Seven practices, one engineering team. We design, build, benchmark and operate the compute layer beneath your hardest problems — on-premise, hybrid or sovereign cloud.
A genomics pipeline and a trading engine are not the same machine. We start from your regulatory perimeter, your data gravity and your deadlines — then design backwards.
Industries · The Arts & Culture
Preservation is an operating commitment, not a purchase. The institutions that hold their collections well are the ones whose architecture assumed a twenty-five year horizon, a flat budget and staff turnover from the beginning. We design for that horizon, and we cost it out loud.
The constraint we design around first
Backup protects against loss over days and weeks. Preservation protects against silent corruption, format obsolescence, media decay, vendor withdrawal and the departure of the only person who understood the folder structure. Different problems, different engineering.
Catastrophic loss is rare and memorable. Attrition is common and invisible, which is why it does well in budget negotiations. Each of the following is a failure mode documented repeatedly in preservation literature.
Every one of these is addressable with practice that is well established in the sector. None of them is addressed by buying more storage.
Digital preservation
OAIS is a reference model, not a product, and that is its value: it separates the things a repository must do. Implemented properly, each function is something that runs on a schedule and produces evidence a board can read.
01
Submission packages are validated on arrival: format identified and characterised, required metadata present, checksums generated and recorded, and a persistent identifier assigned. Material that fails validation is quarantined with a reason rather than accepted quietly. A repository that accepts anything is storing a future problem at archival cost.
02
SHA-256 checksums stored separately from the objects, verified on a rolling cycle sized so that every item is checked within a stated period, and every verification result logged whether it passed or failed. The point is not the hash. It is being able to say when a file was last known good, and to repair from another copy before the damaged version becomes the only version.
03
Three copies, at least two storage technologies, at least one geographically separated and one logically isolated against ransomware and operator error. The discipline is in the word independent: three copies on one filesystem share a single failure, and object-storage versioning within one account shares a single credential.
04
A written format register: what is accepted for preservation, what is tolerated, what is at risk. Uncompressed or lossless TIFF and JPEG 2000 for images, open container and codec choices for audiovisual material, PDF/A or plain text where documents allow. Migration is a planned event with the original retained, the transformation recorded, and a sample validated by a person.
05
BagIt-style packages with checksum manifests, and preservation metadata recorded in an open standard such as PREMIS, so provenance and every event acting on the object travel with it. The test we apply is blunt: could an archivist in 2050, with no access to your current systems and no phone number to call, understand what they are holding.
06
A documented recovery exercise on a real sample, timed, at least annually, with the result reported. This is where paper compliance and actual capability separate, and it is the single most useful thing an institution can add to an existing arrangement. Plenty of repositories discover their tape drive generation problem during a rehearsal, which is the correct time to discover it.
Large-scale digitisation
Handling is the expensive and risky part of digitisation, and every item handled twice is a conservation cost as well as a budget one. The capture specification should be set against what the item will be asked to support in thirty years, not against this year's website.
Resolution, bit depth, colour target and lighting agreed against a recognised imaging guideline, with conservation setting handling limits before any schedule is built. Output of this stage is a written capture specification and a throughput model, so the project plan is based on measured handling time rather than an optimistic item count.
Flat material on calibrated copy stands and scanners with colour targets in frame. Three-dimensional objects by photogrammetry or structured-light and laser scanning, where the deliverable is a dense mesh with measured scale and a documented capture geometry, not just an attractive render. For large objects and sites, terrestrial laser scanning and drone photogrammetry produce point clouds that need real processing capacity behind them.
Photogrammetric alignment and mesh reconstruction are GPU and memory bound, and a single high-resolution object can occupy a workstation for hours. On a programme digitising thousands of objects, that queue determines the whole schedule. We size a small cluster or a burst arrangement against the capture rate, so processing never becomes the reason the imaging team stops.
The preservation master is untouched. Access copies, IIIF tiles, thumbnails, web video and 3D viewer formats are all generated from it by a recorded pipeline, so they can be regenerated when standards change or a viewer is replaced. Manually produced derivatives become a second collection that nobody can reproduce.
Statistical sampling against the capture specification, checking focus, colour accuracy, completeness and metadata linkage, with a named person authorised to halt a batch. Discovering a lighting drift after forty thousand items is the failure this stage exists to prevent.
Metadata and discovery
Discovery infrastructure is where a preservation programme earns its funding back. It is also where open standards pay off most obviously, because they let you change your viewer, your website and your aggregator without touching the collection.
The Image and Presentation APIs decouple your collection from any particular viewer. A manifest describes the object, tiles are served on demand, and researchers can compare items held in different institutions in one workspace. Practically, it means a deep-zoom viewer becomes a configuration choice rather than a redevelopment project, and authentication can gate restricted material at the API rather than in the interface.
Dublin Core as the interoperable floor, with richer sector schemas — archival, museum or audiovisual — where your material needs them, and controlled vocabularies for people, places and subjects. Mapping between them is designed once and applied by the pipeline, so an aggregator harvest does not become an annual manual export.
Publishing identifiers rather than strings lets your holdings connect to other collections and to external authority records. It is genuine work and it repays itself on named entities and places. We will say plainly when a linked data programme is being proposed for its own sake, because a poorly maintained triple store is worse for discovery than a well-kept catalogue.
ARKs, DOIs or handles so a citation made today still resolves after two website rebuilds. Your collection management system stays the single source of curatorial truth, with a defined synchronisation path to the repository and the public site, so nobody maintains the same record in three places and no system quietly becomes the accidental master.
Choose the standard that lets you replace us. If your collection only works through one supplier's software, the preservation plan has a commercial dependency in it.
Interactive and immersive installations
An exhibition build is judged on opening night and lived with for a season. The engineering that matters is what happens on day ninety, when the artist has moved on, the developer's contract has ended and a projector lamp is dimming.
The worst failure mode in a gallery is the silent one: a screen showing a plausible but frozen image for two days. Everything we build declares its own health, and recovers without a person where it safely can.
Unreal, Unity, TouchDesigner and Notch all work. The choice follows who will maintain the piece after handover and whether the source will still build in five years. Multi-projector installations need genlock and calibrated warp and blend, held as data so a bumped projector is a recalibration rather than a re-authoring. For sensor-driven work we set a frame budget and hold to it, because a piece that responds late reads as broken even at a high frame rate.
Access, rights and cultural authority
A great deal of material held in Australian collections carries obligations that copyright law does not describe. Infrastructure has to be able to express those obligations precisely, change them when a community's determination changes, and prove what was accessible when.
01
ICIP rights sit with the communities and knowledge holders concerned, not with the institution that holds the physical item and not with us. Practically this means the repository must support restrictions that are specific rather than binary: access by community, by gender, by kinship relationship, by place, or only with a named person's permission. Systems that only offer public or private force custodians into a choice they should not have to make.
02
The FAIR principles make data findable and reusable. The CARE principles for Indigenous data governance address what FAIR does not: collective benefit, authority to control, responsibility and ethics. In architecture terms, authority to control means the determination is recorded as data owned by the community and changeable by them, with a workflow for that change, rather than a note in a field that only staff can edit.
03
Traditional Knowledge and Biocultural Labels and notices travel with the item and with its derivatives, including through IIIF manifests and aggregator harvests. If a record can be harvested without its conditions of use, the system has exported the object and dropped the obligation.
04
When a determination changes, material has to come down from the public site, the search index, the cache, the tile store, the aggregator and any derivative built from it — while the preservation copy is retained under restriction unless destruction is specifically directed. We design this path deliberately and test it, because in most systems it has never been exercised.
05
Sensitive material — sacred and secret content, records concerning individuals, closed archives and donor-restricted deposits — needs access decisions recorded with who approved them, on what basis and for how long. An access log that can answer a community's question about who saw their material is part of being trustworthy, not an afterthought.
Cost modelling on a long horizon
Digitisation is usually funded as a project and preservation is always an operating cost. That mismatch is how collections end up on unpaid storage. The model has to name the recurring lines and the events that fall outside the funding cycle.
| Cost line | Typical interval | Usually missing from a three-year model |
|---|---|---|
| Storage capacity growth | Continuous, compounding with each digitisation programme | The second and third copies, and the growth rate rather than today's volume |
| Hardware refresh | Roughly every five to seven years per generation | Three or four refresh events across the horizon, each a capital request |
| Tape generation migration | Every two to three LTO generations if tape is in the mix | Drive compatibility windows, and the labour of rewriting the whole holding |
| Format migration events | Unpredictable, plan for several | Processing capacity, validation effort and curatorial sign-off time |
| Fixity and integrity operations | Continuous background load | Read bandwidth, egress on cloud-held copies, and someone to act on failures |
| Retrieval and restore | On demand, rising with access success | Egress and archival retrieval fees, which scale with popularity |
| Staff time | Continuous | The largest line in most honest models, and the first one omitted |
| Exit and migration provision | Once, whenever a supplier or platform changes | The cost of getting everything out, which should be quantified before signing |
Some decisions are nearly free at the start and compound in your favour for decades. Open, well-documented formats mean fewer forced migrations. Storing checksums and preservation metadata inside the package means a future migration does not require your current database. Keeping derivatives reproducible means you store one authoritative copy instead of five you dare not delete.
Object storage with versioning and object lock is a strong second copy, and cheap archival tiers are genuinely cheap to hold. The lines to model carefully are retrieval fees, egress if you ever move, and the minimum storage duration on cold tiers. A collection that becomes popular can turn a modest storage line into an unbudgeted retrieval line, and that is a success failing for the wrong reason.
Let's Talk
A holdings inventory, your current storage arrangement and a candid figure for recurring funding are enough for a first assessment. If your existing setup is sound and only needs fixity checking and a rehearsed restore, that is what we will recommend.
Sydney · Melbourne · Canberra. Australian owned, Australian staffed.