Work
Client names are withheld — enterprise agreements generally prohibit naming them in marketing without written consent. The engagements below are described accurately in every other respect, and two of them carry third-party verified delivery history.
The first two engagements were contracted and invoiced through freelancing platforms, where the work history and client feedback are recorded by the platform rather than written by us.
Client engagements
A cross-border VAT compliance and reporting platform for multinational enterprises, processing financial transaction data sourced from enterprise SAP systems.
Delivered and invoiced through Upwork, with verified client feedback.
A global agri-nutrition multinational’s B2C partner and retailer portal, spanning web, Android, iOS and desktop.
Delivered and invoiced through Freelancer, with verified client feedback.
Own product
InfoYog is Pashyaa’s own product and the reason we can claim AI engineering work honestly. It is a retrieval-backed AI assistant running in production on Java 21 and Spring Boot 3.x — the same stack most of our clients already run. Everything below describes engineering decisions, not marketing positions.
Answers are grounded in a corpus stored in PostgreSQL with pgvector, so retrieval lives in the same database as the rest of the application rather than in a separate vector service. One datastore, one backup story, one set of credentials to protect.
The hard part was never the embedding call. It was deciding what belongs in the corpus, and keeping what the retriever can reach aligned with what the assistant is allowed to say.
Not every question should be answered from the corpus. InfoYog routes between retrieval-grounded answers and web-backed answers depending on whether the retrieved context actually supports the question being asked.
A retrieval system that answers confidently from weak context is worse than one that declines and goes elsewhere. Most of the engineering effort went into that judgement.
Authentication runs through Firebase Auth; credentials and API keys live in Secret Manager, never in configuration files or the container image.
The retrieval boundary is treated as a security boundary: what the model can reach is scoped deliberately, because an assistant with broad read access is an exfiltration path waiting to be found. This is the same review we sell as our LLM/RAG Integration Security Design Review.
The backend runs on GCP App Engine against Cloud SQL. The client is a single Flutter codebase shipping to Android and the web, with Firebase Analytics and Crashlytics for release health. Two engineers build, deploy and operate all of it.
Ongoing research
Insecure Lab is where we publish application and AI security research: prompt injection, RAG security, MCP security, and the OWASP LLM and Agentic Top 10.
It is not a product and we do not sell it. It is how we stay current on the failure modes we are hired to prevent — and it is public, so you can read the thinking before you hire us.
Every offer is scoped and priced on the services page. Tell us which one fits.
