# Hat Boy Software, Inc. > Hat Boy Software is a senior-led cloud, security, and AI engineering firm in Oxford, Mississippi, building and hardening cloud platforms, AI systems, and apps. Hat Boy Software is an engineering firm in Oxford, Mississippi, co-founded in 2015 by September Gray (Chief Executive Officer) and Matthew Gray (Chief Technical Officer). A senior engineer leads every engagement, from assessment through hand-off. The firm works on cloud security and compliance (HIPAA, NIST 800-53), applied AI engineering, platform reliability and FinOps, app stabilization, and ongoing support, across Azure, AWS and Google Cloud. - Website: https://hatboysoftware.com/ - Email: info@hatboysoftware.com - Phone: (662) 626-0732. The line is answered by an AI receptionist that takes details for an engineer to follow up. - Address: 1205 Office Park Drive Suite B, Oxford, MS 38655 - Pricing is not published. Engagements are scoped and quoted before work starts. - Client names in case studies and blog posts are anonymized unless the client agreed to be named. ## Services - [Services](https://hatboysoftware.com/services/): Cloud security and compliance, applied AI engineering, platform reliability and FinOps, app stabilization, and ongoing support — led by senior engineers. - [Cloud Security & Compliance](https://hatboysoftware.com/services/cloud-security-compliance/): HIPAA and NIST 800-53 aligned Azure security: landing zones as code, Sentinel coverage and cost reviews, private networking, and evidence an auditor can check. - [Applied AI Engineering](https://hatboysoftware.com/services/applied-ai-engineering/): Enterprise AI engineering: grounded RAG in regulated tenants, multi-tenant agent platforms, voice agents, and LLM spend cut with per-tenant cost attribution. - [Platform Reliability & FinOps](https://hatboysoftware.com/services/platform-reliability-finops/): Cloud estate audits with severity-ranked findings, disaster recovery and SQL high availability, keyless automation identity, and a cloud bill you can defend. - [App Stabilization](https://hatboysoftware.com/app-stabilization/): A fixed-fee senior assessment for apps built fast, including with Bolt, Lovable, or Cursor, that now need to be trusted with real users, data, and money. - [AI Receptionist](https://hatboysoftware.com/ai-receptionist/): A voice AI receptionist that answers your main line 24/7, captures every caller as a lead in your CRM, and routes urgent calls to a person. ## Case studies - [Bringing an orthopedic group's SIEM to audit-readiness](https://hatboysoftware.com/case-studies/healthcare-siem-audit-readiness/): 33 of 83 Sentinel detections were running against no data. We restored 23 of them. - [A HIPAA landing zone built entirely as code](https://hatboysoftware.com/case-studies/hipaa-landing-zone-as-code/): Zero public data-plane exposure, delivered as a 42-module Terraform registry. - [Re-engineering Shovel Solutions' payments and platform](https://hatboysoftware.com/case-studies/hauling-marketplace-payments-and-platform/): A payments layer that "should be treated as breached" — redesigned so every critical risk is closed by architecture. - [Making an AI platform's economics visible](https://hatboysoftware.com/case-studies/ai-platform-cost-attribution/): LLM spend went from ~0% recorded to fully attributed per tenant — and a lakehouse bill dropped ~75%. - [Auditing and hardening a $45K/month SaaS estate](https://hatboysoftware.com/case-studies/saas-estate-audit-and-hardening/): 52 findings, 25 resolved in about two weeks — and a $470K–$540K three-year savings case. - [Rescuing the intellectual property of an AI platform](https://hatboysoftware.com/case-studies/ai-platform-ip-continuity/): A stalled commercial launch turned out to be one expired credential away from live. ## Blog - [Your load balancer health probe may be lying](https://hatboysoftware.com/blog/health-probes-that-lie/): Three Azure health probe failures on one production estate, and what a probe should check so that it can tell a healthy backend from a broken one. - [Your code highlighting probably fails accessibility contrast](https://hatboysoftware.com/blog/code-highlighting-fails-contrast/): Hugo's default code theme failed WCAG AA contrast on 10 of our 12 posts with code. How we tested nine themes with axe-core, and the parser trap we found. - [What the Azure Communication Services retirement means for voice AI agents](https://hatboysoftware.com/blog/azure-communication-services-retirement-voice-ai/): Azure Communication Services retires as a standalone offering in 2028, and new phone numbers are already restricted. What it means for voice AI agents. - [What "HSM-backed encryption" actually covers in an Azure estate](https://hatboysoftware.com/blog/what-hsm-backed-encryption-covers/): HSM-backed describes who holds the key, not how strong the encryption is. How to state Azure encryption-at-rest coverage per resource type, with evidence. - [Testing embedded firmware before the hardware exists](https://hatboysoftware.com/blog/testing-embedded-firmware-without-hardware/): How to keep pre-silicon firmware honest: fail-closed stubs, a sanitized host test harness, marked bench seams and a protocol simulator. - [Spend caps at every layer, and partition pruning as a requirement](https://hatboysoftware.com/blog/llm-pipeline-spend-caps-and-partition-pruning/): How an AI intelligence platform caps LLM spend per collection, tenant and org, makes BigQuery partition pruning mandatory, and measures projected savings. - [Rolling out an EDR agent with Terraform: installed is not running](https://hatboysoftware.com/blog/idempotent-edr-agent-rollout-terraform/): How to make an Azure Custom Script Extension safe to run against VMs that already carry an EDR agent, and keep the site token out of the repository. - [Retire, don't patch: moving users off a legacy app without a big-bang cutover](https://hatboysoftware.com/blog/retire-dont-patch-legacy-migration/): A strategy for retiring an insecure legacy app: a live switch, delta loads, paced invites, a read-only legacy database and rehearsed restores. - [Our contact form silently dropped every inquiry for six days](https://hatboysoftware.com/blog/contact-form-silently-dropped-enquiries/): A post-mortem: a template-encoding bug sent every website inquiry to a dead URL for six days. How we found it, sized the damage and stopped it recurring. - [GitHub's immutable OIDC subjects break cloud logins after a repo transfer or rename](https://hatboysoftware.com/blog/github-oidc-immutable-subject-claims/): Since July 15, 2026, renaming or transferring a GitHub repo changes its OIDC subject claim. How to update Azure, AWS and Google Cloud trust before the move. - [Fail-closed tenant isolation in an ORM](https://hatboysoftware.com/blog/fail-closed-tenant-isolation-orm/): How Omnisnia enforces tenant isolation in GORM callbacks that refuse unscoped queries, with an explicit system scope, tests, and where RLS fits. - [Cookie-free site analytics on Azure, and what it costs](https://hatboysoftware.com/blog/cookieless-site-analytics-on-azure/): How we measure traffic, Core Web Vitals, conversions and failures on our own site with Application Insights and Front Door logs, without cookies. - [Azure Front Door redirect gotchas for SEO](https://hatboysoftware.com/blog/azure-front-door-redirects-for-seo/): What we learned moving our site's redirects and cache headers into Azure Front Door Standard rules: status codes, rule order, path matching and limits. - [Adding llms.txt and llms-full.txt to a Hugo site](https://hatboysoftware.com/blog/llms-txt-with-hugo/): How we generate llms.txt and llms-full.txt from Hugo content with custom output formats, the gotchas we hit, and why we did it while it is only a proposal. - [Your CI watchdog can't live on the pool it watches](https://hatboysoftware.com/blog/ci-watchdog-on-the-pool-it-watches/): A self-hosted runner pool was down for 6 hours 38 minutes. Its watchdog ran on the same pool. What went wrong, and how to monitor CI from outside. - [Your Azure OpenAI private endpoint may not be carrying your traffic](https://hatboysoftware.com/blog/azure-openai-private-endpoint-public-path/): A private endpoint existing does not mean traffic uses it. Two DNS problems that kept Azure OpenAI calls on the public endpoint, and how to check yours. - [What we find in apps built fast](https://hatboysoftware.com/blog/what-we-find-in-apps-built-fast/): The failure classes a stabilization assessment keeps finding in apps built quickly, including with AI builders, and how to check your own. - [What breaks when you move a GitHub repo](https://hatboysoftware.com/blog/what-breaks-when-you-move-a-github-repo/): Moving repositories between GitHub organizations without breaking CI/CD: the hidden dependencies, and the order to change them in. - [Two SQL Server incidents where nothing crashed](https://hatboysoftware.com/blog/sql-down-but-never-crashed/): Two SQL Server on Azure VM incidents where the engine never stopped: a backup retry storm, and log backups that quietly ended for seven databases. - [The logging feedback loop that more than quadrupled an AWS bill](https://hatboysoftware.com/blog/aws-logging-feedback-loop/): How S3 access logging, CloudTrail data events and GuardDuty malware scanning fed each other until one AWS account's bill went from about $1.7K to $7.8K. - [Support tickets from your apps, straight into the CRM](https://hatboysoftware.com/blog/support-tickets-from-your-apps-into-omnisnia/): How a customer-facing app, a backend job and an AI receptionist open support cases in Omnisnia CRM with scoped, revocable support tokens. - [One intake pipeline for our web form and AI receptionist](https://hatboysoftware.com/blog/web-form-and-ai-receptionist-into-omnisnia/): How we send website enquiries and AI receptionist calls into Omnisnia CRM through one public web-to-lead endpoint, and why a public token is safe there. - [Key-person risk after an engineer leaves](https://hatboysoftware.com/blog/key-person-risk-after-an-engineer-leaves/): A continuity checklist for when the one engineer who understood your platform leaves: secrets, state, credentials, access and ground truth. - [Fail-safe tools for a voice AI receptionist](https://hatboysoftware.com/blog/fail-safe-tools-for-voice-ai-agents/): Lessons from building our own AI phone receptionist: tools that degrade safely, caller ID matching, conversation tuning, and live-call verification. - [DR workarounds that never merge are defects with a timer](https://hatboysoftware.com/blog/dr-workarounds-must-merge/): A failover exercise hit three defects that had been found and worked around 15 months earlier. Why imported Terraform hides them, and how to fix them. - [Cutting Microsoft Sentinel cost without blinding your detections](https://hatboysoftware.com/blog/sentinel-cost-without-blinding-detections/): Four lessons from reducing Sentinel and Log Analytics cost for a healthcare client, including the cheaper table plan that silently emptied 33 detections. - [Cutting an agent platform's LLM spend by 79%](https://hatboysoftware.com/blog/cutting-llm-spend-79-percent/): How a multi-agent platform's metered model spend fell from about $107 to $22 a day: attribution, three cache layers, model routing and loop caps. - [Caging an autonomous AI agent inside an enterprise tenant](https://hatboysoftware.com/blog/caging-autonomous-ai-agents/): The control pattern we design to before an autonomous AI agent touches a Microsoft 365 tenant: identity, network, policy, logging and a kill switch. ## Company - [About](https://hatboysoftware.com/about/): About Hat Boy Software: a senior-led cloud, security, and AI engineering firm in Oxford, Mississippi, delivering since 2015. - [Contact](https://hatboysoftware.com/contact/): Contact Hat Boy Software in Oxford, MS: info@hatboysoftware.com or (662) 626-0732. ## Optional - [Full text of this site](https://hatboysoftware.com/llms-full.txt): The pages above as Markdown, in one file. - [Blog RSS feed](https://hatboysoftware.com/blog/index.xml): New articles as they are published.