The AI engineering team that ships to production

Customer portals, internal tools, or agents for regulated businesses. You own the code.

30 min with our founder. Live build, no slides.

Using the Nuclicore platform, it took us six weeks from kick-off to a finished Customer Portal. The same version now runs on two different domains and databases. Since then, we have also built our Partner Portal, Claims Management System and Purchase Flow Builder with Nuclicore. We use Nuclicore for both new business and migration projects in our existing business.

Our commercial clients used to send us their underwriting data on PDF renewal forms, and we keyed it into our systems by hand. Today every client automatically receives an email with their own individual link, including reminders, and the data goes straight into our systems. If a policy needs to be endorsed, the follow-on process starts automatically. A dashboard shows us at any time which renewals are still outstanding. What used to take weeks is now done in days. All built with Nuclicore, without an in-house development team.

Ship production software without hiring a team.

Nuclicore runs the workflow of an engineering department: a product manager writes reviewable tasks, developers build and test, SecOps gates every release, DevOps promotes it. You approve.

You describe

Plain language, a prototype, or an existing repo. Attach files and knowledge the team must respect.

AI team builds

Every task has acceptance criteria and becomes one clean git commit.

You approve and deploy

Review on a Preview URL, then release through Test to Production with a security gate and approval.

Product Manager

Captures goals, stakeholders, constraints and risk. Asks back when the request is ambiguous, and records what is out of scope so it stays out.

Turns your request into tasks with acceptance criteria and dependencies. Each task is small enough to review in minutes and becomes one git commit.

You edit the tasks in chat before anything is built. Reorder, cut, add. Nothing goes to the Developer until you have approved the plan.

Developer

Writes the code in a real React and Node.js repository. You decide which AI models do the work: automatic, one model for all agents, or a different model per agent role.

DB Admin

Designs the schema and writes every migration for the application's Postgres database, applied in order to Preview, Test and Production. The most recent migration of a database can be rolled back, and any earlier release can be redeployed from the history.

QA Engineer

Runs automated checks and edge-case tests against each task's acceptance criteria, so every preview is stable and reviewable.

SecOps

Before every build: static code analysis with Semgrep and dependency scanning with Trivy. Critical and high findings stop the release, and a scan that cannot complete stops it too. Safe dependency upgrades are applied automatically and committed on their own.

After every release: runs a nightly OWASP ZAP scan against the running app in Test and Production. Findings become tasks with a severity and an owner, so nothing is fixed by mail.

DevOps

Builds containers, deploys to Test, waits for your approval, releases to Production. Every release is in the history and can be redeployed.

You choose the AI models. Your workspace content is not used to train them.

Production-ready software in weeks. Every change traceable to a task, a commit and a person.

Examples of what you can build on Nuclicore.

Real software, each with its own backend, a managed database and a release pipeline, all owned by you. Start from any of these or import what you already have.

From demo to production in four weeks

One workflow, fixed scope, fixed timeline. Start from a prompt or from the prototype you already have.

The pilot covers one workflow. A complete product takes a little longer: Broker Collective went from kick-off to its finished customer portal in six weeks, and it has been in production ever since.

Scope

Pick one workflow, agree success criteria and the systems it has to talk to. If you have a prototype or repo, we import it here. On your side: one business owner for the workflow, and IT for the integration in week 3.

First slice

A working version of the workflow in a preview environment your team can click through.

Integration

Connect your systems of record through their existing APIs, files or middleware, and validate data flows in a test environment.

Release

Security gate, sign-off, production release. Every release stays in the history and can be redeployed.

Every pilot has a fixed price. You get the written quote after the demo.

Who you work with

Dr. Eberhard Riesenkampff

Founder & Managing Director

Runs your demo and scopes your pilot with you.

Anel Bejtovic

Chief Technology Officer

Owns the security gate and answers the questions of your IT and your auditor.

Dr. Christoph Schaller

Product Director

Turns your workflow into tasks and keeps the pilot on track.

How the work is organised

Every request becomes a task with acceptance criteria. You approve it, the team builds it, you review it. Each completed task is one clean commit in your repository, so the git history reads like a project log.

• Edit any task in chat before it is built
• Auto-accept or manual review per task
• One task, one commit, one person accountable

Handed over when it runs, not when it is written.

Before a task is handed over, the application has to install, build and start. When one of those fails, the platform reads the real error output, changes the code and runs the check again.

Dependency installation fails

One automatic repair attempt

Build fails, type check or bundle

Up to ten automatic repair attempts

Application fails at runtime

Up to ten automatic repair attempts

The same error twice in a row

Repair stops, the task is marked failed with the error

Prototype tools stop where production starts.

Consumer AI builders get you to a demo. Nuclicore gets the same idea through a security gate, a test environment and an approval into production, and keeps it there.

Nuclicore

Built for production

Built for the audit after go-live.

Own backend, managed Postgres

Express, TypeORM, Postgres, Docker. Standard stack, exportable to GitHub any time.

Preview, Test, Production

Separate databases and secrets per environment, inside the builder.

Governed releases

Security gate, automatic CVE patching, approval, nightly scans, full deployment history.

One release. Every brand's own domain.

Run the same application for every brand, subsidiary or market. Each one gets its own domain, branding, secrets and data. You approve one release, not one per brand.

• One codebase, one release, one approval.
• Own domain and API subdomain per brand, with certificates issued and renewed by the platform.
• Own secrets and own database schema per brand, so data is kept apart.
• Available on Enterprise as deployment labels. Where a policy requires it, a brand can also get a separate database or single-tenant infrastructure.

Broker Collective runs one customer portal for two underwriting brands this way.

Assekuradeure and brokers with several underwriting brands, groups with several subsidiaries, and anyone who would otherwise fork the code for the second market.

You own the code.

Standard React, Node.js and Postgres in a normal git repository. Import from GitHub any time, export to GitHub any time, and back every release up into your own GitLab.

No black box, no platform risk

Your application is containers and a Postgres database, built on a standard stack. If Nuclicore ever ceased to exist, you keep running it on your own infrastructure or with a host of your choice. Any developer can pick it up from the repository.

Audit-ready source

Every task is one commit. Your security team reads the history like a project log and runs its own scanners against the repo.

Portable both ways

Bring an existing repo or prototype in. Take the finished application out. Any developer can pick up where the agents left off.

Already in your own GitLab

Switch on repository backup and every successful release is pushed to your own GitLab: one branch per environment, one commit per release, one way only. The access token is checked for push rights on that exact project and stored encrypted, and no secrets or credential files are included. Your security team gets the escrow answer without an escrow agent.

Frequently asked questions

What buyers, IT and security teams ask before a pilot.

How is Nuclicore different from Claude Code, Cursor, Lovable or our own IT department?

Claude Code and Cursor are excellent tools for developers who already have a team; they make a good engineer faster and give a business user nothing to approve. Lovable, Replit and Bolt produce prototypes on a rented backend with one environment and no release process. Your IT department can build it properly but is booked for the next eighteen months. Nuclicore is the department itself: a product manager agent that writes tasks with acceptance criteria, developers that commit into a real React and Node.js repository with a managed Postgres database, QA, a security gate on every build, DevOps that promotes through preview, test and production, and a named person in your organisation approving each release. IT can read the repository, run its own scanners and export it to GitHub at any time. The business gets the application this quarter; IT gets no new legacy.

Which AI models are used, and is our data used to train them?

You choose: automatic, one model for all agents, or a different model per agent role. Nuclicore offers the frontier models and the cost-efficient models of the large providers, and the catalogue changes as new models ship, so nothing in your application is tied to one vendor. Your workspace content, including your code and your data, is not used to train models.

What kind of software do customers build with Nuclicore?

The things that sit around a core system and never make it out of the IT backlog: customer portals with self-service and status tracking, renewal processes that replace PDF forms and re-keying, partner and broker portals, claims and service-request intake, onboarding and KYC flows, commission statements, internal tools that retire a spreadsheet. Broker Collective runs a customer portal, an IAM portal, a partner portal, claims management and a purchase flow builder. TAS runs automated renewals for its B2B products. The pattern is always the same: one workflow, real roles and rules, integrated into the system of record, in production in weeks.

Who on our side works with Nuclicore, and how much time does it take?

One person who knows the workflow and can decide. No developer needed. While an application is being built, that person describes what is needed, reviews the tasks and approves each release. Your IT joins where your systems are connected. Once the application is live, the platform runs it: hosting, security scans, patches and backups. Your effort then depends on how often you change the application. If you change nothing, it is minimal. On request, a Nuclicore advisor works alongside your team.

How does it connect to our core systems?

Through the interfaces your systems already have: REST and SOAP APIs, webhooks, event streams, SFTP, batch files and middleware. That covers policy administration and broker management systems, CRM, document management, and the APIs and exports of your ERP. If a system has no stable interface or no test environment, the integration becomes its own workstream, and we surface that in week 1 so delivery stays predictable. Common building blocks are built in: e-signature to eIDAS, IBAN verification, e-invoicing with ZUGFeRD and Factur-X, OCR and text extraction, PDF generation, payments with Stripe and email with Mailgun. Each integration has its own monthly budget and limit.

Is the code secure enough for regulated industries?

Yes. Nuclicore runs in production at licensed insurers and regulated firms. Access to the workspace is governed by role-based access control with Owner, Admin, Billing Admin and Developer roles, and sign in runs through Microsoft, Google, GitHub or a one-time code by email. Data is encrypted in transit and at rest. Every release passes a security gate: static code analysis with Semgrep and dependency scanning with Trivy, where critical and high findings stop the release and safe dependency upgrades are applied and committed automatically. ZAP scans run nightly against the running application. Every task is one commit, and the workspace audit trail records approvals, releases and changes with the value before and after, so your auditor reads the record instead of taking our word for it. If you fall under DORA, or your risk carrier passes it down by contract, the security pack includes the Article 30 contract addendum and the data for your register of information.

How do you know the generated code even runs?

A task is handed over once the application installs, builds and starts, not when the code was written. A failed dependency install gets one automatic repair attempt, a failed build or a runtime failure gets up to ten, and each attempt reads the real error output, changes the code and runs the check again. The same error twice in a row stops the repair, and the task is marked failed with the error rather than handed over as done. If a decision from you is needed, the task pauses and asks in the thread. Preview is only reported ready once the application answers through its own frontend and its own API.

Are you certified?

Nuclicore follows the ISO 27001 and SOC 2 control frameworks. On request you receive a security pack with an architecture description, a penetration test summary, the subprocessor list, the DPA template and the DORA contract addendum. We do not currently hold an ISO 27001 certificate or a SOC 2 report. What your auditor can verify directly is more useful than a logo: a security gate on every release, a test environment, a named approval, one commit per task and an audit trail that records changes with the value before and after.

Who owns the code created with Nuclicore?

You do. Completely. Unlike platforms that license you a runtime, Nuclicore generates standard source code that belongs to you and your collaborators. If you leave us, you take your IP with you.

Can one application run under several brands or domains?

Yes. Deployment labels serve the same release on separate branded domains, each with its own secrets, logos and its own database schema. Broker Collective runs one portal for two underwriting brands this way. Labels are an Enterprise feature; where a policy requires it, a label can also get a separate database or single-tenant infrastructure.

How do I keep credit and integration costs under control?

Each integration has its own monthly budget with a hard or soft limit and email alerts. Credits are visible per app and per subscription. Apps stay live if you run out; you top up or upgrade at any time, and any overage is billed at the pay-as-you-go rate.

Ready to take it to production?

Book a demo and leave with a pilot scope, or start free in your browser and import what you already have.

30 min with our founder · live build · no slides

Free plan with no credit card required. Explore first, upgrade when it fits.