Skip to main content
Services · Enterprise Architecture

Architecture you can defend in three years.

Business, data, application, and technology architecture aligned to your strategy. TOGAF-based where it helps, plain-spoken where it doesn't.

Start a conversation →See the scope
What we do

We help organisations make architectural decisions they can still defend three years later. That means starting from business outcomes, not technology preferences, across life sciences, fintech, retail, logistics, telecom, and manufacturing, including under regulatory frameworks like GxP, GAMP 5, GDPR, and SOC 2.

Advisory: We run the workshops, produce the decisions and documentation, and leave your team equipped to execute.

Embedded: We sit alongside your engineers through delivery and adjust the architecture as the system tells us what we got wrong.

The four domains

We cover the full architecture stack, or just the layer you're stuck on.

01 / Business

Business Architecture

Capability maps, operating models, and process designs that connect strategy to day-to-day work, for when teams know the destination but disagree on how to get there.

02 / Data

Data Architecture

Data domains, ownership, lineage, and integration patterns across distributed systems: warehouses, lakehouses, event streams, and operational stores.

03 / Application

Application Architecture

Application portfolios, integration patterns, and API contracts, from monolith decomposition to microservice boundaries to deciding what to keep and what to retire.

04 / Technology

Technology Architecture

Cloud reference architectures, landing zones, network topology, and platform choices across AWS, Azure, and GCP. Hybrid and multi-cloud where it earns its keep.

What we assess

Performance & Scalability

Sizing, capacity planning, and load patterns. Where the system bends before it breaks, and what to change before it does.

Reliability & Availability

Failure modes, recovery objectives (RTO/RPO), and resilience patterns, focused on the scenarios you actually need to survive, not a checklist.

Security & Compliance

Identity, access, data protection, and regulatory alignment (GDPR, SOC 2, ISO 27001, GxP, HIPAA), baked into the architecture, not bolted on.

Cost Optimisation

Total cost of ownership across compute, storage, network, and licensing. Finding the cuts that don't compromise reliability or compliance.

How we work

A short engagement that leaves you with decisions, not slideware.

01

Discover

Stakeholder interviews, current-state review, and constraints. We map what exists and what's actually causing pain.

Current-state map
02

Decide

Options, trade-offs, and recommendations captured as Architecture Decision Records, with the reasoning, not just the verdict.

ADR-014, see the example
03

Document

Target-state diagrams (C4, ArchiMate, or boxes-and-lines) and roadmaps at the right level of detail to act on.

C4 diagrams and a roadmap
04

Hand over

We leave a team that can run, extend, and reason about the architecture without us in the room. By design.

A team that runs it
What you get

Decisions you can read, not slides you have to present.

  • Architecture Decision Records

    Concise, dated decisions with context, options considered, and consequences. Your future engineers will thank you.

  • Reference Architectures & Diagrams

    Target-state diagrams at the right level of detail, with the rationale behind each component.

  • Capability & Process Maps

    Business capability models and as-is / to-be process flows that align stakeholders before code gets written.

  • Roadmaps & Work Breakdown

    Sequenced delivery plans with dependencies, risks, and milestones. Built to be executed, not to sit in a deck.

ADR-014Accepted12 Mar

Keep the audit trail in write-once storage, separate from the application database

Context

GxP requires an audit trail that nobody can change. Today the audit rows sit in the same database the application writes to, so anyone with write access to the application can also change its history.

Options considered

  1. 1Audit table in the same database · RejectedCheapest to build, but a compromised application can still rewrite it.
  2. 2Write-once object storage with a retention lock · ChosenEvents are appended and cannot be changed or deleted before the retention period ends, even by an administrator.
  3. 3A third-party audit service · RejectedMeets the requirement, but the data-residency review would delay go-live by a quarter.

Consequences

  • Benefit: The audit trail survives a compromise of the application.
  • Benefit: Inspectors read one store, with one retention rule.
  • Cost: Two stores to back up and monitor, and reports move to a separate read model.
An example of the format. Real records are written with your team and stay with you.

“His work has been of great use for us, especially due to his deep knowledge, from current-state analysis through to a new technical architecture and governance strategy.”

Karro ZetterholmVolvo Car Corporation
Related reading
31 Oct 2026

The Fear of Being Replaced

The fear of being replaced by AI is justified for some people and overstated for most. A century of automation case studies shows which is which.

→11 Oct 2026

Measure Value From Day One

We test every change to the code, and almost nothing about whether it was worth building. Write test cases for the value proposition on day one, and run them through the pilot, the release and beyond.

→03 Aug 2026

Controls Your Agent Cannot Rewrite

Three kinds of control shape what an agent can do, and they are not equally strong. One is advice the model may ignore, one is enforced by the tool, and one is enforced somewhere the agent cannot reach. Knowing which you have written is the whole game.

→
Let's talk

Stuck on an architecture decision?

Bring us the current state and the constraints. We'll help you choose a target you can defend, and a path to get there.

Get in touch →
Email
info [at] lekman [dot] com
Phone
+44 (0)330 ••• ••••
Office
16 Oughton Head Way
Hitchin, SG5 2LA, UK