I ran the business that depended on the system.
Most people who work on legacy ColdFusion have maintained one. I owned one — the uptime, the security posture, the infrastructure bill, and the P&L, all at once, for twenty-two years. That is the perspective I bring to your application.
I spent twenty-two years as co-founder and CTO of a bootstrapped SaaS platform that hundreds of businesses ran their daily operations on. I migrated it to AWS without downtime, integrated it with thirty-plus enterprise systems, cut infrastructure and storage costs by double-digit percentages, and stayed responsible for it at the board level. I now bring that same ownership perspective to organizations whose ColdFusion applications still run the business.
The platform was DealerPeak — a cloud CRM for the franchise automotive industry that we built from a single dealer to hundreds of dealerships, roughly $8M in annual revenue, more than 500 automotive businesses and over 2,000 active sales personnel. No outside capital. I stepped back from the executive role in 2024 and continue to serve as a Board Advisor.
Alongside that, I've written and maintained production ColdFusion since the early engine days, through the platform's major shifts and every version since. That long memory is what an aging codebase actually needs: someone who recognizes the patterns, the pitfalls, and the safe path forward.
Today I operate as ColdFusion Café Consulting — a solo, senior-only practice based in Portland, Oregon. When you hire me, you get me. No junior developers, no offshore hand-offs, no account managers between you and the person doing the work.
An owner weighs risk differently than a contractor does.
For twenty-two years I was the person who got the call when production was down, signed the invoice for the infrastructure that caused it, and then explained both to a board. Those are usually three different people with three different incentives. When they are the same person, the advice changes.
No reason to sell you a rewrite
A rewrite is the most profitable thing a consultant can recommend and usually the worst thing an owner can authorize. I've been on the side that has to fund it and live with the outage. If a targeted fix solves your problem, that's what the assessment will say.
Infrastructure spend is a real number to me
I cut storage cost by 60% on one migration and infrastructure cost by 35% and 40% on two others — not as an optimization exercise, but because it was my company's money. I read an AWS bill the way a CFO does.
I've been the key-person risk
I know exactly how much of a legacy system lives in one person's head, because for years that person was me. That's why every engagement produces written runbooks and documentation your team keeps.
Where the experience comes from.
- 2024 – present Independent applied R&D and consulting practice. Built an enterprise-scale application on AWS with serverless infrastructure in Python and AWS CDK; engineered a reinforcement-learning model orchestration and routing layer; founded ColdFusion Café Consulting.
- 2002 – 2024 Co-founder & CTO, DealerPeak Inc. Bootstrapped a cloud B2B SaaS CRM for the franchise automotive industry from a single dealer to hundreds of dealerships and roughly $8M in annual revenue, supporting 500+ automotive businesses and 2,000+ active sales personnel. Currently Board Advisor.
- 2018 – 2023 CTO, CarDog LLC. Re-platformed a .NET application stack onto shared AWS resources for a 35% infrastructure cost reduction; grew the customer base 40% in 18 months; automated site provisioning with CloudFormation, Lightsail, ACM, Route 53, S3, and CloudFront, taking deployment from days to minutes.
- 2005 – 2010 First GM OEM CRM certification. Designed, developed, and managed the first OEM CRM certification with General Motors using STAR (Standards for Technology in Automotive Retail), which opened the path to certification with every other major OEM.
- 1999 – 2002 Senior Application Developer, TransferOnline. Brought legacy services online, built an online private stock trading board, and programmed proxy voting and corporate governance reporting systems serving 150+ corporate clients.
Automotive retail, and passing someone else's review.
Twenty-two of those years were spent inside franchise and independent automotive retail — dealer CRM, dealer web systems, dealer management system integrations, and the OEM programs that govern all of it. If you run a dealer group or sell software into one, I don't need the vocabulary explained.
The more transferable part is the certification work. Taking an application through General Motors' technical certification meant submitting our architecture, our data handling, and our security posture to somebody else's standard and passing it — then repeating that with the other OEMs. That is structurally the same exercise as a public-sector security review or a procurement technical assessment: an external body with its own checklist, its own timeline, and no interest in your explanations.
It's why the government and public-sector work feels familiar rather than foreign. I've been the vendor being audited.
I build the scaffolding around AI, not just the prompts.
Since 2024 my independent R&D has been applied AI on AWS: event-driven serverless infrastructure written in Python with AWS CDK, and a reinforcement-learning-based orchestration layer that routes work between models. Two pieces of that are worth naming here, because they're what separate useful AI-assisted delivery from a chatbot with opinions.
I built a Model Context Protocol server for AI memory management and AI pair programming, and I write prompt templates paired with evaluation checks that measure output accuracy — which is to say I treat AI output as something to be verified by construction, not trusted on sight. On a twenty-year-old CFML codebase that distinction is the whole ballgame: AI can read code archaeology far faster than I can, and it can also be confidently, fluently wrong.
I also operate self-hosted AI agents inside my own practice, including one performing operational monitoring duties — watching logs, handling routine operational chores, and acting on alerts — for an application I manage. I've published on deploying and securing that setup, including the trust boundaries, tool policy, sandboxing, and the discipline of treating inbound content as untrusted data rather than instructions.
I run them on my own systems first, deliberately. Autonomous agents are not safe by default — the documented failure modes include prompt injection, over-broad credentials, and third-party extensions exfiltrating data without the operator noticing. Knowing where they break is the qualification; that's why the agent work I offer clients is governance and controls review, not deployment.
Read the write-up on deploying and securing a self-hosted agent — or see everything I've published on the writing page.
Certifications, education, and training.
Certifications
- AWS Certified Solutions Architect – Associate (September 2024)
- AWS Certified Cloud Practitioner (August 2024)
- AWS Certified Solutions Architect – Professional (in progress)
- Dave DeVol’s professional profile on LinkedIn
Education & training
- B.A. Business Administration, University of North Carolina at Greensboro, 1990
- AWS Solutions Architecture Bootcamp, DigitalCloud, 2024
Principles that guide every engagement.
Stabilize first, modernize second
I never recommend a rewrite when a targeted fix will solve the problem. Stability and security come before shiny new architecture.
Designed for phased cutover and rollback
Migrations and upgrades are built as a parallel environment with a tested rollback path and a soak period, so cutover is a decision rather than a leap. I've run migrations of this shape without downtime; I won't guarantee your outcome before I've seen your system.
Transparent, direct communication
You'll always know what I'm doing, why, and what it costs. No surprises, no scope creep without explicit approval.
Document everything
Every engagement produces written deliverables — architecture diagrams, risk registers, runbooks — so your team can maintain the work after I leave.
AI-augmented, human-governed
I use AI tools to accelerate analysis, documentation, and code comprehension, with evaluation checks around the output. Every production decision goes through human judgment.
Earn the retainer
I start with a low-risk assessment so you can evaluate the work before committing to a larger engagement. Trust is built, not assumed.
Book a free 30-minute assessment.
I'll review your ColdFusion version, licensing status, and known-vulnerability exposure — and send you a short written summary. No obligation.
Book a free assessment