Independent consultancy · Portugal · Remote-first · B2B
You need this to be right, and you need it to ship.
Most technical projects don't fail on the code. They fail in the gap between
what the engineers know and what the client was promised.
Nine years on both sides of that gap — as the engineer, as the tech lead, and as the
delivery manager answering to the client — is what this company sells.
2017In software since, counting from the research post. Industry work from 2018.
2022Código Descontraído incorporated and trading.
3 yrsInside a security services practice, running engagements end to end.
MSc + PGComputer Science and Engineering; Business Administration.
Start here
Which of these is you?
Six problems this company is built around. If yours is on the list, the first call will
be useful.
“We're about to ship something that cannot be wrong.”
What we do
Scoped, staffed and managed end to end — threat modelling, architecture and code
review, remediation planning and re-test, with named specialists on the hands-on
work. Web2 and web3.
What you walk away with
Prioritised findings your engineers can act on, a fix plan, and a re-test
that closes it out.
Three years running security engagements end to end — scope set with the researchers,
client contact throughout, and a deliverable the client's leadership would read.
“The programme is late and nobody can tell me why.”
What we do
Delivery diagnosis and recovery: the real critical path, a dependency and risk
register, and a reporting line that surfaces problems before they become incidents.
What you walk away with
A status you can act on inside two weeks, then a cadence that keeps it honest.
Multi-year, multi-workstream engagements run end to end — roadmap, quarterly scoping,
delivery cadence, risk, and the reporting the client saw.
“We need a delivery function, not another contractor.”
What we do
Stand the function up: how engagements start, the tracking boards, the risk
register standard, a hiring work test, and an onboarding curriculum.
What you walk away with
Your own people owning engagements inside three months — and it keeps working
after we leave.
Wrote the proposal that created a project management team, built its curriculum and
hiring test, and took it from four engagements to a pipeline of roughly twelve.
“Our team is using AI and we don't know what we're exposed to.”
What we do
Training pitched per audience, and an acceptable-use and governance policy. If
you want the automation itself built, that is a separate engagement on the
consulting line, scoped and priced as one — it is not folded into a workshop.
What you walk away with
A written acceptable-use policy you can circulate, a team that can say why a
given output is unreliable, and — where you asked for it — a working automation
with the evaluation harness that tells you when it stops behaving.
Agentic workflows and the systems that keep their output, architected first-hand and
running in production now — see the current entry on the timeline above.
“Our people are the attack surface.”
What we do
Security and IT training at three levels — general staff, engineers, IT and
operations — built on your stack and your risk profile rather than a fixed syllabus.
What you walk away with
A session per audience with the materials to re-run it, threat models drawn on
your own systems, and a written list of what to fix first.
Secure-development and DevSecOps practice, plus mentoring and onboarding programmes
built for technical teams.
“We have a funded project with five partners and the paperwork is eating us.”
What we do
Consortium coordination, technical management across partners, and deliverables
and reporting against the grant agreement.
What you walk away with
Partners who cooperate, and deliverables that land on the date in the agreement.
Technical management of projects run jointly with universities, research centres,
municipalities and companies. EU Horizon proposals written.
Where it comes from
Engineer, tech lead, then delivery manager
Most of what follows was done as an employee, at other companies, and none of it is the
company's own client list. Código Descontraído has traded since 2022; what it sells is
the judgement built over those nine years. Client names and engagement detail are not
published — the same confidentiality you would want applied to your own work.
JS
Principal
João Amaral Santos
Founder of Código Descontraído. Nine years across software engineering, technical
leadership and delivery management, in security engineering, industrial IoT and data
platforms. Previously a software engineer, and a tech lead for web3 and backend
security. Engineer first, delivery manager second — which is why the scoping and the
accountability sit in the same head.
Five years of applied-blockchain research at a Portuguese university — mobile health,
health provider systems, textile and supply chain — run in parallel with the industry
roles that follow, not instead of them.
2018 – 2019
Engineering
Backend cloud infrastructure for distributed systems — the high-volume ingestion and
processing behind AI products. Spark, Kafka, Hadoop, Cassandra, MongoDB, FastAPI,
Docker. DevSecOps.
2019 – 2022
Technical project management, then technical lead
Led the design and development of the projects in an industrial IoT department —
hands on the architecture, not only the plan. Industry 4.0, logistics, supply chain,
agriculture, environmental monitoring. Machine learning, computer vision,
sensorisation, machine-to-machine communication, mesh networks, spectral detection,
predictive maintenance. Multi-party projects with universities, research centres and
municipalities. EU Horizon proposals. Onboarding and mentoring for the engineers in
it.
2022 – 2025
Security services delivery
Technical project manager for security engagements: scope and technical requirements
defined alongside security researchers, primary client contact, risk and change
managed end to end.
2025 – now
Lead delivery, then heading the function
The largest and most complex engagements, and the team built to carry the rest of
them. Built the agentic automation and the systems of record behind the function's
metrics and executive reporting — the agents themselves, and the backend that holds
the data after they finish. Risk register and reporting standards; proposals and
scopes reviewed before signature.
MSc in Computer Science and Engineering, and a postgraduate degree in Business
Administration and Management. The second one is why the commercial half of a scope
gets the same attention as the technical half.
Why us
Four things you will not get everywhere
One accountable party
The person scoping the work is the person accountable for the commitment, and the
one who assembles and manages whoever else is needed. Nothing is lost between whoever
promised it and whoever has to build it, and you never coordinate the vendors.
The scope gets read before you sign it
Every scope gets read against what delivery can actually hold before it is signed —
deliverables, dates, dependencies and the assumptions each one rests on, in writing.
You get that applied to your work, including the parts that are inconvenient for us.
The record is the deliverable
Findings, decisions, risks and handover are written down. Every engagement leaves
something your team can still use once we are gone.
We say no
Some jobs belong elsewhere, and when that is the case you hear it on the first
call, with a pointer to who would be better. Said before an invoice exists, not
after three.
How it runs
From first email to handover
Four steps, and you can stop after the first two. Vendor questionnaires, a data-processing agreement and an insurance certificate are all part of the normal course.
01
Call
Free · 45 minutes
What you are trying to get done, and whether we are the right people for it.
You get a straight answer.
02
Scope
Inside a week
In writing: what is in, what is out, deliverables, dates and price. Fixed price
wherever the work can be fixed.
03
Work
At an agreed cadence
One named contact. Problems surfaced when they appear, not at the deadline.
04
Close
With the record
Deliverables handed over with the written reasoning behind them. Re-test or
follow-up where the work calls for it.
Four ways to engage
Fixed-scope assessmentA defined deliverable at a fixed price.
Advisory retainerA block of time each month, for decisions as they arrive.
Embedded deliveryPart-time or full-time inside your team, contracted B2B.
Workshop or programmeA single day, or a recurring curriculum.
The full list
Everything we sell, line by line
Four service lines across two practices. Who performs each one, and what is bought in,
is stated on the card rather than left to be discovered later.
Technology
Security & IT consulting
Read this first. We do not perform the hands-on penetration testing or the
formal audit ourselves. What this company does is take the whole engagement: scope
it, contract the specialists who do that work, manage them, and own the deliverable
and the commitment. Threat modelling, architecture review, scoping and the agentic
automation work are done here. Build at client scale is staffed rather than assumed —
the principal's last full-time engineering role ended in 2019, so implementation is
resourced through contracted engineers, named and priced before you sign. If you want
a firm whose own staff hold the testing certifications, that is not us, and we will
tell you so on the first call.
Assess
Threat modelling and architecture review
Security code review, on-chain and off-chain
Due diligence on an existing codebase
Secure-development gap assessment
Remediation planning, and re-test once it is fixed
Who the specialists are. Chosen per engagement, for fit with your problem
rather than from a standing roster — we are not obliged to any one firm, which is
the point. They come from people we have delivered alongside before, and whoever is
actually on your engagement is named, with their cost, before you sign.
What the written scope names. The standard the work is run against — OWASP
guidance, PTES, or your own — the severity model findings are rated by, the re-test
window, the specialists doing the hands-on work and what they cost, and what is
explicitly out of scope. You see all of that before you sign, not after.
Build
Backend and systems development
Data platform and integration work
Secure development practices, embedded in your team
Agentic automation, and the backend that holds its output
Define
Discovery and problem definition
Product design and specification
Roadmap, requirements and stakeholder alignment
Technology
Project management across the SDLC
Technical delivery
Release planning and dependency management
Architecture and technical decision facilitation
Risk and issue management with engineering teams
Quality gates, testing strategy, environments
Commercial delivery
Scope, schedule and budget management
Proposal, scope and work-order review before signature
Vendor and third-party coordination
Stakeholder communication and executive reporting
Situations
Agile, hybrid or stage-gate, matched to you
Grant-funded and multi-partner consortia
Recovery of programmes already in difficulty
Standing up a delivery function from scratch
Training
AI training
Who builds and delivers it, and how new this is. Built and delivered by the
principal. The agentic work is current and on the timeline above — the automation and
the systems of record behind a delivery function's metrics and executive reporting,
in production now. The curriculum-design credential is there too: the development
curriculum and hiring work test built for a project management team, and the
onboarding and mentoring programme for an engineering department. Being straight
about it: this is the newest of the four lines and the sessions delivered so far have
been internal, so we will show you the exercise set and the evaluation material
before you book rather than ask you to take the syllabus on trust. Where a programme
needs depth beyond ours, it is delivered alongside a specialist picked for that
subject, named before you book.
What a session actually is. Half a day or a full day per audience. Materials
you keep and can re-run without us. Exercises built on your own stack and your own
data, not a generic demo. A written summary of what was covered, what the group got
wrong, and what to do next.
Non-technical teams
Foundations: capabilities and real limits
Effective prompting and daily workflows
Recognising unreliable output
Acceptable use and data handling
Engineering teams
Integrating models into products
Retrieval, tool use and agent patterns
Evaluating and regression-testing behaviour
Failure modes, prompt injection, abuse
Leadership
Governance and internal policy
Build-versus-buy and vendor assessment
Realistic expectations and cost structure
Training
Security & IT training
Who teaches which tier. General staff awareness is built and delivered by the
principal. The engineers and IT-and-operations tiers are led by a practitioner chosen
for the tier — contracted under the same agreement and named before you sign, on the
same model as the consulting line, because those sessions need somebody who does that
work daily rather than someone who has managed it.
What a session actually is. Half a day or a full day per audience. Materials
you keep. Threat modelling and code review run against your live systems rather than
a textbook example. A written summary of what was covered and what to fix first.
General staff
Awareness and social engineering
Credentials, devices, everyday hygiene
Phishing and pretexting, shown and taken apart
Incident recognition and reporting
Engineers
Secure development lifecycle practices
Threat modelling on your live systems
Security code review technique
Common vulnerability classes
IT and operations
Operational hardening and configuration
Access management and least privilege
Logging, monitoring, backup and continuity
Onsite or remote · single engagement, retainer or recurring programme
Before you ask
The questions everybody asks
How are engagements staffed?
To the work. Where a job needs more hands or a particular specialism, we bring in
the people for it — named, and contracted under the same agreement as the rest, so
you deal with one party throughout. The written scope and record exist so that the
work never depends on any single person's memory.
Can you work under NDA?
Yes, and it is the norm. Client names and engagement detail are never published —
which is precisely why there is no logo wall on this page.
Can we see references?
Arranged directly, where a client agrees to it. Never published, and never used as
marketing without asking first.
Do you know our stack?
Nine years across backend services, data platforms, industrial IoT and blockchain,
in Python-centred and container-native environments. Where we do not know it, we
say so and scope around it.
Are you actually an independent business?
Yes — a company since 2022, not a person invoicing through one. Its own premises,
equipment and business expenses, its own staff, its own insurance, VAT registered,
and every engagement contracted business to business. What that means for you:
invoicing, VAT and compliance are handled at our end, and you contract with an entity
that carries its own liability.
What happens to our code and our findings?
Under NDA as standard. Source, credentials and findings stay on encrypted company
equipment, are never shared with anyone not named in the engagement, and are deleted
at the end of it on request. Nothing is used as marketing, in any form, without
asking first.
What does it cost?
Retained and embedded work runs to a three-month minimum — below that the
ramp-up costs you more than it returns. Fixed-scope assessments and the two-week
delivery diagnosis are priced on their own and are not held to it, and training is
quoted per programme. Rates are given on the first call, once there is enough scope
to price honestly; since that call is free, you have the number before you commit to
anything. Nothing runs open-ended without a cap you agreed to.
Which language do we work in?
Portuguese, English or Spanish — spoken and written. Deliverables in whichever of
those you need them.
Also from Código Descontraído
Looking to invest in a classic car?
Restoration, independent buying advice, and sales — a separate part of the company,
run on its own site and its own terms.