Your platform team has already decided what good infrastructure looks like at your company. What's missing is the front door — somewhere a product team asks for a database and has one the same day, without waiting on a specialist and without ever holding a cloud credential.
cOTTER gives product teams one place to order approved infrastructure, while your platform team keeps ownership of the standards, the rules and the recovery path.
Runs in your own estate · your cloud accounts · your data
Self-service fails when it is built for one side only. The teams ordering want less to learn. The team accountable wants more control.
Azure, AWS and Google Cloud sit side by side in the same catalogue. Teams order the same way whichever they land on, and adding another one is a configuration change rather than a second portal to build and maintain.
Everything belongs to a team with its own membership, spending limits and history. Cost questions, access questions and audit questions all resolve to a named owner instead of a shared account nobody remembers creating.
Each order is checked against what already exists and against your rules before anything is created. Combinations that can't work are refused at the form — not discovered during an incident three weeks later.
Your team writes the recipe once — network, database, cache, secrets, in order. Product teams order it as a single item. If a step fails, everything after it waits, visibly, with the reason attached.
Every action leaves a record with its own outcome, and anything stuck collects in one place where an administrator can retry it, release it or clear it up. Each of those steps is recorded too.
Work can be carried out centrally or inside a business unit's own environment — which matters when regulation or a network boundary says it must be. Capacity follows demand, up to a ceiling you set.
Closing a project removes the infrastructure it created and keeps the paperwork — the membership, the history, the audit trail. No forgotten resources quietly billing for another two years.
Every vendor ROI figure is fiction until it runs on your baseline. So here is the model, with your numbers in the inputs.
The model still charges roughly twelve minutes of platform attention to every self-served request — review, unblock, exception handling — and counts nothing at all for the requesting team's reduced wait time, which in most estates is the larger number.
A form that checks itself turns a multi-day exchange into a submit. Your own measured before-and-after belongs in this space — not our guess at it.
Senior platform engineers are expensive and hard to replace, and answering the same request for the ninth time is why they leave. This is the part of the business case that never fits in a spreadsheet.
Cloud access belongs to the system, not to people. Removing standing human access removes a whole category of incident and audit finding at once.
Limits are checked before anything is created, which makes budget a policy your teams work inside rather than a monthly reconciliation exercise.
Who asked for this, who allowed it, what it created and when. The difference between answering that in an hour and answering it in a week.
Your standards stay yours, in your own tooling. What your team stops owning forever is the ordering experience, the queueing and the clean-up.
Not a policy document. These are properties of the system itself, which is why they still hold when a deadline is close.
Rotating a credential doesn't require a change window and doesn't disturb anything already running — the system simply picks the new value up. One less scheduled Saturday.
Read both columns. The left one is the honest version of the plan most platform teams present internally.
Every time your standards change, someone updates the ordering forms by hand. That job never appears in the original estimate.
Checking that a request is actually possible gets deferred, quarter after quarter, until a bad one causes an outage.
A half-finished request leaves resources nobody owns and an engineer piecing together what happened.
Debug shortcuts and log lines are where cloud credentials end up when a delivery date is close.
Reconstructing who did what after the fact is painful, and the result is almost always partial.
Serving fifty teams instead of five is weeks of work that nobody scoped when this was an internal tool for one.
Someone owns its roadmap, its on-call and its upgrades permanently. Usually your best platform engineer.
Ordering forms come from the definitions your team already maintains, and update when those do. Nothing hand-kept.
Requests that can't work are refused at submission, with a plain reason the requester can act on themselves.
Stuck work stops, becomes visible, and has a documented way back — retry, release or clear up, all recorded.
No part of the ordering flow is able to expose a cloud credential. That's how it's built, not a rule someone has to remember.
Every change recorded end to end, and exportable the first time somebody asks for it.
Throughput rises with the workload, up to a ceiling you set. Adding a team is configuration, not a project.
You own the standards, the policy and the cloud accounts. We own the ordering experience, the queueing and the recovery.
Deliberately boring. One place where decisions are made, work carried out in the background, and nothing that has to be trusted twice.
The catalogue and the forms your teams actually use. It can't reach anything except the layer below it, which is what makes the rest of this list enforceable.
One place where every rule lives: who may order what, whether the limits allow it, whether the prerequisites exist, and what gets written down.
A durable record of everything asked for and everything done, alongside a work list of what is still in progress. The record is the truth; anything else can be rebuilt.
Workers pick jobs off the list and carry them out against your cloud accounts. They hold nothing themselves, so one of them restarting is a non-event rather than an incident.
Whatever already keeps your infrastructure in step continues to do exactly that. cOTTER puts a front door on it — it doesn't replace it, and it doesn't ask you to migrate.
The plain-language layers above map one to one onto these. Your team will want this list in the first ten minutes; nobody else on the buying side needs it.
A public, self-hostable platform for teams proving governed self-service.
Scale, compliance and organization-wide policy for regulated platform teams.
The commercial service for teams that want cOTTER managed by cotterhq.com.
There is no published price list yet. The boundaries above follow the current edition matrix: Community stays complete and self-hostable, Enterprise adds commercial governance and compliance capabilities, and Hosted adds managed cotterhq.com operation and private managed content.
Thirty minutes against something you actually run. No slides unless you ask for them.