diff --git a/cloud-tracker/.env.example b/cloud-tracker/.env.example
new file mode 100644
index 00000000..21f04e50
--- /dev/null
+++ b/cloud-tracker/.env.example
@@ -0,0 +1,32 @@
+# ─────────────────────────────────────────────
+# Cloud Tracker – Environment Configuration
+# Copy this file to .env and fill in the values
+# ─────────────────────────────────────────────
+
+# Database
+DB_PASSWORD=change_me_strong_password
+
+# Flask secret key (generate with: python3 -c "import secrets; print(secrets.token_hex(32))")
+SECRET_KEY=change_me_flask_secret
+
+# ── IRIS IAM / OIDC ─────────────────────────
+# Register your application at https://iris-iam.stfc.ac.uk/
+# Redirect URI to register: ${APP_BASE_URL}/auth/callback
+OIDC_CLIENT_ID=your-client-id
+OIDC_CLIENT_SECRET=your-client-secret
+OIDC_DISCOVERY_URL=https://iris-iam.stfc.ac.uk/.well-known/openid-configuration
+
+# Public base URL of this application (no trailing slash)
+APP_BASE_URL=https://cloud-tracker.example.stfc.ac.uk
+
+# ── Site settings ────────────────────────────
+SITE_TITLE=STFC Cloud Tracker
+
+# Comma-separated email addresses that are granted admin rights
+ADMIN_EMAILS=admin@stfc.ac.uk,another.admin@stfc.ac.uk
+
+# ── Backup settings ──────────────────────────
+# Cron expression for db-backup service (default: 02:00 daily)
+BACKUP_SCHEDULE=0 2 * * *
+# Number of days to keep backups
+BACKUP_RETAIN_DAYS=7
diff --git a/cloud-tracker/.gitignore b/cloud-tracker/.gitignore
new file mode 100644
index 00000000..7efdf564
--- /dev/null
+++ b/cloud-tracker/.gitignore
@@ -0,0 +1,37 @@
+# Environment secrets
+.env
+*.env
+.env.*
+!.env.example
+
+# SSL / certs
+ssl/*.key
+ssl/*.crt
+ssl/*.pem
+ssl/*.p12
+ssl/*.csr
+ssl/*.der
+
+# Python artifacts
+__pycache__/
+*.pyc
+*.pyo
+*.pyd
+
+# Editor / IDE
+.vscode/
+.idea/
+*.swp
+*~
+
+# OS artifacts
+.DS_Store
+Thumbs.db
+
+# Local runtime/log files
+*.log
+*.tmp
+*.bak
+
+# Claude Code
+.claude/
\ No newline at end of file
diff --git a/cloud-tracker/app/Dockerfile b/cloud-tracker/app/Dockerfile
new file mode 100644
index 00000000..ac9782a9
--- /dev/null
+++ b/cloud-tracker/app/Dockerfile
@@ -0,0 +1,46 @@
+FROM ubuntu:22.04
+
+LABEL maintainer="STFC Scientific Computing"
+LABEL description="STFC Cloud Tracker – Apache + mod_wsgi + Flask"
+
+ENV DEBIAN_FRONTEND=noninteractive
+ENV APACHE_RUN_USER=www-data
+ENV APACHE_RUN_GROUP=www-data
+ENV APACHE_LOG_DIR=/var/log/apache2
+
+# ── System packages ──────────────────────────────────────
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    apache2 \
+    libapache2-mod-wsgi-py3 \
+    python3 \
+    python3-pip \
+    python3-dev \
+    libpq-dev \
+    gcc \
+    curl \
+    && rm -rf /var/lib/apt/lists/*
+
+# ── Enable Apache modules ────────────────────────────────
+RUN a2enmod wsgi headers expires
+
+# ── Python dependencies ──────────────────────────────────
+COPY requirements.txt /tmp/requirements.txt
+RUN pip3 install --no-cache-dir -r /tmp/requirements.txt
+
+# ── Application code ─────────────────────────────────────
+WORKDIR /var/www/app
+COPY . /var/www/app/
+RUN chown -R www-data:www-data /var/www/app
+
+# ── Apache configuration ─────────────────────────────────
+COPY apache-app.conf /etc/apache2/sites-available/cloudtracker.conf
+RUN a2dissite 000-default.conf && a2ensite cloudtracker.conf
+
+# ── Entrypoint ────────────────────────────────────────────
+COPY docker-entrypoint.sh /usr/local/bin/docker-entrypoint.sh
+RUN chmod +x /usr/local/bin/docker-entrypoint.sh
+
+EXPOSE 80
+
+ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]
+CMD ["apache2ctl", "-D", "FOREGROUND"]
diff --git a/cloud-tracker/app/__init__.py b/cloud-tracker/app/__init__.py
new file mode 100644
index 00000000..a7b923a1
--- /dev/null
+++ b/cloud-tracker/app/__init__.py
@@ -0,0 +1,55 @@
+import os
+from flask import Flask
+from flask_sqlalchemy import SQLAlchemy
+from authlib.integrations.flask_client import OAuth
+
+db = SQLAlchemy()
+oauth = OAuth()
+
+
+def create_app():
+    app = Flask(__name__)
+
+    app.config['SECRET_KEY'] = os.environ['SECRET_KEY']
+    app.config['SQLALCHEMY_DATABASE_URI'] = os.environ['DATABASE_URL']
+    app.config['SQLALCHEMY_TRACK_MODIFICATIONS'] = False
+    app.config['SITE_TITLE'] = os.environ.get('SITE_TITLE', 'STFC Cloud Tracker')
+    app.config['APP_BASE_URL'] = os.environ.get('APP_BASE_URL', '')
+    admin_raw = os.environ.get('ADMIN_EMAILS', '')
+    app.config['ADMIN_EMAILS'] = [e.strip() for e in admin_raw.split(',') if e.strip()]
+
+    db.init_app(app)
+    oauth.init_app(app)
+
+    oauth.register(
+        name='iris_iam',
+        client_id=os.environ['OIDC_CLIENT_ID'],
+        client_secret=os.environ['OIDC_CLIENT_SECRET'],
+        server_metadata_url=os.environ['OIDC_DISCOVERY_URL'],
+        client_kwargs={
+            'scope': 'openid email profile',
+        },
+    )
+
+    from .auth import auth_bp, current_user, is_admin
+    from .routes import main_bp
+    from .metrics import metrics_bp
+    from .quota import quota_bp
+
+    app.register_blueprint(auth_bp)
+    app.register_blueprint(main_bp)
+    app.register_blueprint(metrics_bp)
+    app.register_blueprint(quota_bp)
+
+    @app.context_processor
+    def inject_globals():
+        return {
+            'site_title': app.config.get('SITE_TITLE', 'STFC Cloud Tracker'),
+            'current_user': current_user(),
+            'is_admin': is_admin(),
+        }
+
+    with app.app_context():
+        db.create_all()
+
+    return app
diff --git a/cloud-tracker/app/apache-app.conf b/cloud-tracker/app/apache-app.conf
new file mode 100644
index 00000000..42d44cea
--- /dev/null
+++ b/cloud-tracker/app/apache-app.conf
@@ -0,0 +1,47 @@
+# ── Main site (served over plain HTTP; host Apache is the public TLS edge) ──
+<VirtualHost *:80>
+    ServerName _default_
+
+    # Security headers (HTTP-appropriate; no HSTS since this vhost isn't TLS)
+    Header always set X-Content-Type-Options    "nosniff"
+    Header always set X-Frame-Options           "SAMEORIGIN"
+    Header always set Referrer-Policy           "strict-origin-when-cross-origin"
+    Header always set Content-Security-Policy   "default-src 'self'; style-src 'self' 'unsafe-inline'; script-src 'self' 'unsafe-inline';"
+
+    # WSGI application
+    WSGIDaemonProcess cloudtracker \
+        python-path=/var/www \
+        user=www-data \
+        group=www-data \
+        processes=2 \
+        threads=5 \
+        display-name=%{GROUP}
+
+    WSGIProcessGroup  cloudtracker
+    WSGIApplicationGroup %{GLOBAL}
+    WSGIScriptAlias / /var/www/app/wsgi.py
+    WSGIPassAuthorization On
+
+    <Directory /var/www/app>
+        <Files wsgi.py>
+            Require all granted
+        </Files>
+    </Directory>
+
+    # Static files served directly by Apache
+    Alias /static /var/www/app/static
+    <Directory /var/www/app/static>
+        Require all granted
+        Options -Indexes
+        ExpiresActive On
+        ExpiresDefault "access plus 1 week"
+    </Directory>
+
+    # Restrict Prometheus metrics endpoint to internal network only
+    <Location /metrics>
+        Require ip 127.0.0.1 ::1 172.16.0.0/12 10.0.0.0/8
+    </Location>
+
+    ErrorLog  ${APACHE_LOG_DIR}/cloudtracker_error.log
+    CustomLog ${APACHE_LOG_DIR}/cloudtracker_access.log combined
+</VirtualHost>
diff --git a/cloud-tracker/app/auth.py b/cloud-tracker/app/auth.py
new file mode 100644
index 00000000..1e64549c
--- /dev/null
+++ b/cloud-tracker/app/auth.py
@@ -0,0 +1,63 @@
+from flask import (
+    Blueprint, redirect, url_for, session,
+    request, current_app,
+)
+from functools import wraps
+from . import oauth
+
+auth_bp = Blueprint('auth', __name__, url_prefix='/auth')
+
+
+def login_required(f):
+    @wraps(f)
+    def decorated(*args, **kwargs):
+        if 'user' not in session:
+            session['next'] = request.url
+            return redirect(url_for('auth.login'))
+        return f(*args, **kwargs)
+    return decorated
+
+
+def current_user():
+    return session.get('user')
+
+
+def is_admin():
+    user = current_user()
+    if not user:
+        return False
+    return user.get('email', '') in current_app.config.get('ADMIN_EMAILS', [])
+
+
+@auth_bp.route('/login')
+def login():
+    redirect_uri = current_app.config['APP_BASE_URL'] + url_for('auth.callback')
+    return oauth.iris_iam.authorize_redirect(redirect_uri)
+
+
+@auth_bp.route('/callback')
+def callback():
+    token = oauth.iris_iam.authorize_access_token()
+    userinfo = token.get('userinfo') or oauth.iris_iam.userinfo()
+    session['user'] = {
+        'sub':   userinfo.get('sub'),
+        'name':  userinfo.get('name', userinfo.get('preferred_username', 'Unknown')),
+        'email': userinfo.get('email', ''),
+    }
+    next_url = session.pop('next', None)
+    return redirect(next_url or url_for('main.index'))
+
+
+@auth_bp.route('/logout')
+def logout():
+    session.clear()
+    # Redirect to OIDC end_session_endpoint if available
+    try:
+        meta = oauth.iris_iam.load_server_metadata()
+        end_session = meta.get('end_session_endpoint')
+        if end_session:
+            post_logout = current_app.config['APP_BASE_URL'] + url_for('main.index')
+            return redirect(f"{end_session}?post_logout_redirect_uri={post_logout}")
+    except Exception:
+        pass
+    return redirect(url_for('main.index'))
diff --git a/cloud-tracker/app/docker-entrypoint.sh b/cloud-tracker/app/docker-entrypoint.sh
new file mode 100644
index 00000000..4c8c8c4e
--- /dev/null
+++ b/cloud-tracker/app/docker-entrypoint.sh
@@ -0,0 +1,19 @@
+#!/bin/bash
+set -e
+
+# Wait for database to be ready
+echo "Waiting for database..."
+until python3 -c "
+import os, sys, psycopg2
+try:
+    psycopg2.connect(os.environ['DATABASE_URL'])
+    print('Database ready.')
+except Exception as e:
+    print(f'Not ready: {e}')
+    sys.exit(1)
+" 2>/dev/null; do
+    sleep 2
+done
+
+echo "Starting Apache..."
+exec "$@"
diff --git a/cloud-tracker/app/metrics.py b/cloud-tracker/app/metrics.py
new file mode 100644
index 00000000..1f05c268
--- /dev/null
+++ b/cloud-tracker/app/metrics.py
@@ -0,0 +1,55 @@
+from flask import Blueprint, Response
+from prometheus_client import (
+    generate_latest, CONTENT_TYPE_LATEST,
+    Gauge, REGISTRY,
+)
+
+metrics_bp = Blueprint('metrics', __name__)
+
+# Custom application metrics
+tracked_projects_total = Gauge(
+    'cloudtracker_tracked_projects_total',
+    'Total number of projects with a recorded quota snapshot',
+)
+quota_snapshots_total = Gauge(
+    'cloudtracker_quota_snapshots_total',
+    'Total number of quota snapshots recorded',
+)
+funding_parties_total = Gauge(
+    'cloudtracker_funding_parties_total',
+    'Total number of funding parties defined',
+)
+project_quota = Gauge(
+    'cloudtracker_project_quota',
+    'Latest recorded quota value per project and field',
+    ['project', 'field'],
+)
+
+
+@metrics_bp.route('/metrics')
+def prometheus_metrics():
+    """Prometheus scrape endpoint. Restrict to internal network via Apache config."""
+    _refresh_metrics()
+    return Response(generate_latest(REGISTRY), mimetype=CONTENT_TYPE_LATEST)
+
+
+def _refresh_metrics():
+    from . import db
+    from .models import QuotaSnapshot, FundingParty, QUOTA_FIELD_KEYS
+    try:
+        quota_snapshots_total.set(QuotaSnapshot.query.count())
+        funding_parties_total.set(FundingParty.query.count())
+
+        project_names = [r[0] for r in db.session.query(QuotaSnapshot.project_name).distinct()]
+        tracked_projects_total.set(len(project_names))
+        for project_name in project_names:
+            latest = (QuotaSnapshot.query
+                      .filter_by(project_name=project_name)
+                      .order_by(QuotaSnapshot.recorded_at.desc())
+                      .first())
+            for key in QUOTA_FIELD_KEYS:
+                val = getattr(latest, key)
+                if val is not None:
+                    project_quota.labels(project=project_name, field=key).set(val)
+    except Exception:
+        pass
diff --git a/cloud-tracker/app/models.py b/cloud-tracker/app/models.py
new file mode 100644
index 00000000..3cce826f
--- /dev/null
+++ b/cloud-tracker/app/models.py
@@ -0,0 +1,73 @@
+from datetime import datetime, timezone
+from . import db
+
+
+# ── Quota allocation tracking (funding parties, manual entry, change log) ────
+
+QUOTA_FIELDS = [
+    ('cpu_cores',            'CPU Cores',            'cores'),
+    ('instances',            'Instances',            ''),
+    ('ram_gb',               'RAM',                  'GB'),
+    ('floating_ips',         'Floating IPs',         ''),
+    ('security_group_rules', 'Security Group Rules', ''),
+    ('cinder_storage_gb',    'Cinder Storage',       'GB'),
+    ('backups',              'Backups',              ''),
+    ('security_groups',      'Security Groups',      ''),
+    ('snapshots_count',      'Snapshots',            ''),
+    ('volumes',              'Volumes',              ''),
+]
+QUOTA_FIELD_KEYS = [f[0] for f in QUOTA_FIELDS]
+QUOTA_FIELD_LABELS = {f[0]: f[1] for f in QUOTA_FIELDS}
+QUOTA_FIELD_UNITS = {f[0]: f[2] for f in QUOTA_FIELDS}
+
+
+class QuotaSnapshot(db.Model):
+    __tablename__ = 'quota_snapshots'
+
+    id = db.Column(db.Integer, primary_key=True)
+    project_name = db.Column(db.String(255), nullable=False, index=True)
+    recorded_by = db.Column(db.String(255), nullable=True)
+    recorded_at = db.Column(db.DateTime, nullable=False,
+                            default=lambda: datetime.now(timezone.utc), index=True)
+    cpu_cores = db.Column(db.Integer, nullable=True)
+    instances = db.Column(db.Integer, nullable=True)
+    ram_gb = db.Column(db.Integer, nullable=True)
+    floating_ips = db.Column(db.Integer, nullable=True)
+    security_group_rules = db.Column(db.Integer, nullable=True)
+    cinder_storage_gb = db.Column(db.Integer, nullable=True)
+    backups = db.Column(db.Integer, nullable=True)
+    security_groups = db.Column(db.Integer, nullable=True)
+    snapshots_count = db.Column(db.Integer, nullable=True)
+    volumes = db.Column(db.Integer, nullable=True)
+
+
+class QuotaChangeLogEntry(db.Model):
+    __tablename__ = 'quota_change_log'
+
+    id = db.Column(db.Integer, primary_key=True)
+    snapshot_id = db.Column(db.Integer, db.ForeignKey('quota_snapshots.id', ondelete='CASCADE'),
+                            nullable=False, index=True)
+    project_name = db.Column(db.String(255), nullable=False, index=True)
+    field_name = db.Column(db.String(100), nullable=False, index=True)
+    previous_value = db.Column(db.Integer, nullable=True)
+    new_value = db.Column(db.Integer, nullable=True)
+    difference = db.Column(db.Integer, nullable=True)
+    status = db.Column(db.String(20), nullable=False, default='unchanged', index=True)
+    recorded_at = db.Column(db.DateTime, nullable=False,
+                            default=lambda: datetime.now(timezone.utc), index=True)
+
+
+class FundingParty(db.Model):
+    __tablename__ = 'funding_parties'
+
+    id = db.Column(db.Integer, primary_key=True)
+    name = db.Column(db.String(255), nullable=False)
+
+
+class PartyProject(db.Model):
+    __tablename__ = 'party_projects'
+
+    id = db.Column(db.Integer, primary_key=True)
+    party_id = db.Column(db.Integer, db.ForeignKey('funding_parties.id', ondelete='CASCADE'),
+                         nullable=False, index=True)
+    project_name = db.Column(db.String(255), nullable=False, index=True)
diff --git a/cloud-tracker/app/quota.py b/cloud-tracker/app/quota.py
new file mode 100644
index 00000000..bb712833
--- /dev/null
+++ b/cloud-tracker/app/quota.py
@@ -0,0 +1,283 @@
+from flask import (
+    Blueprint, render_template, request, redirect,
+    url_for, flash, jsonify,
+)
+from . import db
+from .auth import login_required, current_user
+from .models import (
+    QuotaSnapshot, QuotaChangeLogEntry, FundingParty, PartyProject,
+    QUOTA_FIELDS, QUOTA_FIELD_KEYS, QUOTA_FIELD_LABELS,
+)
+
+quota_bp = Blueprint('quota', __name__, url_prefix='/quota')
+
+
+def _known_projects():
+    rows = (db.session.query(QuotaSnapshot.project_name)
+            .distinct().order_by(QuotaSnapshot.project_name).all())
+    return [r[0] for r in rows]
+
+
+def _latest_snapshot(project_name):
+    return (QuotaSnapshot.query
+            .filter_by(project_name=project_name)
+            .order_by(QuotaSnapshot.recorded_at.desc())
+            .first())
+
+
+# ── Quota entry ───────────────────────────────────────────────────────────────
+
+@quota_bp.route('/entry', methods=['GET'])
+@login_required
+def entry():
+    return render_template('quota_entry.html',
+        quota_fields=QUOTA_FIELDS,
+        projects=_known_projects(),
+        form_data=None,
+    )
+
+
+@quota_bp.route('/entry', methods=['POST'])
+@login_required
+def entry_post():
+    project_name = request.form.get('project_name', '').strip()
+
+    def _rerender(error_msg):
+        flash(error_msg, 'error')
+        return render_template('quota_entry.html',
+            quota_fields=QUOTA_FIELDS,
+            projects=_known_projects(),
+            form_data=request.form,
+        )
+
+    if not project_name:
+        return _rerender('Project name is required.')
+
+    entered = {}
+    for key, label, _unit in QUOTA_FIELDS:
+        raw = request.form.get(key, '').strip()
+        if raw == '':
+            entered[key] = None
+        else:
+            try:
+                entered[key] = int(float(raw))
+            except ValueError:
+                return _rerender(f'Invalid value for {label}: "{raw}" — please enter a whole number.')
+
+    if all(v is None for v in entered.values()):
+        return _rerender('At least one quota field must be filled in.')
+
+    result = _record_quota(project_name, entered, current_user()['email'])
+    if result['is_first']:
+        flash(f'Baseline recorded for "{project_name}".', 'success')
+    elif result['changed_count'] > 0:
+        flash(f'{result["changed_count"]} field(s) changed for "{project_name}".', 'success')
+    else:
+        flash(f'No changes detected for "{project_name}" — values recorded.', 'info')
+
+    return redirect(url_for('quota.log'))
+
+
+def _record_quota(project_name, entered, recorded_by):
+    """entered: dict {field_key: int or None}. None = carry previous value forward."""
+    prev = _latest_snapshot(project_name)
+    is_first = prev is None
+
+    snap_values = {}
+    for key in QUOTA_FIELD_KEYS:
+        if entered[key] is not None:
+            snap_values[key] = entered[key]
+        elif prev is not None:
+            snap_values[key] = getattr(prev, key)
+        else:
+            snap_values[key] = None
+
+    snapshot = QuotaSnapshot(project_name=project_name, recorded_by=recorded_by, **snap_values)
+    db.session.add(snapshot)
+    db.session.flush()  # assign snapshot.id
+
+    changed_count = 0
+    for key in QUOTA_FIELD_KEYS:
+        new_val = snap_values[key]
+        prev_val = getattr(prev, key) if prev else None
+
+        if is_first:
+            status, diff = 'new', None
+        elif entered[key] is None:
+            status, diff = 'unchanged', 0
+        elif prev_val != new_val:
+            status = 'changed'
+            changed_count += 1
+            diff = (new_val - prev_val) if (new_val is not None and prev_val is not None) else None
+        else:
+            status, diff = 'unchanged', 0
+
+        db.session.add(QuotaChangeLogEntry(
+            snapshot_id=snapshot.id, project_name=project_name, field_name=key,
+            previous_value=prev_val, new_value=new_val, difference=diff, status=status,
+        ))
+
+    db.session.commit()
+    return {'snapshot_id': snapshot.id, 'is_first': is_first, 'changed_count': changed_count}
+
+
+# ── Change log ────────────────────────────────────────────────────────────────
+
+@quota_bp.route('/log')
+@login_required
+def log():
+    project_filter = request.args.get('project', '')
+    changed_only = request.args.get('changed_only', '1') == '1'
+
+    query = (db.session.query(QuotaSnapshot)
+             .order_by(QuotaSnapshot.recorded_at.desc()))
+    if project_filter:
+        query = query.filter(QuotaSnapshot.project_name == project_filter)
+    snapshots = query.limit(100).all()
+
+    events = []
+    for snap in snapshots:
+        changes = (QuotaChangeLogEntry.query
+                   .filter_by(snapshot_id=snap.id)
+                   .order_by(QuotaChangeLogEntry.field_name).all())
+        changed_count = sum(1 for c in changes if c.status == 'changed')
+        new_count = sum(1 for c in changes if c.status == 'new')
+        if changed_only and changed_count == 0 and new_count == 0:
+            continue
+        events.append({
+            'id': snap.id, 'project_name': snap.project_name,
+            'recorded_at': snap.recorded_at, 'recorded_by': snap.recorded_by,
+            'changed_count': changed_count, 'new_count': new_count,
+            'changes': changes,
+        })
+
+    return render_template('quota_log.html',
+        events=events,
+        projects=_known_projects(),
+        project_filter=project_filter,
+        changed_only=changed_only,
+        field_labels=QUOTA_FIELD_LABELS,
+    )
+
+
+# ── Raw snapshot listing ─────────────────────────────────────────────────────
+
+@quota_bp.route('/snapshots')
+@login_required
+def snapshots():
+    project_filter = request.args.get('project', '')
+    query = QuotaSnapshot.query.order_by(QuotaSnapshot.recorded_at.desc())
+    if project_filter:
+        query = query.filter_by(project_name=project_filter)
+    rows = query.limit(200).all()
+    return render_template('quota_snapshots.html',
+        snapshots=rows,
+        projects=_known_projects(),
+        project_filter=project_filter,
+        quota_fields=QUOTA_FIELDS,
+    )
+
+
+# ── Funding parties ───────────────────────────────────────────────────────────
+
+@quota_bp.route('/parties')
+@login_required
+def parties():
+    parties = FundingParty.query.order_by(FundingParty.name).all()
+
+    result = []
+    for party in parties:
+        proj_names = [pp.project_name for pp in
+                      PartyProject.query.filter_by(party_id=party.id)
+                      .order_by(PartyProject.project_name).all()]
+
+        party_projects = []
+        party_totals = {k: 0 for k in QUOTA_FIELD_KEYS}
+        for pname in proj_names:
+            snap = _latest_snapshot(pname)
+            if snap:
+                party_projects.append(snap)
+                for k in QUOTA_FIELD_KEYS:
+                    val = getattr(snap, k)
+                    if val is not None:
+                        party_totals[k] += val
+            else:
+                party_projects.append({'project_name': pname, 'recorded_at': None, 'recorded_by': None})
+
+        result.append({
+            'id': party.id, 'name': party.name,
+            'projects': party_projects, 'totals': party_totals,
+            'project_count': len(proj_names),
+        })
+
+    return render_template('quota_parties.html',
+        parties=result,
+        all_projects=_known_projects(),
+        quota_fields=QUOTA_FIELDS,
+    )
+
+
+@quota_bp.route('/parties/new', methods=['POST'])
+@login_required
+def parties_new():
+    name = request.form.get('name', '').strip()
+    if not name:
+        flash('Party name is required.', 'error')
+        return redirect(url_for('quota.parties'))
+    db.session.add(FundingParty(name=name))
+    db.session.commit()
+    flash(f'Funding party "{name}" created.', 'success')
+    return redirect(url_for('quota.parties'))
+
+
+@quota_bp.route('/parties/<int:party_id>/add-project', methods=['POST'])
+@login_required
+def parties_add_project(party_id):
+    project_name = request.form.get('project_name', '').strip()
+    if not project_name:
+        flash('Project name is required.', 'error')
+        return redirect(url_for('quota.parties'))
+    db.session.add(PartyProject(party_id=party_id, project_name=project_name))
+    db.session.commit()
+    flash(f'Project "{project_name}" added.', 'success')
+    return redirect(url_for('quota.parties'))
+
+
+@quota_bp.route('/parties/<int:party_id>/remove-project', methods=['POST'])
+@login_required
+def parties_remove_project(party_id):
+    project_name = request.form.get('project_name', '').strip()
+    PartyProject.query.filter_by(party_id=party_id, project_name=project_name).delete()
+    db.session.commit()
+    flash(f'Project "{project_name}" removed.', 'success')
+    return redirect(url_for('quota.parties'))
+
+
+@quota_bp.route('/parties/<int:party_id>/delete', methods=['POST'])
+@login_required
+def parties_delete(party_id):
+    party = db.session.get(FundingParty, party_id)
+    if party:
+        name = party.name
+        db.session.delete(party)
+        db.session.commit()
+        flash(f'Funding party "{name}" deleted.', 'success')
+    return redirect(url_for('quota.parties'))
+
+
+# ── API endpoints ─────────────────────────────────────────────────────────────
+
+@quota_bp.route('/api/projects')
+@login_required
+def api_projects():
+    return jsonify({'projects': _known_projects()})
+
+
+@quota_bp.route('/api/project/<project_name>/current')
+@login_required
+def api_project_current(project_name):
+    snap = _latest_snapshot(project_name)
+    if not snap:
+        return jsonify({'found': False})
+    values = {k: getattr(snap, k) for k in QUOTA_FIELD_KEYS}
+    return jsonify({'found': True, 'values': values})
diff --git a/cloud-tracker/app/requirements.txt b/cloud-tracker/app/requirements.txt
new file mode 100644
index 00000000..eebddc74
--- /dev/null
+++ b/cloud-tracker/app/requirements.txt
@@ -0,0 +1,7 @@
+Flask==3.0.3
+Flask-SQLAlchemy==3.1.1
+authlib==1.3.1
+requests==2.32.3
+psycopg2-binary==2.9.9
+prometheus-client==0.20.0
+Werkzeug==3.0.3
diff --git a/cloud-tracker/app/routes.py b/cloud-tracker/app/routes.py
new file mode 100644
index 00000000..02b14eda
--- /dev/null
+++ b/cloud-tracker/app/routes.py
@@ -0,0 +1,62 @@
+from flask import Blueprint, render_template
+from . import db
+from .models import QuotaSnapshot, QuotaChangeLogEntry, FundingParty, QUOTA_FIELDS, QUOTA_FIELD_KEYS
+from .auth import login_required
+
+main_bp = Blueprint('main', __name__)
+
+
+@main_bp.route('/')
+@login_required
+def index():
+    total_projects = db.session.query(QuotaSnapshot.project_name).distinct().count()
+    total_records = QuotaSnapshot.query.count()
+    last_entry = db.session.query(db.func.max(QuotaSnapshot.recorded_at)).scalar()
+    total_parties = FundingParty.query.count()
+
+    # Latest snapshot per project (current allocations)
+    latest_ids = (db.session.query(db.func.max(QuotaSnapshot.id))
+                  .group_by(QuotaSnapshot.project_name).all())
+    current_allocations = (QuotaSnapshot.query
+                           .filter(QuotaSnapshot.id.in_([i for (i,) in latest_ids]))
+                           .order_by(QuotaSnapshot.project_name).all())
+
+    totals = {k: 0 for k in QUOTA_FIELD_KEYS}
+    for snap in current_allocations:
+        for k in QUOTA_FIELD_KEYS:
+            val = getattr(snap, k)
+            if val is not None:
+                totals[k] += val
+
+    # Recent change events (snapshots with at least one changed field)
+    recent_events = []
+    for snap in (QuotaSnapshot.query.order_by(QuotaSnapshot.recorded_at.desc()).limit(20).all()):
+        changed_count = QuotaChangeLogEntry.query.filter_by(
+            snapshot_id=snap.id, status='changed').count()
+        if changed_count > 0:
+            recent_events.append({'snapshot': snap, 'changed_count': changed_count})
+        if len(recent_events) >= 8:
+            break
+
+    return render_template('index.html',
+        total_projects=total_projects,
+        total_records=total_records,
+        total_parties=total_parties,
+        last_entry=last_entry,
+        current_allocations=current_allocations,
+        recent_events=recent_events,
+        quota_fields=QUOTA_FIELDS,
+        totals=totals,
+    )
+
+
+# ── Error handlers ─────────────────────────────────────────────────────────────
+
+@main_bp.app_errorhandler(403)
+def forbidden(e):
+    return render_template('403.html'), 403
+
+
+@main_bp.app_errorhandler(404)
+def not_found(e):
+    return render_template('404.html'), 404
diff --git a/cloud-tracker/app/static/css/style.css b/cloud-tracker/app/static/css/style.css
new file mode 100644
index 00000000..5c9b1b9f
--- /dev/null
+++ b/cloud-tracker/app/static/css/style.css
@@ -0,0 +1,579 @@
+/* ============================================================
+   STFC Cloud Tracker – Stylesheet
+   Brand reference: UKRI/STFC colour palette
+   ============================================================ */
+
+:root {
+  --stfc-navy:       #003865;
+  --stfc-blue:       #0072CE;
+  --stfc-mid-blue:   #005EB8;
+  --stfc-light-blue: #41B6E6;
+  --stfc-cyan:       #00B0F0;
+  --stfc-white:      #ffffff;
+  --stfc-off-white:  #f4f6f9;
+  --stfc-grey-light: #e8ecf0;
+  --stfc-grey:       #c8d0d8;
+  --stfc-grey-mid:   #6b7685;
+  --stfc-text:       #1a1f27;
+  --stfc-text-muted: #5a6370;
+
+  --color-success:   #00703c;
+  --color-warning:   #d4720a;
+  --color-danger:    #b10e1e;
+  --color-info:      #1d70b8;
+  --color-pending:   #d4720a;
+  --color-approved:  #00703c;
+  --color-rejected:  #b10e1e;
+  --color-in-progress: #1d70b8;
+
+  --radius:   4px;
+  --radius-lg: 8px;
+  --shadow:   0 1px 4px rgba(0,0,0,0.10);
+  --shadow-md: 0 2px 12px rgba(0,0,0,0.13);
+  --transition: 0.18s ease;
+
+  --font-sans: "Helvetica Neue", Arial, "Liberation Sans", sans-serif;
+  --font-mono: "Courier New", monospace;
+}
+
+/* ── Reset ──────────────────────────────────────────────── */
+*, *::before, *::after { box-sizing: border-box; margin: 0; padding: 0; }
+html { font-size: 16px; scroll-behavior: smooth; }
+body {
+  font-family: var(--font-sans);
+  color: var(--stfc-text);
+  background: var(--stfc-off-white);
+  min-height: 100vh;
+  display: flex;
+  flex-direction: column;
+  line-height: 1.5;
+}
+a { color: var(--stfc-blue); text-decoration: none; }
+a:hover { text-decoration: underline; color: var(--stfc-navy); }
+img { max-width: 100%; }
+
+/* ── Layout ─────────────────────────────────────────────── */
+.container {
+  width: 100%;
+  max-width: 1200px;
+  margin: 0 auto;
+  padding: 0 1.5rem;
+}
+.main-content {
+  flex: 1;
+  padding: 2rem 0 3rem;
+}
+
+/* ── Top bar ────────────────────────────────────────────── */
+.topbar {
+  background: var(--stfc-navy);
+  color: rgba(255,255,255,0.75);
+  font-size: 0.75rem;
+  padding: 0.35rem 0;
+}
+.topbar__inner { display: flex; align-items: center; gap: 0.5rem; }
+.topbar__org   { font-weight: 600; color: #fff; }
+.topbar__divider { opacity: 0.4; }
+.topbar__ukri  {}
+
+/* ── Site header ────────────────────────────────────────── */
+.site-header {
+  background: var(--stfc-blue);
+  color: #fff;
+  box-shadow: 0 2px 8px rgba(0,0,0,0.18);
+  position: sticky;
+  top: 0;
+  z-index: 100;
+}
+.site-header__inner {
+  display: flex;
+  align-items: center;
+  gap: 2rem;
+  min-height: 60px;
+  padding-top: 0.5rem;
+  padding-bottom: 0.5rem;
+}
+.site-header__logo {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  text-decoration: none;
+  color: #fff;
+  flex-shrink: 0;
+}
+.site-header__logo:hover { text-decoration: none; opacity: 0.9; }
+.site-header__title {
+  font-size: 1.05rem;
+  font-weight: 700;
+  letter-spacing: 0.01em;
+  color: #fff;
+}
+
+.logo-mark {
+  display: inline-flex;
+  flex-direction: column;
+  line-height: 1;
+  background: var(--stfc-navy);
+  padding: 0.25rem 0.5rem;
+  border-radius: var(--radius);
+}
+.logo-mark__stfc {
+  font-size: 0.9rem;
+  font-weight: 900;
+  letter-spacing: 0.08em;
+  color: #fff;
+}
+.logo-mark__cloud {
+  font-size: 0.62rem;
+  letter-spacing: 0.15em;
+  color: var(--stfc-cyan);
+  text-transform: uppercase;
+}
+.logo-mark--large { padding: 0.4rem 0.75rem; }
+.logo-mark--large .logo-mark__stfc  { font-size: 1.4rem; }
+.logo-mark--large .logo-mark__cloud { font-size: 0.85rem; }
+
+/* ── Site nav ───────────────────────────────────────────── */
+.site-nav { flex: 1; }
+.site-nav__list {
+  display: flex;
+  gap: 0;
+  list-style: none;
+}
+.site-nav__link {
+  display: block;
+  padding: 0.55rem 1rem;
+  color: rgba(255,255,255,0.85);
+  font-size: 0.92rem;
+  transition: background var(--transition), color var(--transition);
+  border-radius: var(--radius);
+}
+.site-nav__link:hover,
+.site-nav__link.active {
+  color: #fff;
+  background: rgba(255,255,255,0.15);
+  text-decoration: none;
+}
+
+/* ── User menu ──────────────────────────────────────────── */
+.user-menu {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  font-size: 0.875rem;
+  flex-shrink: 0;
+}
+.user-menu__name { color: rgba(255,255,255,0.9); }
+.user-menu__logout {
+  color: rgba(255,255,255,0.75);
+  border: 1px solid rgba(255,255,255,0.3);
+  padding: 0.25rem 0.75rem;
+  border-radius: var(--radius);
+  transition: all var(--transition);
+}
+.user-menu__logout:hover {
+  background: rgba(255,255,255,0.15);
+  color: #fff;
+  text-decoration: none;
+}
+
+/* ── Badges ─────────────────────────────────────────────── */
+.badge {
+  display: inline-block;
+  font-size: 0.72rem;
+  font-weight: 700;
+  letter-spacing: 0.04em;
+  text-transform: uppercase;
+  padding: 0.15em 0.6em;
+  border-radius: 2px;
+  line-height: 1.6;
+}
+.badge--admin      { background: var(--stfc-cyan); color: var(--stfc-navy); }
+.badge--primary    { background: var(--stfc-blue); color: #fff; }
+.badge--info       { background: var(--color-info); color: #fff; }
+.badge--success    { background: var(--color-success); color: #fff; }
+.badge--warning    { background: var(--color-warning); color: #fff; }
+.badge--danger     { background: var(--color-danger); color: #fff; }
+.badge--neutral    { background: var(--stfc-grey); color: var(--stfc-text); }
+.badge--pending    { background: var(--color-pending); color: #fff; }
+.badge--approved   { background: var(--color-approved); color: #fff; }
+.badge--rejected   { background: var(--color-danger); color: #fff; }
+.badge--in_progress { background: var(--color-in-progress); color: #fff; }
+
+/* ── Flash alerts ───────────────────────────────────────── */
+.flash-container { margin-top: 1rem; }
+.alert {
+  display: flex;
+  align-items: flex-start;
+  gap: 0.75rem;
+  padding: 0.875rem 1rem;
+  border-radius: var(--radius);
+  margin-bottom: 0.75rem;
+  font-size: 0.9rem;
+  border-left: 4px solid transparent;
+}
+.alert__icon {
+  font-size: 1.1rem;
+  font-weight: bold;
+  flex-shrink: 0;
+  margin-top: -1px;
+}
+.alert--success { background: #e8f5e9; border-color: var(--color-success); color: #1b5e20; }
+.alert--error   { background: #fce4e4; border-color: var(--color-danger); color: #6b0000; }
+.alert--info    { background: #e3f0fb; border-color: var(--color-info); color: #0a3a6b; }
+.alert--warning { background: #fff4e0; border-color: var(--color-warning); color: #5a2d00; }
+
+/* ── Page header ────────────────────────────────────────── */
+.page-header {
+  margin-bottom: 2rem;
+  border-bottom: 3px solid var(--stfc-blue);
+  padding-bottom: 1rem;
+}
+.page-header__title {
+  font-size: 1.75rem;
+  font-weight: 700;
+  color: var(--stfc-navy);
+}
+.page-header__subtitle {
+  color: var(--stfc-text-muted);
+  margin-top: 0.25rem;
+}
+
+/* ── Cards ──────────────────────────────────────────────── */
+.card {
+  background: var(--stfc-white);
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow);
+  margin-bottom: 1.5rem;
+  overflow: hidden;
+  border: 1px solid var(--stfc-grey-light);
+}
+.card--compact .card__body { padding: 0.875rem 1.25rem; }
+.card__header {
+  display: flex;
+  align-items: center;
+  justify-content: space-between;
+  padding: 0.875rem 1.25rem;
+  background: var(--stfc-navy);
+  color: #fff;
+  gap: 0.75rem;
+}
+.card__header--toggle { cursor: pointer; user-select: none; }
+.card__header--toggle:hover { background: var(--stfc-mid-blue); }
+.card__title { font-size: 1rem; font-weight: 700; color: #fff; display: flex; align-items: center; gap: 0.5rem; }
+.card__header-link { font-size: 0.85rem; color: rgba(255,255,255,0.8); }
+.card__header-link:hover { color: #fff; }
+.card__toggle-icon { color: rgba(255,255,255,0.7); font-size: 0.75rem; }
+.card__body { padding: 1.25rem; }
+.card__body--table { padding: 0; overflow-x: auto; }
+.card__body--actions {
+  display: flex;
+  align-items: center;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+}
+
+/* ── Stats grid ─────────────────────────────────────────── */
+.stats-grid {
+  display: grid;
+  grid-template-columns: repeat(auto-fit, minmax(160px, 1fr));
+  gap: 1rem;
+  margin-bottom: 1.5rem;
+}
+.stat-card {
+  background: var(--stfc-white);
+  border-radius: var(--radius-lg);
+  padding: 1.25rem 1rem;
+  text-align: center;
+  border: 1px solid var(--stfc-grey-light);
+  border-top: 4px solid var(--stfc-grey);
+  box-shadow: var(--shadow);
+}
+.stat-card__value {
+  font-size: 2.5rem;
+  font-weight: 900;
+  line-height: 1;
+  margin-bottom: 0.25rem;
+}
+.stat-card__label {
+  font-size: 0.8rem;
+  text-transform: uppercase;
+  letter-spacing: 0.06em;
+  color: var(--stfc-text-muted);
+  font-weight: 600;
+}
+.stat-card--blue    { border-top-color: var(--stfc-blue);    }
+.stat-card--blue    .stat-card__value { color: var(--stfc-blue); }
+.stat-card--warning { border-top-color: var(--color-warning); }
+.stat-card--warning .stat-card__value { color: var(--color-warning); }
+.stat-card--success { border-top-color: var(--color-success); }
+.stat-card--success .stat-card__value { color: var(--color-success); }
+.stat-card--danger  { border-top-color: var(--color-danger);  }
+.stat-card--danger  .stat-card__value { color: var(--color-danger); }
+.stat-card--info    { border-top-color: var(--color-info);    }
+.stat-card--info    .stat-card__value { color: var(--color-info); }
+
+/* ── Section row ────────────────────────────────────────── */
+.section-row {
+  display: flex;
+  gap: 1.5rem;
+  margin-bottom: 1.5rem;
+  flex-wrap: wrap;
+}
+.flex-1 { flex: 1; min-width: 280px; }
+
+/* ── Definition list ────────────────────────────────────── */
+.definition-list { display: grid; grid-template-columns: auto 1fr; gap: 0.3rem 1rem; font-size: 0.9rem; margin-bottom: 1rem; }
+.definition-list dt { font-weight: 600; color: var(--stfc-text-muted); }
+
+/* ── Data table ─────────────────────────────────────────── */
+.data-table {
+  width: 100%;
+  border-collapse: collapse;
+  font-size: 0.875rem;
+}
+.data-table th {
+  background: var(--stfc-off-white);
+  color: var(--stfc-text-muted);
+  font-size: 0.75rem;
+  font-weight: 700;
+  letter-spacing: 0.05em;
+  text-transform: uppercase;
+  padding: 0.65rem 1rem;
+  text-align: left;
+  border-bottom: 2px solid var(--stfc-grey-light);
+  white-space: nowrap;
+}
+.data-table td {
+  padding: 0.75rem 1rem;
+  border-bottom: 1px solid var(--stfc-grey-light);
+  vertical-align: middle;
+}
+.data-table tbody tr:hover { background: rgba(0,114,206,0.04); }
+.data-table tbody tr:last-child td { border-bottom: none; }
+.data-table--full { min-width: 800px; }
+.nowrap { white-space: nowrap; }
+.data-table th.sortable { cursor: pointer; user-select: none; }
+.data-table th.sortable:hover { color: var(--stfc-navy); }
+.data-table th.sorted-asc::after  { content: ' \25B2'; font-size: 0.7em; }
+.data-table th.sorted-desc::after { content: ' \25BC'; font-size: 0.7em; }
+
+.table-toolbar {
+  display: flex;
+  justify-content: flex-end;
+  margin-bottom: 0.75rem;
+}
+.table-search { max-width: 280px; width: 100%; }
+
+/* Row status colouring */
+.row--rejected td { color: var(--stfc-text-muted); }
+.row--approved td:first-child { border-left: 3px solid var(--color-success); }
+.row--pending  td:first-child { border-left: 3px solid var(--color-warning); }
+.row--rejected td:first-child { border-left: 3px solid var(--color-danger); }
+.row--in_progress td:first-child { border-left: 3px solid var(--color-info); }
+
+/* Admin expand row */
+.admin-panel td { background: #f0f4fa; }
+.admin-form__fields {
+  display: flex;
+  align-items: flex-end;
+  gap: 0.75rem;
+  flex-wrap: wrap;
+}
+.admin-form { padding: 0.75rem 0; }
+.justification-details { margin-top: 0.75rem; font-size: 0.875rem; }
+.justification-details summary { cursor: pointer; color: var(--stfc-blue); }
+.justification-details blockquote { margin-top: 0.5rem; padding: 0.5rem 1rem; border-left: 3px solid var(--stfc-grey); color: var(--stfc-text-muted); font-style: italic; }
+
+/* ── Buttons ────────────────────────────────────────────── */
+.btn {
+  display: inline-flex;
+  align-items: center;
+  gap: 0.5rem;
+  padding: 0.5rem 1.25rem;
+  font-size: 0.9rem;
+  font-weight: 600;
+  border-radius: var(--radius);
+  border: 2px solid transparent;
+  cursor: pointer;
+  transition: all var(--transition);
+  text-decoration: none;
+  line-height: 1.4;
+  font-family: var(--font-sans);
+}
+.btn:hover { text-decoration: none; }
+.btn--primary   { background: var(--stfc-blue); color: #fff; border-color: var(--stfc-blue); }
+.btn--primary:hover { background: var(--stfc-navy); border-color: var(--stfc-navy); color: #fff; }
+.btn--secondary { background: var(--stfc-grey-light); color: var(--stfc-navy); border-color: var(--stfc-grey); }
+.btn--secondary:hover { background: var(--stfc-grey); }
+.btn--outline   { background: transparent; color: var(--stfc-blue); border-color: var(--stfc-blue); }
+.btn--outline:hover { background: var(--stfc-blue); color: #fff; }
+.btn--ghost     { background: transparent; color: var(--stfc-blue); border-color: transparent; }
+.btn--ghost:hover { background: rgba(0,114,206,0.08); }
+.btn--full  { width: 100%; justify-content: center; }
+.btn--large { padding: 0.75rem 1.75rem; font-size: 1rem; }
+.btn--sm    { padding: 0.3rem 0.75rem; font-size: 0.82rem; }
+.btn--xs    { padding: 0.2rem 0.55rem; font-size: 0.78rem; }
+.btn__icon  { width: 1.1em; height: 1.1em; flex-shrink: 0; }
+
+/* ── Forms ──────────────────────────────────────────────── */
+.form { }
+.form-row {
+  display: grid;
+  grid-template-columns: 1fr 1fr;
+  gap: 1rem;
+  margin-bottom: 1rem;
+}
+@media (max-width: 600px) { .form-row { grid-template-columns: 1fr; } }
+.quota-fields-grid {
+  display: grid;
+  grid-template-columns: repeat(3, 1fr);
+  gap: 1rem;
+}
+@media (max-width: 800px) { .quota-fields-grid { grid-template-columns: repeat(2, 1fr); } }
+@media (max-width: 500px) { .quota-fields-grid { grid-template-columns: 1fr; } }
+.form-label__unit { font-weight: 400; color: var(--stfc-text-muted); }
+.current-hint { color: var(--stfc-text-muted); }
+.form-group { display: flex; flex-direction: column; gap: 0.35rem; margin-bottom: 1rem; }
+.form-group--required .form-label::after { content: ' *'; color: var(--color-danger); }
+.form-label { font-size: 0.875rem; font-weight: 600; color: var(--stfc-navy); }
+.form-control {
+  padding: 0.5rem 0.75rem;
+  border: 2px solid var(--stfc-grey);
+  border-radius: var(--radius);
+  font-size: 0.9rem;
+  font-family: var(--font-sans);
+  color: var(--stfc-text);
+  background: #fff;
+  transition: border-color var(--transition);
+  width: 100%;
+}
+.form-control:focus {
+  outline: none;
+  border-color: var(--stfc-blue);
+  box-shadow: 0 0 0 3px rgba(0,114,206,0.15);
+}
+.form-control--sm { padding: 0.3rem 0.6rem; font-size: 0.85rem; }
+.form-control--textarea { resize: vertical; min-height: 100px; }
+.form-hint { font-size: 0.78rem; color: var(--stfc-text-muted); margin-top: 0.15rem; }
+.form-actions {
+  display: flex;
+  gap: 0.75rem;
+  padding-top: 0.5rem;
+  border-top: 1px solid var(--stfc-grey-light);
+  margin-top: 0.5rem;
+}
+.form-group--submit { justify-content: flex-end; }
+
+/* ── Filter bar ─────────────────────────────────────────── */
+.filter-bar { margin-bottom: 1rem; }
+.filter-bar__form { display: flex; align-items: flex-end; gap: 0.75rem; flex-wrap: wrap; }
+.filter-bar__group { display: flex; flex-direction: column; gap: 0.25rem; }
+.filter-bar__label { font-size: 0.78rem; font-weight: 600; color: var(--stfc-text-muted); text-transform: uppercase; letter-spacing: 0.04em; }
+
+/* ── Login page ─────────────────────────────────────────── */
+.login-page { background: linear-gradient(160deg, var(--stfc-navy) 0%, var(--stfc-mid-blue) 100%); }
+.login-wrapper {
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  justify-content: center;
+  min-height: calc(100vh - 80px);
+  padding: 2rem 1rem;
+}
+.login-card {
+  background: #fff;
+  border-radius: var(--radius-lg);
+  box-shadow: var(--shadow-md);
+  width: 100%;
+  max-width: 420px;
+  overflow: hidden;
+}
+.login-card__header {
+  background: var(--stfc-navy);
+  color: #fff;
+  text-align: center;
+  padding: 2rem 1.5rem 1.5rem;
+  display: flex;
+  flex-direction: column;
+  align-items: center;
+  gap: 0.75rem;
+}
+.login-card__title { font-size: 1.3rem; font-weight: 700; color: #fff; }
+.login-card__subtitle { font-size: 0.85rem; color: rgba(255,255,255,0.7); }
+.login-card__body { padding: 1.75rem 1.5rem; }
+.login-card__info { font-size: 0.875rem; color: var(--stfc-text-muted); margin-bottom: 1.25rem; line-height: 1.6; }
+.login-card__footer {
+  padding: 1rem 1.5rem;
+  background: var(--stfc-off-white);
+  border-top: 1px solid var(--stfc-grey-light);
+  font-size: 0.82rem;
+  color: var(--stfc-text-muted);
+  text-align: center;
+}
+.login-card__footer p { margin-bottom: 0.25rem; }
+.login-ukri-brand {
+  margin-top: 1.5rem;
+  color: rgba(255,255,255,0.5);
+  font-size: 0.78rem;
+  letter-spacing: 0.05em;
+}
+
+/* ── Site footer ────────────────────────────────────────── */
+.site-footer {
+  background: var(--stfc-navy);
+  color: rgba(255,255,255,0.65);
+  font-size: 0.82rem;
+  padding: 1.25rem 0;
+  margin-top: auto;
+}
+.site-footer__inner {
+  display: flex;
+  justify-content: space-between;
+  align-items: center;
+  gap: 1rem;
+  flex-wrap: wrap;
+}
+.site-footer__left { color: rgba(255,255,255,0.8); }
+.site-footer__right { display: flex; gap: 0.5rem; align-items: center; }
+.site-footer a { color: rgba(255,255,255,0.65); }
+.site-footer a:hover { color: #fff; }
+.site-footer--minimal { padding: 0.75rem 0; }
+.separator { opacity: 0.35; }
+
+/* ── Error pages ────────────────────────────────────────── */
+.error-page {
+  text-align: center;
+  padding: 4rem 1rem;
+}
+.error-page__code {
+  font-size: 6rem;
+  font-weight: 900;
+  color: var(--stfc-grey);
+  line-height: 1;
+  margin-bottom: 0.5rem;
+}
+.error-page__title { font-size: 1.75rem; color: var(--stfc-navy); margin-bottom: 0.75rem; }
+.error-page__message { color: var(--stfc-text-muted); margin-bottom: 2rem; }
+
+/* ── Empty state ────────────────────────────────────────── */
+.empty-state {
+  text-align: center;
+  padding: 3rem 1rem;
+  color: var(--stfc-text-muted);
+}
+
+/* ── Misc ───────────────────────────────────────────────── */
+.text-muted { color: var(--stfc-text-muted); font-size: 0.875rem; }
+
+/* ── Responsive ─────────────────────────────────────────── */
+@media (max-width: 768px) {
+  .site-header__inner { flex-wrap: wrap; gap: 0.5rem; }
+  .site-nav__list { gap: 0; }
+  .site-nav__link { padding: 0.4rem 0.6rem; font-size: 0.85rem; }
+  .user-menu__name { display: none; }
+  .stats-grid { grid-template-columns: repeat(2, 1fr); }
+  .section-row { flex-direction: column; }
+  .filter-bar__form { flex-direction: column; align-items: flex-start; }
+  .site-footer__inner { flex-direction: column; text-align: center; }
+}
diff --git a/cloud-tracker/app/static/js/table-tools.js b/cloud-tracker/app/static/js/table-tools.js
new file mode 100644
index 00000000..acfb2e87
--- /dev/null
+++ b/cloud-tracker/app/static/js/table-tools.js
@@ -0,0 +1,87 @@
+(function () {
+  function normalize(text) {
+    return (text || '').toLowerCase().trim();
+  }
+
+  // Filters <tbody> rows of a table against free-text input. Rows with class
+  // "row-detail" (e.g. an expandable admin panel under a parent row) are not
+  // matched individually — they follow their preceding row's visibility instead.
+  function enableTableSearch(input, table) {
+    if (!input || !table || !table.tBodies[0]) return;
+    var tbody = table.tBodies[0];
+    input.addEventListener('input', function () {
+      var q = normalize(input.value);
+      Array.prototype.forEach.call(tbody.rows, function (row) {
+        if (row.classList.contains('row-detail')) return;
+        var text = normalize(row.textContent);
+        var match = !q || text.indexOf(q) !== -1;
+        row.style.display = match ? '' : 'none';
+        var next = row.nextElementSibling;
+        if (next && next.classList.contains('row-detail') && !match) {
+          next.style.display = 'none';
+        }
+      });
+    });
+  }
+
+  // Click-to-sort column headers. Numeric-aware; blanks/— sort last.
+  function enableTableSort(table) {
+    if (!table || !table.tHead || !table.tBodies[0]) return;
+    var tbody = table.tBodies[0];
+    var headers = table.tHead.rows[0].cells;
+
+    Array.prototype.forEach.call(headers, function (th, index) {
+      if (th.classList.contains('no-sort')) return;
+      th.classList.add('sortable');
+      th.addEventListener('click', function () {
+        var asc = th.dataset.sortDir !== 'asc';
+        Array.prototype.forEach.call(headers, function (h) {
+          delete h.dataset.sortDir;
+          h.classList.remove('sorted-asc', 'sorted-desc');
+        });
+        th.dataset.sortDir = asc ? 'asc' : 'desc';
+        th.classList.add(asc ? 'sorted-asc' : 'sorted-desc');
+
+        var rows = Array.prototype.slice.call(tbody.rows);
+        var numeric = rows.every(function (row) {
+          var cell = row.cells[index];
+          var t = cell ? cell.textContent.trim() : '';
+          return t === '' || t === '—' || !isNaN(parseFloat(t.replace(/,/g, '')));
+        });
+
+        rows.sort(function (a, b) {
+          var av = a.cells[index] ? a.cells[index].textContent.trim() : '';
+          var bv = b.cells[index] ? b.cells[index].textContent.trim() : '';
+          if (numeric) {
+            var an = parseFloat(av.replace(/,/g, ''));
+            var bn = parseFloat(bv.replace(/,/g, ''));
+            if (isNaN(an)) an = asc ? Infinity : -Infinity;
+            if (isNaN(bn)) bn = asc ? Infinity : -Infinity;
+            return asc ? an - bn : bn - an;
+          }
+          return asc ? av.localeCompare(bv) : bv.localeCompare(av);
+        });
+        rows.forEach(function (row) { tbody.appendChild(row); });
+      });
+    });
+  }
+
+  // Filters a list of card-like elements (not plain table rows) by free-text input.
+  function enableCardSearch(input, container, cardSelector, matchSelector) {
+    if (!input || !container) return;
+    input.addEventListener('input', function () {
+      var q = normalize(input.value);
+      container.querySelectorAll(cardSelector).forEach(function (card) {
+        var target = matchSelector ? card.querySelector(matchSelector) : card;
+        var text = normalize(target ? target.textContent : card.textContent);
+        card.style.display = (!q || text.indexOf(q) !== -1) ? '' : 'none';
+      });
+    });
+  }
+
+  window.TableTools = {
+    enableTableSearch: enableTableSearch,
+    enableTableSort: enableTableSort,
+    enableCardSearch: enableCardSearch,
+  };
+})();
diff --git a/cloud-tracker/app/templates/403.html b/cloud-tracker/app/templates/403.html
new file mode 100644
index 00000000..6c1e943a
--- /dev/null
+++ b/cloud-tracker/app/templates/403.html
@@ -0,0 +1,10 @@
+{% extends "base.html" %}
+{% block title %}Access Denied – {{ site_title }}{% endblock %}
+{% block content %}
+<div class="error-page">
+  <div class="error-page__code">403</div>
+  <h1 class="error-page__title">Access Denied</h1>
+  <p class="error-page__message">You do not have permission to view this page. Admin access is required.</p>
+  <a href="{{ url_for('main.index') }}" class="btn btn--primary">Return to Dashboard</a>
+</div>
+{% endblock %}
diff --git a/cloud-tracker/app/templates/404.html b/cloud-tracker/app/templates/404.html
new file mode 100644
index 00000000..4cee2d25
--- /dev/null
+++ b/cloud-tracker/app/templates/404.html
@@ -0,0 +1,10 @@
+{% extends "base.html" %}
+{% block title %}Page Not Found – {{ site_title }}{% endblock %}
+{% block content %}
+<div class="error-page">
+  <div class="error-page__code">404</div>
+  <h1 class="error-page__title">Page Not Found</h1>
+  <p class="error-page__message">The page you are looking for does not exist or has been moved.</p>
+  <a href="{{ url_for('main.index') }}" class="btn btn--primary">Return to Dashboard</a>
+</div>
+{% endblock %}
diff --git a/cloud-tracker/app/templates/base.html b/cloud-tracker/app/templates/base.html
new file mode 100644
index 00000000..7389a46b
--- /dev/null
+++ b/cloud-tracker/app/templates/base.html
@@ -0,0 +1,92 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>{% block title %}{{ site_title }}{% endblock %}</title>
+  <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}">
+  {% block extra_head %}{% endblock %}
+</head>
+<body>
+
+  <!-- Top bar -->
+  <div class="topbar">
+    <div class="container topbar__inner">
+      <span class="topbar__org">Science and Technology Facilities Council</span>
+      <span class="topbar__divider">|</span>
+      <span class="topbar__ukri">Part of UKRI</span>
+    </div>
+  </div>
+
+  <!-- Header -->
+  <header class="site-header">
+    <div class="container site-header__inner">
+      <a href="{{ url_for('main.index') }}" class="site-header__logo" aria-label="{{ site_title }} home">
+        <div class="logo-mark">
+          <span class="logo-mark__stfc">STFC</span>
+          <span class="logo-mark__cloud">Cloud</span>
+        </div>
+        <span class="site-header__title">{{ site_title }}</span>
+      </a>
+
+      {% if current_user %}
+      <nav class="site-nav" aria-label="Main navigation">
+        <ul class="site-nav__list">
+          <li><a href="{{ url_for('main.index') }}" class="site-nav__link {% if request.endpoint == 'main.index' %}active{% endif %}">Dashboard</a></li>
+          <li><a href="{{ url_for('quota.entry') }}" class="site-nav__link {% if request.endpoint == 'quota.entry' or request.endpoint == 'quota.entry_post' %}active{% endif %}">Quota Entry</a></li>
+          <li><a href="{{ url_for('quota.log') }}" class="site-nav__link {% if request.endpoint == 'quota.log' %}active{% endif %}">Quota Log</a></li>
+          <li><a href="{{ url_for('quota.snapshots') }}" class="site-nav__link {% if request.endpoint == 'quota.snapshots' %}active{% endif %}">Quota Snapshots</a></li>
+          <li><a href="{{ url_for('quota.parties') }}" class="site-nav__link {% if request.endpoint and request.endpoint.startswith('quota.parties') %}active{% endif %}">Funding Parties</a></li>
+        </ul>
+      </nav>
+      <div class="user-menu">
+        <span class="user-menu__name">{{ current_user.name }}</span>
+        {% if is_admin %}<span class="badge badge--admin">Admin</span>{% endif %}
+        <a href="{{ url_for('auth.logout') }}" class="user-menu__logout">Sign out</a>
+      </div>
+      {% endif %}
+    </div>
+  </header>
+
+  <!-- Flash messages -->
+  {% with messages = get_flashed_messages(with_categories=true) %}
+  {% if messages %}
+  <div class="flash-container container">
+    {% for category, message in messages %}
+    <div class="alert alert--{{ category }}" role="alert">
+      <span class="alert__icon">
+        {% if category == 'success' %}&#10003;{% elif category == 'error' %}&#33;{% else %}&#8505;{% endif %}
+      </span>
+      {{ message }}
+    </div>
+    {% endfor %}
+  </div>
+  {% endif %}
+  {% endwith %}
+
+  <!-- Main content -->
+  <main class="main-content" id="main-content">
+    <div class="container">
+      {% block content %}{% endblock %}
+    </div>
+  </main>
+
+  <!-- Footer -->
+  <footer class="site-footer">
+    <div class="container site-footer__inner">
+      <div class="site-footer__left">
+        <strong>{{ site_title }}</strong> &mdash; Science and Technology Facilities Council
+      </div>
+      <div class="site-footer__right">
+        <a href="https://www.ukri.org/about-us/stfc/" rel="noopener noreferrer" target="_blank">About STFC</a>
+        <span class="separator">|</span>
+        <a href="https://www.ukri.org/privacy-notice/" rel="noopener noreferrer" target="_blank">Privacy</a>
+        <span class="separator">|</span>
+        <a href="https://www.ukri.org/accessibility-statement/" rel="noopener noreferrer" target="_blank">Accessibility</a>
+      </div>
+    </div>
+  </footer>
+
+  <script src="{{ url_for('static', filename='js/table-tools.js') }}"></script>
+</body>
+</html>
diff --git a/cloud-tracker/app/templates/index.html b/cloud-tracker/app/templates/index.html
new file mode 100644
index 00000000..e23548e9
--- /dev/null
+++ b/cloud-tracker/app/templates/index.html
@@ -0,0 +1,119 @@
+{% extends "base.html" %}
+
+{% block title %}Dashboard – {{ site_title }}{% endblock %}
+
+{% block content %}
+<div class="page-header">
+  <h1 class="page-header__title">Dashboard</h1>
+  <p class="page-header__subtitle">Cloud quota allocation overview</p>
+</div>
+
+<!-- Stats cards -->
+<div class="stats-grid">
+  <div class="stat-card stat-card--blue">
+    <div class="stat-card__value">{{ total_projects }}</div>
+    <div class="stat-card__label">Projects Tracked</div>
+  </div>
+  <div class="stat-card stat-card--info">
+    <div class="stat-card__value">{{ total_records }}</div>
+    <div class="stat-card__label">Quota Entries Recorded</div>
+  </div>
+  <div class="stat-card stat-card--success">
+    <div class="stat-card__value">{{ total_parties }}</div>
+    <div class="stat-card__label">Funding Parties</div>
+  </div>
+  <div class="stat-card stat-card--warning">
+    <div class="stat-card__value">{{ last_entry.strftime('%Y-%m-%d') if last_entry else '—' }}</div>
+    <div class="stat-card__label">Last Entry</div>
+  </div>
+</div>
+
+<!-- Current totals across all tracked projects -->
+<div class="card">
+  <div class="card__header">
+    <h2 class="card__title">Current Quota Totals</h2>
+    <a href="{{ url_for('quota.snapshots') }}" class="card__header-link">View all snapshots &rarr;</a>
+  </div>
+  <div class="card__body card__body--table">
+    {% if total_projects %}
+    <table class="data-table">
+      <thead>
+        <tr><th>Field</th><th>Total in use</th></tr>
+      </thead>
+      <tbody>
+        {% for key, label, unit in quota_fields %}
+        <tr>
+          <td>{{ label }}</td>
+          <td class="nowrap"><strong>{{ totals[key] }}</strong>{% if unit %} {{ unit }}{% endif %}</td>
+        </tr>
+        {% endfor %}
+      </tbody>
+    </table>
+    {% else %}
+    <div class="empty-state">
+      <p>No quota data recorded yet.</p>
+      <p><a href="{{ url_for('quota.entry') }}">Record quota values &rarr;</a></p>
+    </div>
+    {% endif %}
+  </div>
+</div>
+
+<!-- Quick actions -->
+<div class="section-row">
+  <div class="card flex-1">
+    <div class="card__header">
+      <h2 class="card__title">Quick Actions</h2>
+    </div>
+    <div class="card__body card__body--actions">
+      <a href="{{ url_for('quota.entry') }}" class="btn btn--primary">Record Quota Values</a>
+      <a href="{{ url_for('quota.log') }}" class="btn btn--outline">View Change Log</a>
+      <a href="{{ url_for('quota.parties') }}" class="btn btn--outline">Funding Parties</a>
+    </div>
+  </div>
+
+  <div class="card flex-1">
+    <div class="card__header">
+      <h2 class="card__title">Current Allocations</h2>
+    </div>
+    <div class="card__body">
+      <dl class="definition-list">
+        <dt>Projects with data</dt>
+        <dd>{{ total_projects }}</dd>
+        <dt>Funding parties</dt>
+        <dd>{{ total_parties }}</dd>
+        <dt>Last recorded</dt>
+        <dd>{{ last_entry.strftime('%Y-%m-%d %H:%M UTC') if last_entry else 'never' }}</dd>
+      </dl>
+      <a href="{{ url_for('quota.parties') }}" class="btn btn--ghost btn--sm">Browse by funding party &rarr;</a>
+    </div>
+  </div>
+</div>
+
+<!-- Recent change events -->
+{% if recent_events %}
+<div class="card">
+  <div class="card__header">
+    <h2 class="card__title">Recent Changes</h2>
+    <a href="{{ url_for('quota.log') }}" class="card__header-link">View all &rarr;</a>
+  </div>
+  <div class="card__body card__body--table">
+    <table class="data-table">
+      <thead>
+        <tr><th>Project</th><th>Recorded</th><th>By</th><th>Fields Changed</th></tr>
+      </thead>
+      <tbody>
+        {% for ev in recent_events %}
+        <tr>
+          <td><strong>{{ ev.snapshot.project_name }}</strong></td>
+          <td class="nowrap">{{ ev.snapshot.recorded_at.strftime('%Y-%m-%d %H:%M') }}</td>
+          <td>{{ ev.snapshot.recorded_by or '—' }}</td>
+          <td><span class="badge badge--warning">{{ ev.changed_count }}</span></td>
+        </tr>
+        {% endfor %}
+      </tbody>
+    </table>
+  </div>
+</div>
+{% endif %}
+
+{% endblock %}
diff --git a/cloud-tracker/app/templates/login.html b/cloud-tracker/app/templates/login.html
new file mode 100644
index 00000000..6241ca95
--- /dev/null
+++ b/cloud-tracker/app/templates/login.html
@@ -0,0 +1,75 @@
+<!DOCTYPE html>
+<html lang="en">
+<head>
+  <meta charset="UTF-8">
+  <meta name="viewport" content="width=device-width, initial-scale=1.0">
+  <title>Sign in – {{ site_title }}</title>
+  <link rel="stylesheet" href="{{ url_for('static', filename='css/style.css') }}">
+</head>
+<body class="login-page">
+
+  <div class="topbar">
+    <div class="container topbar__inner">
+      <span class="topbar__org">Science and Technology Facilities Council</span>
+      <span class="topbar__divider">|</span>
+      <span class="topbar__ukri">Part of UKRI</span>
+    </div>
+  </div>
+
+  <div class="login-wrapper">
+    <div class="login-card">
+
+      <div class="login-card__header">
+        <div class="logo-mark logo-mark--large">
+          <span class="logo-mark__stfc">STFC</span>
+          <span class="logo-mark__cloud">Cloud</span>
+        </div>
+        <h1 class="login-card__title">{{ site_title }}</h1>
+        <p class="login-card__subtitle">Cloud resource quota management portal</p>
+      </div>
+
+      <div class="login-card__body">
+        <p class="login-card__info">
+          Access is restricted to authorised STFC staff and collaborators.
+          Sign in with your institutional IRIS IAM account.
+        </p>
+
+        <a href="{{ url_for('auth.login') }}" class="btn btn--primary btn--full btn--large">
+          <svg class="btn__icon" viewBox="0 0 24 24" fill="none" stroke="currentColor" stroke-width="2" aria-hidden="true">
+            <path d="M15 3h4a2 2 0 0 1 2 2v14a2 2 0 0 1-2 2h-4"/>
+            <polyline points="10 17 15 12 10 7"/>
+            <line x1="15" y1="12" x2="3" y2="12"/>
+          </svg>
+          Sign in with IRIS IAM
+        </a>
+      </div>
+
+      <div class="login-card__footer">
+        <p>
+          Don&rsquo;t have an IRIS account?
+          <a href="https://iris-iam.stfc.ac.uk/registration" target="_blank" rel="noopener noreferrer">Register here</a>
+        </p>
+        <p>
+          Need help? Contact
+          <a href="mailto:cloud-support@stfc.ac.uk">cloud-support@stfc.ac.uk</a>
+        </p>
+      </div>
+    </div>
+
+    <div class="login-ukri-brand">
+      <span>Delivered by STFC Scientific Computing</span>
+    </div>
+  </div>
+
+  <footer class="site-footer site-footer--minimal">
+    <div class="container site-footer__inner">
+      <span>&copy; Science and Technology Facilities Council {{ now.year if now else '2025' }}</span>
+      <span class="separator">|</span>
+      <a href="https://www.ukri.org/privacy-notice/" target="_blank" rel="noopener noreferrer">Privacy</a>
+      <span class="separator">|</span>
+      <a href="https://www.ukri.org/accessibility-statement/" target="_blank" rel="noopener noreferrer">Accessibility</a>
+    </div>
+  </footer>
+
+</body>
+</html>
diff --git a/cloud-tracker/app/templates/quota_entry.html b/cloud-tracker/app/templates/quota_entry.html
new file mode 100644
index 00000000..97e4795d
--- /dev/null
+++ b/cloud-tracker/app/templates/quota_entry.html
@@ -0,0 +1,91 @@
+{% extends "base.html" %}
+{% block title %}Record Quota – {{ site_title }}{% endblock %}
+
+{% block content %}
+<div class="page-header">
+  <h1 class="page-header__title">Record Quota Values</h1>
+  <p class="page-header__subtitle">Enter current quota allocations for a project. Leave any field blank to record it as unchanged.</p>
+</div>
+
+<div class="card">
+  <div class="card__header">
+    <h2 class="card__title">Quota Entry</h2>
+  </div>
+  <div class="card__body">
+    <form method="post" action="{{ url_for('quota.entry_post') }}" class="form" id="quota-form" novalidate>
+
+      <div class="form-group form-group--required" style="max-width:440px; margin-bottom:1.75rem">
+        <label for="project_name" class="form-label">Project Name</label>
+        <input type="text" id="project_name" name="project_name" class="form-control"
+               required placeholder="e.g. my-research-project"
+               list="project-list" autocomplete="off"
+               value="{{ form_data.project_name if form_data else '' }}">
+        <datalist id="project-list">
+          {% for p in projects %}<option value="{{ p }}">{% endfor %}
+        </datalist>
+        <span class="form-hint">Select an existing project or type a new name</span>
+      </div>
+
+      <div id="current-notice" class="alert alert--info" style="display:none; margin-bottom:1.25rem">
+        <span class="alert__icon">&#9432;</span>
+        Current recorded values shown below each field. Leave blank to keep unchanged.
+      </div>
+
+      <div class="quota-fields-grid">
+        {% for key, label, unit in quota_fields %}
+        <div class="form-group">
+          <label for="{{ key }}" class="form-label">
+            {{ label }}{% if unit %} <span class="form-label__unit">({{ unit }})</span>{% endif %}
+          </label>
+          <input type="number" id="{{ key }}" name="{{ key }}"
+                 class="form-control" min="0" placeholder="blank = unchanged"
+                 data-field="{{ key }}"
+                 value="{{ form_data[key] if form_data and form_data.get(key) else '' }}">
+          <span class="form-hint current-hint" id="hint-{{ key }}"></span>
+        </div>
+        {% endfor %}
+      </div>
+
+      <div class="form-actions" style="margin-top:1.5rem">
+        <button type="submit" class="btn btn--primary">Record Quota Values</button>
+        <button type="button" class="btn btn--ghost" onclick="clearForm()">Clear</button>
+      </div>
+    </form>
+  </div>
+</div>
+{% endblock %}
+
+{% block extra_head %}
+<script>
+const projectInput = document.getElementById('project_name');
+const notice       = document.getElementById('current-notice');
+
+projectInput.addEventListener('change', fetchCurrent);
+projectInput.addEventListener('blur',   fetchCurrent);
+
+async function fetchCurrent() {
+  const name = projectInput.value.trim();
+  if (!name) return;
+  try {
+    const res  = await fetch('/quota/api/project/' + encodeURIComponent(name) + '/current');
+    const data = await res.json();
+    if (data.found) {
+      notice.style.display = 'flex';
+      Object.entries(data.values).forEach(function([key, val]) {
+        const hint = document.getElementById('hint-' + key);
+        if (hint) hint.textContent = val !== null ? 'Current: ' + val : 'Current: not recorded';
+      });
+    } else {
+      notice.style.display = 'none';
+      document.querySelectorAll('.current-hint').forEach(function(el) { el.textContent = ''; });
+    }
+  } catch(e) {}
+}
+
+function clearForm() {
+  document.getElementById('quota-form').reset();
+  document.querySelectorAll('.current-hint').forEach(function(el) { el.textContent = ''; });
+  notice.style.display = 'none';
+}
+</script>
+{% endblock %}
diff --git a/cloud-tracker/app/templates/quota_log.html b/cloud-tracker/app/templates/quota_log.html
new file mode 100644
index 00000000..c6110fe4
--- /dev/null
+++ b/cloud-tracker/app/templates/quota_log.html
@@ -0,0 +1,106 @@
+{% extends "base.html" %}
+{% block title %}Quota Change Log – {{ site_title }}{% endblock %}
+
+{% block content %}
+<div class="page-header">
+  <h1 class="page-header__title">Quota Change Log</h1>
+  <p class="page-header__subtitle">History of recorded quota entries and what changed</p>
+</div>
+
+<div class="filter-bar">
+  <form method="get" action="{{ url_for('quota.log') }}" class="filter-bar__form">
+    <div class="filter-bar__group">
+      <label for="filter-project" class="filter-bar__label">Project</label>
+      <select id="filter-project" name="project" class="form-control form-control--sm" onchange="this.form.submit()">
+        <option value="">All</option>
+        {% for p in projects %}
+        <option value="{{ p }}" {% if project_filter == p %}selected{% endif %}>{{ p }}</option>
+        {% endfor %}
+      </select>
+    </div>
+    <div class="filter-bar__group">
+      <label class="filter-bar__label">
+        <input type="checkbox" name="changed_only" value="1" {% if changed_only %}checked{% endif %}
+               onchange="this.form.submit()"> Changes only
+      </label>
+    </div>
+  </form>
+</div>
+
+<div class="card">
+  <div class="card__header">
+    <h2 class="card__title">Entries</h2>
+    <span class="badge badge--neutral">{{ events | length }}</span>
+  </div>
+  <div class="card__body card__body--table">
+    {% if events %}
+    <div class="table-toolbar">
+      <input type="search" id="log-search" class="form-control form-control--sm table-search"
+             placeholder="Search project, field...">
+    </div>
+    <div id="log-events">
+    {% for ev in events %}
+    <div class="card card--compact log-entry" style="margin-bottom:0.75rem">
+      <div class="card__header card__header--toggle" data-target="log-{{ ev.id }}">
+        <h2 class="card__title">
+          {{ ev.project_name }}
+          <span class="text-muted" style="font-weight:400">— {{ ev.recorded_at.strftime('%Y-%m-%d %H:%M') }} by {{ ev.recorded_by or 'unknown' }}</span>
+        </h2>
+        <span>
+          {% if ev.new_count %}<span class="badge badge--info">{{ ev.new_count }} new</span>{% endif %}
+          {% if ev.changed_count %}<span class="badge badge--warning">{{ ev.changed_count }} changed</span>{% endif %}
+        </span>
+      </div>
+      <div class="card__body card__body--table" id="log-{{ ev.id }}">
+        <table class="data-table">
+          <thead>
+            <tr><th>Field</th><th>Previous</th><th>New</th><th>Difference</th><th>Status</th></tr>
+          </thead>
+          <tbody>
+            {% for c in ev.changes %}
+            <tr>
+              <td>{{ field_labels.get(c.field_name, c.field_name) }}</td>
+              <td class="nowrap">{{ c.previous_value if c.previous_value is not none else '—' }}</td>
+              <td class="nowrap">{{ c.new_value if c.new_value is not none else '—' }}</td>
+              <td class="nowrap">{{ c.difference if c.difference is not none else '—' }}</td>
+              <td>
+                {% if c.status == 'new' %}<span class="badge badge--info">New</span>
+                {% elif c.status == 'changed' %}<span class="badge badge--warning">Changed</span>
+                {% else %}<span class="badge badge--neutral">Unchanged</span>{% endif %}
+              </td>
+            </tr>
+            {% endfor %}
+          </tbody>
+        </table>
+      </div>
+    </div>
+    {% endfor %}
+    </div>
+    {% else %}
+    <div class="empty-state">
+      <p>No quota entries found.</p>
+      <p><a href="{{ url_for('quota.entry') }}">Record quota values &rarr;</a></p>
+    </div>
+    {% endif %}
+  </div>
+</div>
+{% endblock %}
+
+{% block extra_head %}
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+  document.querySelectorAll('[data-target^="log-"]').forEach(function (toggle) {
+    toggle.addEventListener('click', function () {
+      var body = document.getElementById(toggle.dataset.target);
+      body.style.display = body.style.display === 'none' ? '' : 'none';
+    });
+  });
+
+  TableTools.enableCardSearch(
+    document.getElementById('log-search'),
+    document.getElementById('log-events'),
+    '.log-entry'
+  );
+});
+</script>
+{% endblock %}
diff --git a/cloud-tracker/app/templates/quota_parties.html b/cloud-tracker/app/templates/quota_parties.html
new file mode 100644
index 00000000..333cbcc4
--- /dev/null
+++ b/cloud-tracker/app/templates/quota_parties.html
@@ -0,0 +1,155 @@
+{% extends "base.html" %}
+{% block title %}Funding Parties – {{ site_title }}{% endblock %}
+
+{% block content %}
+<div class="page-header">
+  <h1 class="page-header__title">Quotas by Funding Party</h1>
+  <p class="page-header__subtitle">Aggregate quota allocations grouped by funding body</p>
+</div>
+
+{% if parties %}
+<div class="table-toolbar">
+  <input type="search" id="parties-search" class="form-control form-control--sm table-search"
+         placeholder="Search party, project...">
+</div>
+<div id="parties-list">
+{% for party in parties %}
+<div class="card card--collapsible party-entry" id="party-{{ party.id }}" style="margin-bottom:1rem">
+  <div class="card__header card__header--toggle" data-target="party-projects-{{ party.id }}">
+    <h2 class="card__title">
+      {{ party.name }}
+      <span class="badge badge--neutral">{{ party.project_count }} project{{ 's' if party.project_count != 1 }}</span>
+    </h2>
+    <span class="card__toggle-icon">&#9660;</span>
+  </div>
+
+  <div class="card__body card__body--table">
+    <table class="data-table data-table--full">
+      <thead>
+        <tr>
+          <th>Aggregate</th>
+          {% for key, label, unit in quota_fields %}
+          <th class="nowrap">{{ label }}{% if unit %} ({{ unit }}){% endif %}</th>
+          {% endfor %}
+        </tr>
+      </thead>
+      <tbody>
+        <tr>
+          <td><strong>Total ({{ party.project_count }} projects)</strong></td>
+          {% for key, label, unit in quota_fields %}
+          <td><strong>{{ party.totals[key] or 0 }}</strong></td>
+          {% endfor %}
+        </tr>
+      </tbody>
+    </table>
+  </div>
+
+  <div class="card__body card__body--table" id="party-projects-{{ party.id }}">
+    {% if party.projects %}
+    <table class="data-table data-table--full">
+      <thead>
+        <tr>
+          <th>Project</th>
+          {% for key, label, unit in quota_fields %}
+          <th class="nowrap">{{ label }}{% if unit %} ({{ unit }}){% endif %}</th>
+          {% endfor %}
+          <th>Last Updated</th>
+          <th></th>
+        </tr>
+      </thead>
+      <tbody>
+        {% for proj in party.projects %}
+        <tr>
+          <td><strong>{{ proj.project_name }}</strong></td>
+          {% for key, label, unit in quota_fields %}
+          <td class="nowrap">{{ proj[key] if proj[key] is not none else '—' }}</td>
+          {% endfor %}
+          <td class="nowrap">
+            {% if proj.recorded_at %}{{ proj.recorded_at.strftime('%Y-%m-%d %H:%M') }}{% else %}<span class="text-muted">no data</span>{% endif %}
+          </td>
+          <td>
+            <form method="post" action="{{ url_for('quota.parties_remove_project', party_id=party.id) }}"
+                  onsubmit="return confirm('Remove {{ proj.project_name }} from {{ party.name }}?')">
+              <input type="hidden" name="project_name" value="{{ proj.project_name }}">
+              <button type="submit" class="btn btn--ghost btn--xs">Remove</button>
+            </form>
+          </td>
+        </tr>
+        {% endfor %}
+      </tbody>
+    </table>
+    {% else %}
+    <div class="empty-state"><p>No projects assigned yet.</p></div>
+    {% endif %}
+
+    <form method="post" action="{{ url_for('quota.parties_add_project', party_id=party.id) }}"
+          class="filter-bar__form" style="padding: 0 1.25rem 1.25rem">
+      <div class="filter-bar__group">
+        <label class="filter-bar__label">Add project to {{ party.name }}</label>
+        <input type="text" name="project_name" class="form-control form-control--sm"
+               placeholder="project name" list="project-list-{{ party.id }}"
+               autocomplete="off" required>
+        <datalist id="project-list-{{ party.id }}">
+          {% for p in all_projects %}<option value="{{ p }}">{% endfor %}
+        </datalist>
+      </div>
+      <button type="submit" class="btn btn--primary btn--sm">Add</button>
+    </form>
+
+    <form method="post" action="{{ url_for('quota.parties_delete', party_id=party.id) }}"
+          style="padding: 0 1.25rem 1.25rem"
+          onsubmit="return confirm('Delete party {{ party.name }} and all its project assignments?')">
+      <button type="submit" class="btn btn--outline btn--sm">Delete party</button>
+    </form>
+  </div>
+</div>
+{% endfor %}
+</div>
+{% else %}
+<div class="card">
+  <div class="card__body"><div class="empty-state"><p>No funding parties defined yet.</p></div></div>
+</div>
+{% endif %}
+
+<div class="card" style="margin-top:1.5rem">
+  <div class="card__header">
+    <h2 class="card__title">Add Funding Party</h2>
+  </div>
+  <div class="card__body">
+    <form method="post" action="{{ url_for('quota.parties_new') }}" class="form" style="max-width:400px">
+      <div class="form-group form-group--required">
+        <label for="party_name" class="form-label">Party Name</label>
+        <input type="text" id="party_name" name="name" class="form-control"
+               required placeholder="e.g. IRIS, PSDI, DiRAC">
+        <span class="form-hint">Top-level funding body name</span>
+      </div>
+      <div class="form-actions">
+        <button type="submit" class="btn btn--primary">Create Party</button>
+      </div>
+    </form>
+  </div>
+</div>
+{% endblock %}
+
+{% block extra_head %}
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+  document.querySelectorAll('[data-target^="party-projects-"]').forEach(function (toggle) {
+    var body = document.getElementById(toggle.dataset.target);
+    body.style.display = 'none';
+    toggle.addEventListener('click', function () {
+      var icon = toggle.querySelector('.card__toggle-icon');
+      var open = body.style.display !== 'none';
+      body.style.display = open ? 'none' : '';
+      icon.textContent = open ? '▶' : '▼';
+    });
+  });
+
+  TableTools.enableCardSearch(
+    document.getElementById('parties-search'),
+    document.getElementById('parties-list'),
+    '.party-entry'
+  );
+});
+</script>
+{% endblock %}
diff --git a/cloud-tracker/app/templates/quota_snapshots.html b/cloud-tracker/app/templates/quota_snapshots.html
new file mode 100644
index 00000000..3298c3b9
--- /dev/null
+++ b/cloud-tracker/app/templates/quota_snapshots.html
@@ -0,0 +1,80 @@
+{% extends "base.html" %}
+{% block title %}Quota Snapshots – {{ site_title }}{% endblock %}
+
+{% block content %}
+<div class="page-header">
+  <h1 class="page-header__title">Quota Snapshots</h1>
+  <p class="page-header__subtitle">Raw history of recorded quota allocations per project</p>
+</div>
+
+<div class="filter-bar">
+  <form method="get" action="{{ url_for('quota.snapshots') }}" class="filter-bar__form">
+    <div class="filter-bar__group">
+      <label for="filter-project" class="filter-bar__label">Project</label>
+      <select id="filter-project" name="project" class="form-control form-control--sm" onchange="this.form.submit()">
+        <option value="">All</option>
+        {% for p in projects %}
+        <option value="{{ p }}" {% if project_filter == p %}selected{% endif %}>{{ p }}</option>
+        {% endfor %}
+      </select>
+    </div>
+    <a href="{{ url_for('quota.snapshots') }}" class="btn btn--ghost btn--sm">Clear</a>
+  </form>
+</div>
+
+<div class="card">
+  <div class="card__header">
+    <h2 class="card__title">History</h2>
+    <span class="badge badge--neutral">{{ snapshots | length }}</span>
+  </div>
+  <div class="card__body card__body--table">
+    {% if snapshots %}
+    <div class="table-toolbar">
+      <input type="search" id="snapshots-search" class="form-control form-control--sm table-search"
+             placeholder="Search project, recorded by...">
+    </div>
+    <table class="data-table data-table--full" id="snapshots-table">
+      <thead>
+        <tr>
+          <th class="no-sort">#</th>
+          <th>Project</th>
+          <th>Recorded</th>
+          <th>By</th>
+          {% for key, label, unit in quota_fields %}
+          <th class="nowrap">{{ label }}{% if unit %} ({{ unit }}){% endif %}</th>
+          {% endfor %}
+        </tr>
+      </thead>
+      <tbody>
+        {% for s in snapshots %}
+        <tr>
+          <td>{{ s.id }}</td>
+          <td><strong>{{ s.project_name }}</strong></td>
+          <td class="nowrap">{{ s.recorded_at.strftime('%Y-%m-%d %H:%M') }}</td>
+          <td>{{ s.recorded_by or '—' }}</td>
+          {% for key, label, unit in quota_fields %}
+          <td class="nowrap">{{ s[key] if s[key] is not none else '—' }}</td>
+          {% endfor %}
+        </tr>
+        {% endfor %}
+      </tbody>
+    </table>
+    {% else %}
+    <div class="empty-state">
+      <p>No quota snapshots recorded yet.</p>
+      <p><a href="{{ url_for('quota.entry') }}">Record quota values &rarr;</a></p>
+    </div>
+    {% endif %}
+  </div>
+</div>
+{% endblock %}
+
+{% block extra_head %}
+<script>
+document.addEventListener('DOMContentLoaded', function () {
+  var table = document.getElementById('snapshots-table');
+  TableTools.enableTableSearch(document.getElementById('snapshots-search'), table);
+  TableTools.enableTableSort(table);
+});
+</script>
+{% endblock %}
diff --git a/cloud-tracker/app/wsgi.py b/cloud-tracker/app/wsgi.py
new file mode 100644
index 00000000..14dc3190
--- /dev/null
+++ b/cloud-tracker/app/wsgi.py
@@ -0,0 +1,11 @@
+import sys
+import os
+
+sys.path.insert(0, '/var/www')
+
+from app import create_app
+
+application = create_app()
+
+if __name__ == '__main__':
+    application.run()
diff --git a/cloud-tracker/db-backup/Dockerfile b/cloud-tracker/db-backup/Dockerfile
new file mode 100644
index 00000000..fdec4c03
--- /dev/null
+++ b/cloud-tracker/db-backup/Dockerfile
@@ -0,0 +1,13 @@
+FROM alpine:3.19
+
+RUN apk add --no-cache postgresql15-client dcron bash tzdata
+
+COPY backup.sh /usr/local/bin/backup.sh
+RUN chmod +x /usr/local/bin/backup.sh
+
+COPY entrypoint.sh /usr/local/bin/entrypoint.sh
+RUN chmod +x /usr/local/bin/entrypoint.sh
+
+RUN mkdir -p /backups
+
+ENTRYPOINT ["/usr/local/bin/entrypoint.sh"]
diff --git a/cloud-tracker/db-backup/backup.sh b/cloud-tracker/db-backup/backup.sh
new file mode 100644
index 00000000..9b18e1e7
--- /dev/null
+++ b/cloud-tracker/db-backup/backup.sh
@@ -0,0 +1,24 @@
+#!/bin/bash
+set -e
+
+BACKUP_DIR="/backups"
+TIMESTAMP=$(date +"%Y%m%d_%H%M%S")
+FILENAME="${BACKUP_DIR}/cloudtracker_${TIMESTAMP}.sql.gz"
+RETAIN_DAYS="${BACKUP_RETAIN_DAYS:-7}"
+
+echo "[$(date -u)] Starting backup..."
+
+pg_dump \
+    --host="${PGHOST}" \
+    --username="${PGUSER}" \
+    --dbname="${PGDATABASE}" \
+    --format=plain \
+    --no-password \
+    | gzip > "${FILENAME}"
+
+SIZE=$(du -sh "${FILENAME}" | cut -f1)
+echo "[$(date -u)] Backup complete: ${FILENAME} (${SIZE})"
+
+# Remove backups older than RETAIN_DAYS
+find "${BACKUP_DIR}" -name "cloudtracker_*.sql.gz" -mtime "+${RETAIN_DAYS}" -delete
+echo "[$(date -u)] Pruned backups older than ${RETAIN_DAYS} days"
diff --git a/cloud-tracker/db-backup/entrypoint.sh b/cloud-tracker/db-backup/entrypoint.sh
new file mode 100644
index 00000000..68ddf524
--- /dev/null
+++ b/cloud-tracker/db-backup/entrypoint.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+set -e
+
+SCHEDULE="${BACKUP_SCHEDULE:-0 2 * * *}"
+
+echo "Installing cron schedule: ${SCHEDULE}"
+
+# Write crontab
+echo "${SCHEDULE} /usr/local/bin/backup.sh >> /var/log/backup.log 2>&1" | crontab -
+
+# Run an immediate backup on first start
+echo "Running initial backup..."
+/usr/local/bin/backup.sh
+
+# Start crond in foreground
+echo "Starting crond..."
+crond -f -l 8
diff --git a/cloud-tracker/db/init.sql b/cloud-tracker/db/init.sql
new file mode 100644
index 00000000..d4efa62b
--- /dev/null
+++ b/cloud-tracker/db/init.sql
@@ -0,0 +1,59 @@
+-- Cloud Tracker database initialisation
+-- PostgreSQL 15+
+-- This file runs once when the container is first created.
+-- SQLAlchemy create_all() handles subsequent schema management.
+
+-- Extensions
+CREATE EXTENSION IF NOT EXISTS "pg_stat_statements";
+
+-- Ensure updated_at is auto-managed
+CREATE OR REPLACE FUNCTION set_updated_at()
+RETURNS TRIGGER AS $$
+BEGIN
+    NEW.updated_at = NOW() AT TIME ZONE 'UTC';
+    RETURN NEW;
+END;
+$$ LANGUAGE plpgsql;
+
+-- quota_changes (pre-created so the trigger can be attached)
+CREATE TABLE IF NOT EXISTS quota_changes (
+    id               SERIAL PRIMARY KEY,
+    project_name     VARCHAR(255) NOT NULL,
+    quota_type       VARCHAR(100) NOT NULL,
+    current_value    INTEGER      NOT NULL,
+    requested_value  INTEGER      NOT NULL,
+    unit             VARCHAR(50)  NOT NULL DEFAULT '',
+    justification    TEXT         NOT NULL,
+    requester_name   VARCHAR(255) NOT NULL,
+    requester_email  VARCHAR(255) NOT NULL,
+    status           VARCHAR(20)  NOT NULL DEFAULT 'pending',
+    admin_notes      TEXT,
+    processed_by     VARCHAR(255),
+    created_at       TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+    updated_at       TIMESTAMPTZ  NOT NULL DEFAULT NOW()
+);
+
+CREATE INDEX IF NOT EXISTS ix_quota_changes_project ON quota_changes(project_name);
+CREATE INDEX IF NOT EXISTS ix_quota_changes_email   ON quota_changes(requester_email);
+CREATE INDEX IF NOT EXISTS ix_quota_changes_status  ON quota_changes(status);
+
+DROP TRIGGER IF EXISTS trg_quota_changes_updated_at ON quota_changes;
+CREATE TRIGGER trg_quota_changes_updated_at
+    BEFORE UPDATE ON quota_changes
+    FOR EACH ROW EXECUTE FUNCTION set_updated_at();
+
+-- db_snapshots
+CREATE TABLE IF NOT EXISTS db_snapshots (
+    id             SERIAL PRIMARY KEY,
+    snapshot_time  TIMESTAMPTZ  NOT NULL DEFAULT NOW(),
+    snapshot_type  VARCHAR(20)  NOT NULL DEFAULT 'scheduled',
+    record_count   INTEGER      NOT NULL DEFAULT 0,
+    snapshot_data  JSONB        NOT NULL DEFAULT '{}',
+    created_by     VARCHAR(255)
+);
+
+CREATE INDEX IF NOT EXISTS ix_db_snapshots_time ON db_snapshots(snapshot_time DESC);
+
+-- Grant
+GRANT ALL PRIVILEGES ON ALL TABLES IN SCHEMA public TO cloudtracker;
+GRANT ALL PRIVILEGES ON ALL SEQUENCES IN SCHEMA public TO cloudtracker;
diff --git a/cloud-tracker/docker-compose.yml b/cloud-tracker/docker-compose.yml
new file mode 100644
index 00000000..d58f9e7e
--- /dev/null
+++ b/cloud-tracker/docker-compose.yml
@@ -0,0 +1,101 @@
+version: '3.8'
+
+services:
+
+  web:
+    build: ./app
+    container_name: cloud-tracker-web
+    restart: unless-stopped
+    environment:
+      DATABASE_URL: "postgresql://cloudtracker:${DB_PASSWORD}@db:5432/cloudtracker"
+      SECRET_KEY: "${SECRET_KEY}"
+      OIDC_CLIENT_ID: "${OIDC_CLIENT_ID}"
+      OIDC_CLIENT_SECRET: "${OIDC_CLIENT_SECRET}"
+      OIDC_DISCOVERY_URL: "${OIDC_DISCOVERY_URL}"
+      APP_BASE_URL: "${APP_BASE_URL}"
+      SITE_TITLE: "${SITE_TITLE:-STFC Cloud Tracker}"
+      ADMIN_EMAILS: "${ADMIN_EMAILS:-}"
+    depends_on:
+      db:
+        condition: service_healthy
+    ports:
+      - "127.0.0.1:8080:80"
+    networks:
+      - internal
+
+  db:
+    image: postgres:15-alpine
+    container_name: cloud-tracker-db
+    restart: unless-stopped
+    environment:
+      POSTGRES_DB: cloudtracker
+      POSTGRES_USER: cloudtracker
+      POSTGRES_PASSWORD: "${DB_PASSWORD}"
+    volumes:
+      - postgres_data:/var/lib/postgresql/data
+      - ./db/init.sql:/docker-entrypoint-initdb.d/init.sql:ro,z
+    networks:
+      - internal
+    healthcheck:
+      test: ["CMD-SHELL", "pg_isready -U cloudtracker -d cloudtracker"]
+      interval: 10s
+      timeout: 5s
+      retries: 5
+
+  postgres-exporter:
+    image: prometheuscommunity/postgres-exporter:latest
+    container_name: cloud-tracker-pg-exporter
+    restart: unless-stopped
+    environment:
+      DATA_SOURCE_NAME: "postgresql://cloudtracker:${DB_PASSWORD}@db:5432/cloudtracker?sslmode=disable"
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - internal
+
+  prometheus:
+    image: prom/prometheus:latest
+    container_name: cloud-tracker-prometheus
+    restart: unless-stopped
+    volumes:
+      - ./prometheus/prometheus.yml:/etc/prometheus/prometheus.yml:ro,z
+      - prometheus_data:/prometheus
+    command:
+      - '--config.file=/etc/prometheus/prometheus.yml'
+      - '--storage.tsdb.path=/prometheus'
+      - '--storage.tsdb.retention.time=30d'
+      - '--web.enable-lifecycle'
+    ports:
+      # Bind to localhost only - connect Grafana to this port
+      - "127.0.0.1:9090:9090"
+    networks:
+      - internal
+
+  db-backup:
+    build: ./db-backup
+    container_name: cloud-tracker-db-backup
+    restart: unless-stopped
+    environment:
+      PGHOST: db
+      PGUSER: cloudtracker
+      PGPASSWORD: "${DB_PASSWORD}"
+      PGDATABASE: cloudtracker
+      BACKUP_SCHEDULE: "${BACKUP_SCHEDULE:-0 2 * * *}"
+      BACKUP_RETAIN_DAYS: "${BACKUP_RETAIN_DAYS:-7}"
+    volumes:
+      - db_backups:/backups
+    depends_on:
+      db:
+        condition: service_healthy
+    networks:
+      - internal
+
+volumes:
+  postgres_data:
+  prometheus_data:
+  db_backups:
+
+networks:
+  internal:
+    driver: bridge
diff --git a/cloud-tracker/prometheus/prometheus.yml b/cloud-tracker/prometheus/prometheus.yml
new file mode 100644
index 00000000..eccf7e42
--- /dev/null
+++ b/cloud-tracker/prometheus/prometheus.yml
@@ -0,0 +1,24 @@
+global:
+  scrape_interval:     15s
+  evaluation_interval: 15s
+  external_labels:
+    environment: 'cloud-tracker'
+
+scrape_configs:
+
+  # ── Application metrics (Flask /metrics endpoint) ────────
+  - job_name: 'cloud-tracker-app'
+    static_configs:
+      - targets: ['web:80']
+    metrics_path: /metrics
+    scheme: http
+
+  # ── PostgreSQL metrics (postgres-exporter) ───────────────
+  - job_name: 'postgres'
+    static_configs:
+      - targets: ['postgres-exporter:9187']
+
+  # ── Prometheus self-monitoring ────────────────────────────
+  - job_name: 'prometheus'
+    static_configs:
+      - targets: ['localhost:9090']