. Repositories are scanned before every push.
- AI with a boundary
- Where an AI model touches your data we name the provider, the region and what is retained, before it runs. Local or self-hosted inference is available where the data cannot leave.
- Your security team is invited early
- Not shown the result. Involved in the scoping workshop, because a twin that fails review at the end fails expensively.
Who actually does the work
The honest answer to the key-person question, which is the one every CTO asks and few suppliers answer.
Commercial commitment — confirm the exact wording with us before you rely on it in a procurement document.
- A principal plus a named specialist network
- Nicolas leads every engagement. Specialists are brought in by discipline — reality capture, simulation, RF, integration — and are named to you before they touch anything.
- Key-person risk, stated
- For a small firm this is a real risk and pretending otherwise would be the wrong answer. It is mitigated by the method being published, the work being documented as it happens, and the deliverable being reproducible by your own team.
- Continuity commitment
- If the principal becomes unavailable mid-engagement you receive the full working repository, the documented method and an introduction to a named alternative, at no further cost.
How an engagement runs
Short cycles, visible progress, and a person who owns the numbers in the room from the first hour.
- Scoping workshop first
- Half a day or a full day, with your controller or CFO present, producing a written scope and a costed first phase within a week. The fee is credited against the project.
- Fixed scope per phase
- Each phase is quoted and delivered on its own. You can stop after any phase and keep everything produced up to that point.
- Weekly working sessions
- Not status reports. Your team in the model with ours, which is also how the knowledge transfers.
- An honest no
- If the answer is that you do not need a twin yet, you hear it on the first day and keep the scope and roadmap regardless.
What you own when we stop
The test of a supplier is what remains after they leave.
- Everything, in your accounts
- Source, models, pipelines, capture data and documentation live in your repositories and your cloud from day one — not migrated to you at the end.
- Reproducible from source
- Handover includes the build steps needed for your team to rebuild the twin without us. If they cannot, the handover is not finished.
- The method, not just the model
- You receive the repeatable procedure for doing the next asset, which is the part that outlives the project.
- No exit fee, no hostage data
- There is nothing to unwind. That is the point of the licence floor and the swap test.
Send the question that would stall this internally.
Architecture, security review, procurement wording, or the thing your platform team will object to. We would rather answer it now than discover it in week six.
The method itself is published and citable — read SMILE before you hire us, and see nine engagements with what could not be validated named in each.
Nobody brings the full stack of digital twin competence — organizational, global, change management, technology strategy, and a NASA JPL-derived method — the way we do. We bring the best people together for a company faster than anyone else, and we implement it with them.
An answer that takes nine months to verify gets verified against a reality that has moved on.
Scoping workshop from €4,500, credited in full against the project. See how scoping works