# Cédric Merlin

> CTO. From infrastructure to the product that pays: cloud architecture, security, AI and product, from critical platforms at scale (up to 750 million requests per day) to SaaS in production. Based in Nancy and Paris. French and English (C2). Founder of M-KIS (https://m-kis.fr).

This site presents 27 concrete cases across 5 galaxies (Leadership 7, Cloud 7, Security 5, AI 8, Products: 4 in-house products). Each case exists as an HTML page and as Markdown (same address, with the .md extension). All content is visible on the page: nothing is hidden. The French version is at https://merlin-cedric.fr/.

## Who, where, how
- [Work together](https://merlin-cedric.fr/en/travailler-ensemble/): where Cédric works (on site in Paris and the Grand Est region, travelling to Luxembourg, French-speaking Switzerland and Belgium, remotely elsewhere) and how to contact him. Assignments go through his company M-KIS.
- [FAQ](https://merlin-cedric.fr/en/faq/): the questions a recruiter or a prospect asks, short answers with links to the proof.
- [CV](https://merlin-cedric.fr/en/cv/): career, skills, certifications (CKA, PCI DSS, ISO 27001, CEH, LPIC-1, CCNA), education (CESI).
- [The CTO](https://merlin-cedric.fr/en/cto/): what a CTO decides, and how.
- [Legal notice](https://merlin-cedric.fr/en/mentions-legales/): publisher, host, audience measurement, credits.
- [Proof wall](https://merlin-cedric.fr/en/preuves/): videos, audio and screenshots, each linked to its case.
- [Long version of this file](https://merlin-cedric.fr/en/llms-full.txt): all 27 cases with problem and result, the full CV.

## Leadership
- [Running a €500k infrastructure budget](https://merlin-cedric.fr/en/direction/budget.md): Servers, workstations and telephony: a single budget of about €500k a year, arbitrated and tracked end to end.
- [Saving €1,220 a month on workstations](https://merlin-cedric.fr/en/direction/postes-cloud.md): Workstations moved to a lighter operating system, centralised authentication: lower costs, less maintenance, €1,220 a month saved.
- [Three hires, three paths, one team that keeps growing](https://merlin-cedric.fr/en/direction/recrutement.md): An apprentice I kept on the team, a first job, a Windows profile trained on Linux: recruiting, training and growing a technical team.
- [Seven vendors, one lead](https://merlin-cedric.fr/en/direction/prestataires.md): Two cloud hosts, a monitoring tool, an external SRE and an external DevOps, email, a telecom carrier: seven vendors, coordinated.
- [Designing the Olympic infrastructure, planned from 2019](https://merlin-cedric.fr/en/direction/jo-architecte.md): Design of the infrastructure for the Rugby World Cup 2023 and the Paris 2024 Olympics, with a build started as early as 2019.
- [Every Friday morning, a review with the executives](https://merlin-cedric.fr/en/direction/point-hebdo.md): Every Friday morning, a review with the executives: current projects, risks, decisions.
- [Founding M-KIS and growing it since 2014](https://merlin-cedric.fr/en/direction/mkis.md): Founder of M-KIS since 2014, a company in France, Togo and Benin: strategy, business development, client relations, partnerships.

## Cloud
- [Holding the Olympic peak without an outage](https://merlin-cedric.fr/en/cloud/grands-evenements.md): Holding the hotel booking peak of the Paris 2024 Olympics and the Rugby World Cup 2023: 750 million requests a day today.
- [One foot at OVH, one foot at AWS](https://merlin-cedric.fr/en/cloud/hybride.md): Moving an application from always-on machines to containers, across OVH and AWS.
- [One crash a day, and no error at all](https://merlin-cedric.fr/en/cloud/monolithe.md): A daily crash with no trace in the logs: a hidden memory reservation pushed the machine past its capacity.
- [A routine maintenance takes the application down](https://merlin-cedric.fr/en/cloud/reboot-404.md): After a host maintenance, a private network card changes name and takes the application down: the cause is a chain of five links.
- [No open port, even under a scan](https://merlin-cedric.fr/en/cloud/zero-port.md): A secure, sovereign infrastructure for a startup with no ops team: under a scan, no open port on the application server.
- [One account opens every access](https://merlin-cedric.fr/en/cloud/acces.md): A VPN opened with the company account, temporary certificates and a rescue console: we always know who gets in.
- [Changing databases without ever accessing them](https://merlin-cedric.fr/en/cloud/scripts-db.md): Running scripts on test and production databases with no direct access: temporary container, approval, traced result.

## Security
- [Finding the flaws that tools miss](https://merlin-cedric.fr/en/securite/bug-bounty.md): Looking for vulnerabilities in an authorised program: written scope, analysis, minimal proof, report and retest.
- [Testing a website faster, without cutting corners](https://merlin-cedric.fr/en/securite/pentest-assiste.md): Automating the mechanical part of a web penetration test to spend more time on analysis, and verifying every finding by hand.
- [Penetration testing: AI helps, I decide](https://merlin-cedric.fr/en/securite/cadre-ia.md): My method for authorised penetration tests: eight phases that I run myself, with AI to speed up the triage of results.
- [Five downloads in under a minute](https://merlin-cedric.fr/en/securite/captcha.md): Blocking bots on a public form without a third-party captcha: single-use signed token, decoy field, a rate limit that survives redeployments.
- [Turning a standard into technical alerts](https://merlin-cedric.fr/en/securite/conformite.md): Each requirement of a standard (ISO 27001, ISO 27005, PCI DSS) becomes a technical control, then an alert.

## AI
- [A bot answers questions about production](https://merlin-cedric.fr/en/ia/bot-infra.md): A bot that queries the production infrastructure read-only, through an MCP server, with every access traced.
- [An assistant keeps the thread during an absence](https://merlin-cedric.fr/en/ia/continuite.md): An assistant on a European server, with a model that retains nothing, prepares the work of an absent leadership team.
- [An assistant that prompts me in meetings](https://merlin-cedric.fr/en/ia/souffleur.md): A 100% local meeting assistant: transcription on the machine, jargon corrected, three lines whispered at the right moment.
- [A voice agent that makes the calls for me](https://merlin-cedric.fr/en/ia/leo.md): Léo, a hand-built prospecting voice agent, telephony included: it introduces itself as Cédric’s virtual secretary, offers a slot and logs a summary.
- [An AI invented two wrong definitions](https://merlin-cedric.fr/en/ia/hallucination.md): A caution instruction is not enough: I give the model document excerpts, otherwise the answer is “absent from the sources”.
- [One-minute videos, built by script](https://merlin-cedric.fr/en/ia/debunk.md): Nine steps, from fact-checking to the final file, to deflate an alarmist AI or security headline in one minute.
- [AI videos with no cuts and no drift](https://merlin-cedric.fr/en/ia/video-ia.md): Routing between video models, a frame-by-frame automatic judge, hidden-cut detection and joins on the last real frame, with cost tracked per call.
- [A robot that recognises the family](https://merlin-cedric.fr/en/ia/reachy.md): A small robot with local face recognition, a tone adapted to each person and a sense of rhythm: nothing leaves the house.

## Products
- [Kadens](https://kadens.m-kis.fr): Gym management software. Customers who pay.
- [SafePrompt](https://safeprompt.m-kis.fr): Keep your data out of AI tools.
- [Merlya](https://merlya.fr): Quotes prepared in a few minutes.
- [Analya](https://analya.fr): A company’s financial health in 10 minutes.

## Contact
- Mail: contact@merlin-cedric.fr
- LinkedIn: https://www.linkedin.com/in/cedric-merlin-623998a7
- TikTok · short videos: https://www.tiktok.com/@cedricmkis
- Company: https://m-kis.fr