Quillstone Software

The business

Quillstone builds a B2B finance platform. It has 420 engineers in 38 teams, working on 160 services written in Java, TypeScript and Python, spread across a main monorepo and about 40 smaller repositories. It is SOC 2 certified and sells to banks, so its customers audit its controls.

What engineering wants

1. Roll out Claude Code to every engineer in a controlled way: shared settings, approved tools and Skills, and a spending limit.
2. Migrate off a deprecated logging library. A security advisory requires every service to move to the new library. Before teams start, the platform team needs an audit of all 160 services within two weeks: whether each service uses the old library, where, in what patterns, and how risky the change is.
3. Speed up incident diagnosis. On-call engineers spend about 30% of incident time searching logs and dashboards.
4. Add an assistant to the product. The product team plans a Claude-powered assistant inside the finance platform for Quillstone's 60 bank customers (tenants). The largest tenant has 4,000 users; the smallest has 40. Each bank must only ever see its own data, and Quillstone bills AI usage back to each bank.

Measured baseline

• Pull request cycle time: median 26 hours from opening to merge.
• Last year: 2 security incidents caused by secrets committed to repositories.
• A manual audit of one service for the logging migration takes an engineer about 2.5 hours.

Systems

Constraints

• Source code may only be sent to vendors approved under the SOC 2 vendor process.
• Production write access is restricted to on-call engineers and goes through change management.
• AI tooling budget: $40 per engineer per month on average.
• Secrets must never be read into an AI tool's context or written to logs.

People