Cloude: a consumer cloud product we designed, built and shipped

We built Cloude end to end. The MVP shipped in two weeks. The team we put on it stayed past the launch and built the final consumer product on top of the same foundation. One engagement, one Next.js codebase, one design system, one team across web, desktop and React Native.

One codebase, two surfaces

The first call we made was structural. A consumer cloud product usually ships its marketing site and its product platform from different repos, with different teams and a translation layer between the two. We argued for one Next.js codebase, one design system, one team. The founder bought the argument.

The trade-off is honest. A unified codebase means the marketing team cannot ship copy without coordinating with the engineering deploy, and the product team has to think about SEO when they refactor a component. We took those costs because the upside was bigger. The marketing site embeds the live Files component instead of a mockup, so what the visitor previews on the landing is what they get when they sign up. The launch quarter shipped in one calendar event, not three.

Engineering for scale before the users existed

The MVP had a small early-access cohort when we started. The seed deck projected an order-of-magnitude increase by year one. We engineered for the projection, not the current load.

The library list is virtualised with a fixed row cap regardless of dataset size, so render cost stays flat as the library grows. Recent files come from a single server query indexed on (owner_id, accessed_at desc), so the query plan stays constant per request. Folder pages and recent views read from a local-first IndexedDB cache, kept in sync with the server through a differential sync engine: only changed bytes travel the wire. A laptop in a tunnel keeps working. A reconnection catches up in one round.

Mobile is React Native, not a thinned web app

The shortcut would have been a PWA wrapped in a WebView. We built native instead. The React Native client consumes the same design tokens as the web through a shared package, so a token bump propagates to every surface in one commit. The bundle is engineered to stay under the Store hot-fetch threshold after tree-shaking, so updates download silently. Transport is HTTP/3 over QUIC. The first interactive frame on a low-end Android budget is the same fixed cost regardless of dataset size: virtualised lists and indexed queries do the heavy lifting on the server, not the device.

Encryption without the latency tax

This was the hardest engineering call. End-to-end encryption usually shows up at the tax window: extra round trips, longer cold starts, files that open slower. We refused to ship that.

Storage is encrypted at rest with AES-256-GCM. Per-account keys are derived via Argon2id from the user passphrase and never stored on the server. Shared files travel end-to-end encrypted with X25519 key exchange. Private keys live inside the iOS Secure Enclave and the Android StrongBox, hardware-backed and resistant to extraction even on a rooted device. The architecture is zero-knowledge: the server holds opaque blobs and never sees an unwrapped key.

Independent penetration testing runs on a recurring cadence with a third-party security firm. A public vulnerability disclosure program with a researcher bounty has been live since launch.

The design system that powers Cloude was built fresh for this engagement and now lives across web, desktop and React Native. We are still maintaining it. The team stayed small throughout, augmented by the studio standing agent governance: no contractor sprawl, no vendor handoff. The vulnerability disclosure program inherited from the security work is still active. The design tokens we shipped on day one are the same tokens running in production today.