Skip to content
Results
$28M+ Revenue GeneratedFor our clients2,140+ Keywords — Page 1Google rankings$12M+ Ad Spend ManagedAcross channels2.5M+ Signups DrivenUser acquisitions87,200+ Leads GeneratedQualified pipeline
Get proposal

Custom Web App Development for Portals & Tools

Custom Web Application Development Services

We'll reply with a written proposal: the work, what we need from you and an estimated timeline.

The hidden ways apps go wrong

A custom app can match the brief and still end up as just another workaround.

We check whether custom software is really worth it. Then, before treating a set of screens as a working system, we connect the workflow, where each record stands, permissions, what happens when things fail, security, tests, recovery and ownership.

  • Custom code is chosen before looking at other options

    A ready-made SaaS product (software you rent online) set up for you, a low-code tool, workflow automation or simply fixing the process might solve the problem faster, but nobody wrote down a build-or-buy decision.

  • Screens are designed before the business rules

    The screens look finished, while the records, rules that must always hold true, allowed stage changes, calculations, change history and who handles exceptions are never written down.

  • Role names are mistaken for real permissions

    "Admin", "staff" and "client" labels exist, but who owns each record, which customer account a user belongs to, field access and permission for each action aren't checked on the server every time.

  • The "everything goes right" path hides duplicates and half-finished work

    Retries, double clicks, webhooks (automatic messages between systems), queued background jobs, time-outs and failures in other companies' services repeat actions or leave a task stuck halfway.

  • Putting it live is treated as the finish line

    Logs, performance numbers, request tracing, alerts, step-by-step guides, updates to the code libraries it relies on, costs, user support and product decisions have no named owner once it's live.

  • A backup exists, but nobody has proved it can be restored

    The team assumes data and the service can be brought back without testing that records are usable, app settings and passwords or keys come back, how long recovery takes or how much data loss is acceptable.

Scope

Seven areas of work take the right app from "is it worth building?" to running smoothly.

Turn a costly manual process into software your team can run, support and improve. Softscotch first checks whether a custom app is really worth building, then pins down the users, business rules, data, permissions and the smallest useful first version that works from start to finish. The work in your plan can cover easy-to-use screens that work for everyone, the parts users see, the server and database behind them, connections to other systems, moving old data across, security checks, proof that you can recover from failures and a handover so your team can run it. You get a working part of the product with written sign-off, a clear list of what's not included and named owners, not an open-ended list of features or a promise that people will use it.

Your proposal picks the users, workflow, MVP (minimum viable product: the smallest useful first version), features saved for later, business rules, data, permissions, platforms, connections, test and live setups, moving old data, tests, launch, support and accounts in your business's name included in these eight areas of work. Anything outside that written scope is separate.

Build or buy, and product discovery

We map the customer or staff problem, current workflow, users, value, limits, existing tools and every option, from custom code, setting up existing software, low-code and automation to not building anything, before agreeing to develop.

Workflow, business rules and first-version design

We define the jobs to be done, decisions, records, how they relate, rules that must always hold true, stages, actions, exceptions, needs such as speed and security, and the smallest start-to-finish piece that can prove real value.

Design, accessibility and design system

We design how information is organized for every screen size, plus flows, forms, tables, dashboards and what users see while loading, when there's nothing to show, on errors, on success and when recovering, with keyboard use and assistive tools such as screen readers included.

Front end, back end and data build

We build the agreed technical design: the screens, services, database, input checks, search, reports, files, notifications, admin controls and product usage tracking, with every change saved in version control.

Sign-in, permissions and connections

We build sign-in, sessions, account recovery, separation between customer accounts or organizations, permission checks for each record and action, APIs, webhooks and approved handovers to other systems, with cross-checks that both sides match.

Testing, security and a controlled launch

We map out how the app could be attacked or misused, how secrets (passwords and keys) are handled and risks in third-party code. We test the rules between systems, permissions, workflows, accessibility, speed and failures, then move data and launch through agreed test and live setups, with a way to undo.

Monitoring, recovery and running the product

We hand over logs, performance numbers, request tracing, alerts, step-by-step guides, backups and proof they can be restored, owners for incidents and support, visibility of running costs, documents, training, a roadmap and decisions on retiring old parts.

Your code, data and accounts stay yours

We set up the code storage, hosting and other service accounts in your business's name where possible, and keep the code, design files, documents and data there, with access for named people. That way your team or another developer can carry on if we stop working together.

Why Softscotch

We map your business rules and what happens when things fail before adding more screens.

The workflow, the true business rules, who can do what, data rules, screens that work for everyone, secure delivery, recovery, proof of how it's running and adoption all stay connected, from discovery through to your team running it live.

Custom software has to be worth the upkeep

Building, buying, setting up existing software, automating, simplifying and waiting all stay on the table as clear choices before a custom-built codebase becomes the answer.

Business rules shape the screens

Records, rules that must always hold true, stages, stage changes, calculations, proof and exceptions decide the screens and APIs, instead of being guessed at afterwards from them.

Permissions are checked for each record and action

Who the user is, which customer account they belong to, ownership, relationships, role, other details and rules on the server are checked where the data and the consequences actually live.

Things half-failing is expected

Actions that are safe to repeat, the order things happen in, retries, time-outs, queues, undo steps, cross-checks and recovery by hand are designed around the real workflow.

Security and quality need proof before sign-off

Attack and misuse cases, where third-party code comes from, tests of the rules between systems, tests that old features still work, accessibility, speed, restoring data and undoing changes are all agreed in scope, not just implied by a word like "secure".

The live product keeps an owner

Usage and error data, incidents, support, costs, backups, access, third-party code, the roadmap, adoption and retiring old parts all stay assigned to someone after the first launch.

Basic to advanced

The skills behind a custom web app that's easy to look after.

These 36 factors run from deciding whether to build or buy and the product basics, through business rules, design, data, security, coping with failure, testing, running the app and AI, to advanced permission control.

Product, workflow and whether it's doable
Build or buy, and when not to buildCompare a custom build with ready-made SaaS set up for you, low-code, automation, changing the workflow and not building at all, looking at how well each fits your data, control, risk, cost, time and upkeep.
Product goals and what users need to get doneName the users, what customers or staff need to get done, decisions, current pain, a useful result, value, risk, owner and cases where software isn't what's holding you back.
Workflow and service mapFollow who's involved, what goes in, decisions, waiting, handovers, outside systems, exceptions, recovery and proof, from the starting event to completion.
First version and sign-off roadmapChoose the smallest start-to-finish workflow that proves the value, data and day-to-day running, and save other features for later, noting what they depend on and clear sign-off rules.
List of systems, data and connectionsRecord your current apps, spreadsheets, databases, APIs, data exports, IDs, owners, volumes, limits, past incidents and anything that limits moving the data.
Starting point for service targets, adoption and costsBefore building, define task success, targets for uptime and recovery, quality, support, running costs, adoption, risk and the value of the decision.
Business rules, sign-in and permissions
Customer accounts and permission designDefine user, organization, role, record and action permissions before the screens or the endpoints behind them (the addresses the app uses to fetch and send data) are built.
Business rules and record stagesMap the records, rules that must always hold true, stage changes and audit needs around the real workflow.
Sign-in, sessions and account recoveryChoose sign-in options, single sign-on with other systems, MFA (a second sign-in step) or passkeys, session limits, asking people to sign in again, account recovery, and device and admin controls based on risk.
Data types and their lifecycleSort fields and files by purpose and how sensitive they are, and set the source, checks, access, how long they're kept, correction, export, deletion and who owns the audit trail.
Design, app and data
Screens everyone can use, in every stateDesign menus, forms, tables, pop-up windows, alternatives to drag-and-drop, focus, errors, status messages, time-outs and sign-in so they work with a keyboard, zoom and assistive tools.
What runs in the browser and what runs on the serverPut display, input checks, secrets, business rules, caching (storing copies for speed) and long-running work in the layer that can best enforce security, speed and easy upkeep.
Rules for APIs and eventsDefine the data and commands, errors, versions, actions that are safe to repeat, splitting results into pages, limits, sign-in, webhooks, events and how old versions are retired, for your own systems and outside ones.
Database design, checks and data historySet up IDs, data types, rules, links between records, history, sources, all-or-nothing updates, indexes for speed and how data is moved, rather than relying only on checks in the screens.
Workflows and connections with other systems
Background jobs, safe repeats and things happening at onceHandle forms submitted twice, retries, schedules, locks, two people editing the same record, time-outs, cancellations, repeated actions and safely running work again.
Connections, webhooks and cross-checksCheck that incoming messages are genuine and where they came from, match fields and IDs, manage order, limits, retries and replays, and compare the source with the destination.
Safe files, imports, exports and reportsCheck file type, size, content and owner, store files separately, scan or hold back risky files, and control large imports, exports, spreadsheet formulas and who can see reports.
Notifications and change historyRecord who did what, to which record, why and with what result, while messages have controls for permission, delivery, no duplicates, user preferences and failures.
Security, coping with failure and recovery
How the app and its APIs could be attacked or misusedTest permissions on each record, sign-in, limits on how many requests can be made, file handling, secrets and high-impact actions.
Secure development process and where code comes fromTrack security requirements, code review, automatic checks, third-party code, licenses, an SBOM (a list of every component in the software) or similar, known weaknesses, how the software was built and fixes.
Secrets, settings and keeping test and live apartKeep development, test and live data and access separate, and use managed storage for secrets, the least access needed, regular key changes, safe default settings and checks on settings.
Proof you can recover from backupsTest the restore steps, how long backups are kept and recovery targets, rather than assuming a scheduled backup is enough.
Testing, launch and running the app
Tests for system rules and for things breakingProtect key calculations, permissions, connections and workflows with automatic checks that run the same way every time.
Speed, capacity and cost controlsSet realistic usage patterns, targets for speed and how much it can handle, database and caching plans, usage caps, load tests, cost alerts and how it should slow down gracefully under strain.
Launching step by step, moving data and undoingUse versioned test and live setups, feature flags (switches that turn features on for some users) or small groups of users, database changes that don't break the old version, data cross-checks, launch proof and a tested way to recover.
Monitoring and owners for incidentsShow logs, request tracing, background jobs, errors, uptime, alerts, step-by-step guides and the people responsible.
Advanced data and systems spread across many parts
Keeping customer accounts apart, and stopping one from slowing othersCarry a checked customer-account ID through every database query, cache, file store, queue and log, and set usage caps, lifecycle, export and deletion for each customer account.
Working offline and syncing changes safelyDefine which data is stored on the device, how users see that it may be out of date, queued actions, retries, avoiding duplicates, rules for merging changes, browsers that aren't supported and letting users settle conflicts themselves.
Reliable messaging between parts of the systemKeep records and messages in step using saved event lists, steps that are safe to repeat, holding areas for failed messages, replays, undo steps for multi-step processes and checks from source to result (patterns known as outbox, queues and sagas).
Database changes with no downtimeMake changes in safe stages (add the new, then remove the old), keep old and new versions able to read and write, use versioned jobs, slow large updates down, save progress points, check results and decide whether to undo or fix forward.
Privacy, how long data is kept and passing on deletionsCollect as little as possible, map why data is collected and who can see it, keep it only as long as the approved rule allows and pass corrections, exports, restrictions and deletions to every connected system.
AI and advanced controls
Product usage tracking, feature flags and testsTrack whether users complete their tasks and the quality of the work, launch behind controlled feature flags where useful, and link adoption and tests to support, costs and later results.
Records and review for AI-assisted codingKeep the requirements, source code and AI-generated changes on record, require a person to review the code and run tests, and never let prompts or AI output become trusted live code by default.
AI features that are tested, including AI search of your own dataKeep versions of AI models, prompts, how the AI looks up your data, tools and tests, and measure task quality, accuracy, safety, speed, cost, people overriding it and changes over time in live use.
Permission rules written as code, and a map of relationshipsWrite record, role, relationship, user-detail and context rules as versioned policy, with decisions that can be explained, practice runs, tests and a way to withdraw access in an emergency.
AI agents with the least access needed and an off switchKeep reading, recommending, suggesting, approving and doing as separate steps, give AI agents (AI that can take actions) only approved tools and data, test them against people trying to trick them, and keep an audit trail, limits, undo and stop controls.
Product and development tools

The technology should fit the business problem, not become the plan in itself.

React, Next.js, Node.js, Python, .NET, PostgreSQL, managed cloud services, low-code tools (build-by-configuring platforms) and monitoring platforms are examples, not partnerships. What we use depends on the workflow, your team, data, risk, size, licenses and who will look after it.

Look inside the app

Seven checks show where custom software can lose value, lose data or become impossible to recover.

Each check links the business workflow, how it's built, permissions, how it could fail, sign-off proof and the person who runs it to a written record of the decision.

Check 01 · Product and fit

Check of build or buy, the workflow and the first version

We prove that custom software is the smallest sensible answer to a business problem worth solving.

A feature list is not a product decision. This check can recommend setting up existing software, low-code, automation, fixing the process or not building at all when owning custom software isn't justified.

User and business result resultName the users, the job to be done, what the problem costs today, a useful result, value, risk and who makes the decision.
Current workflow workflowMap who's involved, what goes in, decisions, waiting, handovers, workarounds, exceptions and proof the work is done.
Other routes optionsHonestly compare existing SaaS, setting up existing tools, low-code, automation, changing the workflow and custom development.
First version first versionChoose one start-to-finish workflow with real data, permissions, exceptions and sign-off, rather than a demo that isn't connected to anything.
Needs beyond features qualityRecord what's needed for security, accessibility, speed, uptime, recovery, audit trails, languages, offline use and growth.
Ownership and total cost ownershipName the product, data, security, launch, support and upkeep roles, plus license, hosting and future change costs.
Check 02 · Business rules and data

Check of records, stages, fixed rules and data

We write down your business rules clearly before database tables and screens lock in guesses by accident.

Checks in the screens make the app easier to use, but only checks on the server and in the database can protect your business data from every source of changes.

Records and IDs recordsDefine customers, organizations, cases, jobs, assets or other business records, and fixed IDs used inside the app and by other systems.
Links and ownership linksMap how many of one record link to another, parent and child records, handing work to someone else, shared records, records with no parent and reassigning.
Stages and stage changes stagesSet allowed moves, checks before each move, required proof, correcting, reopening, canceling and what happens at the final stage.
Fixed rules and calculations rulesRecord the rules that must always hold true across screens, background jobs, imports, connections and people working at the same time.
What each field is for, and its lifecycle fieldsSet data types, checks, source, access, sensitivity, how long it's kept, correction, export and deletion.
Moving data and keeping history data moveBefore the switch-over, map old values, where they came from, how they're changed, exceptions, audit records and cross-checks.
Check 03 · Sign-in and permissions

Check of customer accounts, sign-in and permissions

We confirm who can act on which record and field, and in what context, rather than trusting a role label on the screen.

Signing in proves who someone is. The server still has to decide whether they're allowed to act for that exact customer account, record, relationship, field and action.

Customer account and organization accountWork out the checked account and organization and carry it through every request, data lookup, cache, file store, queue and audit record.
Sign-in and single sign-on sign-inReview sign-in, SSO (single sign-on with another system), MFA (a second sign-in step) or passkeys, invitations, verification, recovery, lockouts and admin access, based on risk.
Sessions and devices sessionSet when sessions expire, refreshing them, ending them remotely, asking people to sign in again, use on several devices at once and extra checks for sensitive actions.
Rules for each record and action permissionsTest the owner, role, relationship, user-detail and context rules for every view, edit, export and admin action in the app.
Access from joining to leaving lifecycleControl new users, role changes, handing access to someone else, temporary access, people leaving, system accounts and emergency access.
Access records auditKeep the decision, who acted, context, record, action, result and refusals that can be reviewed, without logging sensitive content when there's no need.
Check 04 · APIs and workflows

Check of system rules, background jobs and connections

We design for retries, things arriving out of order and half-finished work, instead of assuming one request always has exactly one effect.

Messages that can arrive more than once, time-outs and other companies' limits are normal. Making actions safe to repeat cuts down duplicates, but it can't make every outside action happen exactly once.

API rules apiDefine what each request and command means, input checks, errors, splitting results into pages, limits, versions, sign-in and how old versions are retired.
IDs for each action no repeatsUse fixed IDs, checks before each stage change and unique values for form submissions, jobs, payments, messages and actions in other systems.
Queues and schedules jobsReview order, things running at the same time, priority, which errors get retried, waiting longer between retries, canceling, time-outs, holding areas for failed work and replays.
Webhooks and outside services webhooksCheck incoming messages are genuine and where they came from, limit what's sent and where, and handle speed limits, delays, duplicates and unsafe replies.
Workflows across several systems consistencyMark which steps must succeed or fail together, which catch up later, undo steps, the point of no return, recovery by hand and the status customers can see.
Cross-checks cross-checkCompare accepted incoming events, the app's own records, later actions and results until every mismatch has an owner.
Check 05 · Security and privacy

Check of threats, third-party code and data protection

We turn likely misuse and data risks into written, versioned requirements, tests and go-live decisions.

Following OWASP or NIST guidance (respected public security standards) is not a certification. Your proposal states what we check, who owns the risk and the limits that remain, without promising an app that can't be hacked.

Misuse cases threatsMap broken permissions on records and functions, misuse of business flows by bots, overloading the system, injection attacks, tricking the server into making requests for an attacker (SSRF) and data theft.
Input, output and files contentCheck input on the server, make output safe for where it's shown, limit uploads and exports and keep risky content separate or held back.
Secrets and setups secretsReview system accounts, managed storage for secrets, permissions, regular key changes, safe default settings, use of live data and debug information left exposed.
Third-party code and builds third-party codeList the components you use directly and the ones they bring in, their licenses and origin, and decide how to handle known weaknesses, updates and versions that are no longer supported.
Privacy from start to finish privacyMap purpose, collecting as little as possible, privacy notices, consent where required, access, how long data is kept, correction, export, deletion and outside companies that process data for you.
Responding to security issues responseSet how issues are reported, sorted by urgency, contained, logins withdrawn, evidence kept, fixed, communicated, patched, put live and followed up.
Check 06 · Quality and recovery

Check of testing, launch, moving data and restoring

We prove the key workflow and the recovery path work before live traffic and data rely on them.

A successful deployment and a finished backup job are useful signs. Neither proves that users can complete a task, or that a working service and data can be brought back.

Testing plan testsCover fixed business rules, permissions, rules between systems, page parts, workflows, accessibility, speed and failures, each at the right level.
Realistic test data dataUse safe test data and anonymized or made-up edge cases for roles, stages, empty fields, volume, languages, dates and failures.
Moving data and switching over switch-overTest that database changes don't break things, filling in historical data, totals or counts that prove nothing was lost, users who are active at the time, a freeze on changes, running old and new side by side, undoing and fixing forward.
Launching step by step go liveUse approved test and live setups, feature flags or small groups of users, health checks before each step, a change record, the point at which we undo and a last version known to work.
Backup and restore recoveryRestore app data and settings to a separate copy, then check they're complete and correct, permissions, RPO (how much recent data you could lose), RTO (how long recovery takes) and connected services.
Handover proof handoverHand over source code, builds, test and live setups, logins, tests, third-party code, step-by-step guides, support, decisions and who owns access.
Check 07 · Live product

Check of monitoring, adoption and real value

We check whether the app stays useful, can be supported and is still worth the cost after launch.

Uptime, page views, features released and lines of code don't prove that the right users complete the right workflow with less risk or less day-to-day effort.

Service health targetsSet targets for uptime, speed, errors, queues, connected services and recovery, with owners who can act and an agreed allowance for missing targets.
Usage and error data monitoringLink logs, performance numbers and request tracing across requests, background jobs and connections, while hiding sensitive data and data too detailed to be useful.
Alerts and incidents incidentsSend warning signs to the right person with context, how serious it is, a step-by-step guide, escalation, communication, recovery and follow-up actions afterwards.
Are people using it for their tasks? adoptionMeasure who should be using it, jobs done successfully, tasks abandoned, errors and support requests by role and workflow, not just sign-ins.
Cost and capacity costsTrack hosting, outside suppliers, messages, storage, support, upkeep and feature costs against usage and value.
Roadmap and retiring features roadmapRank changes backed by evidence, permissions, third-party code updates and technical debt (shortcuts that need fixing later), and safely remove unused features and data.
What changes

From a long list of screens to a well-run business app.

Before

The users, workflow, business rules, data, who's allowed to do what and the risks of running it are unclear, so a feature list stands in for a real product decision.

  • The workflow has no clear edgesUsers, decisions, handovers, exceptions and what "done" means differ between the people involved and your current records.
  • The rules live outside the systemCalculations, permissions, stage changes and who owns each source stay in spreadsheets, messages or people's heads.
  • Launch risk has no starting pointThe quality of moved data, security, accessibility, speed, recovery, support and long-term ownership have no agreed measures or owners.
Changes

An approved first version links one useful workflow to real data, permissions checked on the server, handling of failures and test proof, before wider feature work begins.

  • One complete task worksA typical user can complete the agreed journey from start to finish through the screens, server, database and required connections.
  • Business rules are enforcedRecords, calculations, stages, permissions and input checks are built in where the data and its consequences are controlled.
  • Launch blockers are visibleChecks on security, accessibility, speed, moving data, third-party code, restoring and undoing reveal unfinished work before going live.
After

A controlled live app has proof that the workflow, moved data, recovery and day-to-day running all work, plus a roadmap of features saved for later and named owners.

  • Live health leads to actionLogs, performance numbers, request tracing, background job history and alerts link a failed customer task to a named person, response and way to recover.
  • Recovery has real proofA restore to a separate copy, checks on completeness and permissions, and agreed recovery targets show what the team can bring back and how.
  • The next release has an ownerTask success, support demand, cost, risk and features saved for later guide priorities, upkeep and decisions about retiring features.
How your business works

A useful web app changes with the workflow, what's at stake and how you serve people.

Our method always starts from your business rules. What changes by industry is how users sign in, permissions, data, connections, how available it must be, working offline, audit records and how people take it up.

Ecommerce

Online store and retail operations

Build in-house tools for merchandising, stock, orders, returns, suppliers, customer service or reporting, without replacing your online store or ecommerce platform unless that's scoped separately.

FocusProduct, product option, customer and order IDs, stock locations, prices and promotions, order delivery, refunds, permissions, APIs, volumes, busiest-time load and store platform owners
MeasureTasks completed, data quality and cross-checks, delivery and service time, errors, permission incidents, speed at the busiest times, support cost and value to your operations
Software

Software (SaaS) company operations

Create in-house tools for product operations, support, onboarding (getting new users started) or admin, while the product you sell, with its customer accounts, billing and subscriptions, stays under our SaaS builds service.

FocusAccount and user IDs, product and billing events, what each plan allows, support workflows, APIs, separation between customer accounts, security and product owners
MeasureCorrect handling of tasks and plan access, support and onboarding time, errors, access exceptions, reliability, adoption, cost and later product results
B2B

Business-to-business (B2B) and professional services

Build qualifying, estimating, case, proposal, delivery, approval and client portal workflows into the app, around complex accounts, documents and handovers.

FocusAccount and contact setup, workflow and approvals, service rules, documents, CRM and finance connections, roles, how sensitive the data is, capacity and owners
MeasureCases or jobs completed correctly, handover time, rework, document and data quality, access exceptions, client use of the portal, cost and good-quality business results
Local

Local and multi-location businesses

Coordinate inquiries, bookings, sending staff out, field work, locations, staff, capacity and proof of service across devices and patchy internet connections.

FocusMap of locations and services, areas covered, schedules, users and devices, customer and job records, offline needs, booking and payment systems, permissions and support owners
MeasureBookings and jobs completed correctly, routing, conflicts when syncing, response and service time, errors, how long offline actions wait in the queue, adoption and customer support results
Healthcare

Healthcare and wellness admin

Support approved admin workflows for booking, referrals, intake and other services, while protecting sensitive data, accessibility and the limits of clinical care.

FocusAdmin business rules, decisions on user and patient records, approved fields and documents, access roles, consent, how long data is kept, audit, booking, clinical and privacy owners
MeasureAdmin tasks completed, access and privacy exceptions, complete audit trails, errors, accessibility, service time, recovery proof and incidents, with no claims about automating clinical care
Finance

Finance, insurance and legal

Build systems for applications, cases, client matters, proof and approvals, with rules for each region, separation of duties, disclosures, change history and people making high-stakes decisions.

FocusHow clients and companies are recorded, region, who qualifies and approval policy, documents, sensitive fields, how long data is kept, disclosures, roles, systems, security and approved reviewers
MeasureRequired proof, valid decisions and handovers, refused access and exceptions, complete audit trails, errors, speed, recovery, service results and incidents
Education

Education and training

Manage program, intake, application, learner, parent or guardian, employer, assessment and service workflows, with screens everyone can use and stages that respect deadlines.

FocusRecords for people and organizations, programs and intakes, application and payment stages, learning content and assessment systems, accessibility, permissions, deadlines and student service owners
MeasureCorrect application and enrollment stages, deadlines met and tasks completed, quality of access, accessibility issues, support demand, errors, adoption and service results
Travel

Travel and hospitality

Create tools for reservations, itineraries, properties, guests, suppliers and putting things right for guests, which stay clear when availability, language, price and cancellation status change.

FocusGuest and booking IDs, properties, availability and rates, dates and time zones, cancellation and refund policy, connections, permissions, busiest-time demand and operations owners
MeasureData cross-checks, booking and service tasks completed, accurate cancellation status, errors, speed at the busiest times, recovery, staff adoption and guest service results
Marketplace

Marketplaces and directories

Build tools for content checks, verification, matching, listings, transactions, disputes and support, while protecting both sides, keeping customer accounts separate and controlling how much each one uses.

FocusBuyer and seller IDs, listings, matching and transaction stages, verification, fees, content checks, disputes, files, APIs, usage caps, permissions and marketplace owners
MeasureValid matches and workflows, attempts to reach other accounts' data or exceed access, time to check content and settle disputes, resource use, errors, reliability, adoption and quality on both sides
Media

Publishers, creators and media companies

Support editorial, usage rights, contributor, sponsor, subscriber, event and production workflows, with records of where content came from, permissions and fast publishing cycles.

FocusContent and media setup, rights and license status, authors and contributors, subscriptions, sponsors, events, files, editorial and commercial roles, connections and how long data is kept
MeasurePublishing and approval tasks completed, rights and access exceptions, data and media quality, turnaround time, errors, accessibility, adoption and running costs
Apps

Digital products and supporting tools

Build supporting admin, customer support, operations or data tools, with stable product IDs, clear rules for events, feature flags and workflows that know when there's an incident.

FocusAccount, device and product IDs, events and data formats, releases and feature flags, subscriptions, support and admin actions, APIs, security, usage and error data and product owners
MeasureQuality of system rules and tasks, access and action errors, health of releases and incidents, speed, adoption, support workload, cost and later product results
Enterprise

Large and global organizations

Manage workflows across several systems, regions and business units, with shared sign-in, policies, rules on where data is stored, connections, moving data and ownership of changes.

FocusMap of systems and data, sign-in and shared sign-in, regions and business units, policy and where data must be stored, rules for each connection, volumes, uptime, recovery, security and change rules
MeasureHow much policy and access is covered, data and connection cross-checks, launch and recovery performance, incidents, adoption by unit, service targets, running costs and business results
Clear ownership

We build the app in your plan. Your team stays in charge of business rules and customer facts.

The three columns split out our product and development work, the platforms we coordinate with others, and the policy, legal, privacy, security, accessibility, staffing and go-live decisions that stay with you.

We do the work

The product, app and day-to-day running controls written into your proposal.

  • Write the agreements for fit, workflow, first version, business rules, stages, data, permissions and sign-off
  • Design how information is organized for every screen size and for everyone, plus page parts, flows and screen states
  • Build the agreed front end, back end, database, workflows, admin area, files, reports and usage tracking
  • Build approved sign-in, permissions, APIs, webhooks, background jobs and connections to other systems
  • Run checks on system rules, permissions, security, accessibility, speed, moving data, launch and recovery
  • Deliver source code, versions, test and live setups, monitoring, step-by-step guides, documents, training and a product record with named owners
We coordinate

The platform, data and specialist work needed for an app that's genuinely useful in live use.

  • Line up with SaaS builds, API integration, automation, reporting and AI feature work
  • Work with the owners of sign-in, cloud, database, storage, network, DNS (domain settings), email, payments and suppliers
  • Gather input on your design system, content, accessibility, translation and customer support
  • Work with the owners of moving data, master data, how long data is kept, deletion, exports and reporting
  • Arrange security review, response to security weaknesses, privacy, legal and regulated-industry work
  • Organize launch windows, incident response, recovery practice runs, trials with small user groups and roadmap reviews
You review & sign off

Your organization keeps the final say on product, policy, customer and go-live decisions.

  • Approve users, workflows, product decisions, business rules, exceptions and what counts as a useful result
  • Provide accurate details of systems, data, APIs, access, subject experts, test users and current limits
  • Approve how strongly users must prove who they are, roles, permissions, how customers are treated and high-stakes actions
  • Approve what data is for, consent, how long it's kept, deletion, where it's stored, privacy and security policy
  • Approve legal, regulatory, accessibility, moving data, going live and incident decisions
  • Keep final control of budget, staffing, business policy, licenses, hosting and long-term ownership
How it fits together

A custom app works when you can trace where each record stands, who's allowed to act, every action and every fix.

The system links what users need to get done, business rules, sign-in, permissions, data, workflows, connections, tests, launches, usage and error data, incidents, recovery and product decisions.

Custom Web Application Development Services

01
Product and fit brief

Users, jobs to be done, workflow, other options, value, risk, first version, where building won't help, sign-off and owners.

02
Business rules and data

Records, IDs, links, rules that must always hold true, stages, calculations, fields, where data came from, history and moving data.

03
Sign-in and permissions

Customer accounts, users, shared sign-in, signing in, sessions, roles, relationships, user details, actions and access from joining to leaving.

04
Design and the app itself

Flows that work on every screen size and for everyone, page parts, forms, tables, dashboards, content, screen states, front end and back end.

05
Workflows and connections

APIs, events, webhooks, background jobs, actions safe to repeat, order, retries, queues, files, notifications and cross-checks.

06
Security and privacy

Threats, input checks, secrets, third-party code, where code comes from, what data is for, how long it's kept, deletion, incidents and response.

07
Quality and delivery

Rules between systems, tests that old features still work, accessibility, speed, test and live setups, data moves, feature flags, launches, undo and proof.

08
Monitoring and recovery

Logs, performance numbers, request tracing, service targets, alerts, step-by-step guides, backups, restores, RPO, RTO, incidents and support.

09
How the product is run

Adoption, task results, costs, roadmap, permissions, third-party code, documents, training and retiring features.

The connected growth engine

SaaS builds

Software products you sell to many customers add customer account setup and closure, subscriptions, billing, plan limits, product usage tracking and customer-facing operations, which go beyond a custom business app.

API integration services

Reusable data rules, middleware (software that sits between systems), sending events, queues and standard connections stay separate when connecting systems is the main product, rather than something the app depends on.

AI-powered tools

AI features and agents need their own decisions on the task, data, tests, model, prompts, how AI looks up data, tools, human control and monitoring in live use.

Automation and CRM

Workflow or CRM automation may solve the business problem without new screens or a new codebase, or it may feed approved records and actions into the app.

Reporting and conversion tracking

Measurement services define wider analytics, how results are credited and regular business reports, while the app supplies reliable product, workflow and quality events.

Security, privacy and platform owners

Approved owners decide on security assurance, what data is for, test and live setups, logins, hosting, recovery, compliance, go-live and incidents.

One connected scope. Custom Web Application Development Services is coordinated with the strategy, creative, experience, data and reporting it depends on, so responsibilities and handoffs stay visible in one written plan.

What to expect

A useful first piece can appear early, but going live waits for proof that it's ready.

The "is it worth building?" check is done in week 1, the first-version plan and technical design are agreed in weeks 1 to 2, and a working core piece can follow in weeks 2 to 4 when users, rules, data and access are ready. A controlled live launch often falls in weeks 8 to 12, but only when the scope, data moves, connections, security, recovery and sign-off allow it.

Custom web application development, from discovery to a controlled launch

Week 1

Fit and product brief

Confirm the users, the workflow problem, the result you want, build-or-buy options, limits, business rules, data, risk, where building won't help and who makes decisions.

KPI Fit brief
Weeks 1–2

First version and technical design

Agree the smallest useful start-to-finish workflow, features saved for later, business rules and data setup, permission rules, connections and the rules for whether it works and runs well.

KPI Approved first version
Weeks 2–4

Working core piece

Build the agreed user journey, screen states everyone can use, business rules, server and database controls, permissions and the required connection, once the inputs are ready.

KPI Working piece
Weeks 4–8

Proof it's ready to launch

Run checks on business rules, rules between systems, permissions, misuse, accessibility, speed, moving data, third-party code, undoing and restoring, and record anything still blocking launch.

KPI Sign-off proof
Weeks 8–12

Controlled live launch

Move and cross-check approved data, launch through agreed health checks and confirm workflows, access, background jobs, monitoring and recovery, but only when the proof supports going live.

KPI Go-live sign-off
After release

Handover and roadmap for running it

Hand over source code, access, test and live setups, tests, step-by-step guides, and ownership of support, incidents and recovery, then rank the work saved for later using task, cost and risk evidence.

KPI Running with owners

Our full growth plan (all services together), month by month

Month 1

Foundation and review

We review your whole website, where you rank and your competitors, agree how the site should be organized, and set up hosting, analytics (visitor tracking) and your GoHighLevel lead system. The first agreed pages start going live.

KPI pages live
Month 2

Build and launch

The site is built or rebuilt. Main, service and industry pages go live with on-page SEO, website labels and technical fixes. Your Google Business Profile is improved and lead follow-up automations are switched on.

KPI pages in Google
Month 3

Early rankings, paid ads start

More pages built from templates (programmatic pages) start going live, paid ads and email follow-ups are switched on for early leads, and Google adds your pages to its results as the first rankings usually appear.

KPI search terms ranking
Month 4

Momentum builds

Rankings often start climbing, visits from free search begin to rise, ad spending is tuned to the return it brings (ROAS, return on ad spend), and groups of related articles and links from other sites build your reputation with Google.

KPI visits from search
Month 5

Results start to show

Main search terms can move closer to page one, the first leads from free search often arrive, AI tools may begin to mention you, and testing improvements to your pages (CRO, conversion rate optimization) helps more visitors get in touch.

KPI leads from search
Month 6

Growth builds on itself

Pages that are working are protected and improved, template pages bring in visitors searching for very specific terms, and SEO, ads, email and automation work together to bring steadier leads and sales. Timing varies by market and competition, and no ranking is guaranteed.

KPI leads and sales
How we compare

Good web app development includes everything needed to run the code, not just the code.

The difference shows in honest build-or-buy advice, clear business rules and permission design, written rules for how systems talk, planning for failure and misuse, proof that you can restore your data, a controlled launch, being able to see what's happening and clear ownership after launch.

The risk of using a different agency for everything
  • Assumes custom development before comparing setting up existing software, low-code, automation or changing the process
  • Turns everyone's feature wish lists into screens, without one start-to-finish piece that delivers value
  • Lets the fields on screen decide the records, stage changes and business rules
  • Uses "admin" and "user" role labels without permission checks for each record, field and action
  • Assumes one request, webhook or queued message always causes exactly one action
  • Calls knowing about OWASP, using encryption or cloud hosting a complete security program
  • Tests the "everything goes right" path by hand and leaves checks on system rules, permissions and failures to the live app
  • Makes database and data changes without proof they're compatible, cross-checked and can be undone
  • Counts a scheduled backup without ever restoring a working copy of the app
  • Hands over code while monitoring, incidents, third-party code, support and the roadmap have no owner
vs
Softscotch
  • Records the trade-offs of building, buying, setting up, automating, simplifying, waiting and not building before setting scope
  • Launches the smallest approved workflow with real stages, permissions, exceptions and results
  • Defines records, fixed rules, stages, calculations, proof and the data lifecycle before any building starts
  • Enforces customer account, owner, role, relationship, user-detail and action rules on the server and in the database
  • Designs fixed action IDs, the order things happen in, retries, queues, undo steps, replays and cross-checks
  • Uses versioned requirements for threats, third-party code, secrets, privacy and incidents, with agreed checks
  • Automates tests of business rules, system rules, permissions, connections, accessibility and workflows, based on risk
  • Uses compatible changes, small user groups, proof that moved data is right, health checks and a recovery path known to work
  • Restores data and settings to a separate copy and checks completeness, permissions, RPO (data you could lose) and RTO (time to recover)
  • Hands over monitoring, recovery, access, third-party code, support, costs, adoption and product decisions
The numbers

Results from Softscotch client work.

These totals come from work for Softscotch clients across search, paid ads, websites and lead generation, as published on softscotch.com. Past results don't guarantee future results.

$12M+Ad spend managed for clients
87,200+Leads generated for clients
2,140+Search terms ranked on Google's first page
$28M+Revenue generated for clients
Client case studies

All six Softscotch client stories.

Every Quick Story currently published on Softscotch.com, covering education, ecommerce, healthcare and SaaS. Stock photography represents each client industry; the figures are reported historical results and do not guarantee future performance.

Education consultant speaking with a prospective student Education Ads + local SEO
+183%leads

183% more leads for an education consultancy

WordPressQuora adsLocal SEO
The challenge

An education consulting business in India needed to build its digital presence and lead flow from scratch.

What changed
  • Built a new WordPress website
  • Used Quora ads to grow daily lead volume
  • Added Local SEO and community engagement
+183% leads25+ leads/day-38% bounce rate+273% new users
Bright modern home interior representing the home-solutions client Home solutions Shopify + SEO
+82%Shopify sales

Home-solutions ecommerce growth

ShopifyOrganic searchAmazon ads
The challenge

A home-solutions business was dependent on business-to-business (B2B) marketplaces, losing sales and recovering from a Google penalty.

What changed
  • Resolved the Google penalty
  • Revamped the website and online store
  • Improved organic visibility and Amazon campaign performance
+82% Shopify sales+147% organic+23% Amazon ROAS
Mother and baby representing the lactation-consultant client Health consultant $20/day
5/daybooked calls

Five booked calls a day for a health consultant

Facebook adsGoogle AdsLocal SEO
The challenge

A Houston lactation consultant needed to recover a malware-damaged website and rebuild local patient acquisition.

What changed
  • Rebuilt the hacked site and migrated it to secure hosting
  • Ran targeted Facebook and Google campaigns
  • Reached top-three local Google positions
5 calls/day$20 daily spend+87% local traffic+34% new users
Ecommerce owner preparing customer orders beside a laptop Ecommerce 10 months
+315%organic traffic

315% organic growth for an ecommerce site

Content strategyOn-page SEO
The result

Softscotch reports a 315% increase in ecommerce organic traffic over 10 months through focused on-page SEO.

What changed
  • Optimized product and collection pages
  • Improved the links between pages and the page addresses (URLs)
  • Made the site easier for Google to explore and better matched to what people search for
+315% organic10 monthsProductsCollections
SaaS team reviewing campaign data around a laptop SaaS platform Cold outreach
16%reply rate

9% close rate for a transcription SaaS

ProspectingSMTP
The challenge

A transcription platform needed a qualified prospect list and a reliable email-sending setup for outreach we managed.

What changed
  • Built a comprehensive prospecting list
  • Managed the cold outreach campaigns
  • Set up reliable email-sending servers (SMTP)
9% close rate16% reply rateSaaSManaged outreach
Healthcare professional consulting with a patient Healthcare 6 months
+182%organic traffic

182% organic growth for a healthcare clinic

HealthcareOn-page SEOOff-page SEO
The challenge

A clinic in a competitive location needed to build organic search visibility from the ground up.

What changed
  • Built the clinic's foundation for unpaid (organic) Google search
  • Combined on-page and off-page SEO
  • Reached top-five positions in Google Search
+182% organic6 monthsTop 5 Google
01 / 06
In their words

Teams that stopped leaving clicks on the table.

★★★★★

"The Softscotch team has been a solid partner as our business evolved over the last five years. Unlike most agencies, they have never charged us for work that falls outside the agreement. That is what sets them apart."

IM
Imtiyaz MominHairareus
★★★★★

"Without their knowledge, we would be in a very different place than we are now. Whenever they find something that can be improved, they implement it quickly. I could not be happier with their performance and response time."

AP
Aaron PaulsonBaby Pavilion
★★★★★

"Softscotch goes above and beyond the scope. The time, effort and dedication they put in is like having your own in-house marketing team. They are not just another marketing company."

TM
Tabassum MithaniTRS Care
★★★★★

"We are extremely happy with Softscotch, such an attentive team. No project is too small, and they give their 100%. We are extremely satisfied with their work."

SH
Safiya HafiziSimply Lactation
★★★★★

"Softscotch is a great team to work with: transparent, reliable and genuinely invested in the growth of your company. They are good partners to have by your side."

MJ
Malvika JainCyclop
★★★★★

"The Softscotch team has been a solid partner as our business evolved over the last five years. Unlike most agencies, they have never charged us for work that falls outside the agreement. That is what sets them apart."

IM
Imtiyaz MominHairareus
★★★★★

"Without their knowledge, we would be in a very different place than we are now. Whenever they find something that can be improved, they implement it quickly. I could not be happier with their performance and response time."

AP
Aaron PaulsonBaby Pavilion
★★★★★

"Softscotch goes above and beyond the scope. The time, effort and dedication they put in is like having your own in-house marketing team. They are not just another marketing company."

TM
Tabassum MithaniTRS Care
★★★★★

"We are extremely happy with Softscotch, such an attentive team. No project is too small, and they give their 100%. We are extremely satisfied with their work."

SH
Safiya HafiziSimply Lactation
No black box

You'll always know exactly what we changed.

Plenty of agencies go quiet after the audit and you never quite know what you're paying for. We do the opposite. You get a live view of every change and what it moved, in plain language you can act on.

Your delivery, at a glanceSample
Changes shipped12
Pages reviewed28
StartMidpointNow
Delivery activity✓ Up to date
HTML mockupExplore mockup ↗

Live client dashboard

Every change, score and ranking in one place you can open any time, not a monthly PDF you wait around for.

This week, explainedSample
✓Titles updated
Ready for your review
SSSoftscotch weekly update
0:00
2:00
HTML mockupExplore mockup ↗

Weekly video summary

A short screen-recorded video (Loom) each week walking you through exactly what shipped and what it moved, so nothing is a mystery.

The change is clearSample

Before

Titles30 / 100
Structure42 / 100
Content28 / 100

After

Titles84 / 100
Structure79 / 100
Content90 / 100
Same page. Reviewed changes.
HTML mockupExplore mockup ↗

Before/after score per page

See the exact lift on every page we touch, not a vague "it's improving" you have to take on faith.

Your weekly reportSample
01
What shipped

Approved page updates are live.

02
What we learned

Product details need a review.

03
What happens next

Confirm the next priority pages.

HTML mockupExplore mockup ↗

Plain-English reporting

Clicks, rankings and revenue, explained in words you can act on, instead of a wall of charts about how often you were seen (impression charts.

Your data. Your view.Sample
Organic search
StartMidpointNow
Sample report preview↗
HTML mockupExplore mockup ↗

Reports on demand

Ask for any cut of the data whenever you need it and get it, no waiting for the end of the month.

Every step, visibleSample
  1. ✓
    Proposed

    Softscotch prepares the change.

  2. ✓
    Approved

    Your team gives the go-ahead.

  3. ✓
    Published

    Checked live and recorded.

HTML mockupExplore mockup ↗

Ethical, transparent, always on

One accountable team, strictly white-hat (only methods search engines and platforms allow), no shortcuts and no surprises. Support whenever you need it.

One plan, full-stack access

One Softscotch plan gives you access to the full service stack, coordinated around your priorities.

You do not need a separate agency or retainer for every channel. Your plan can draw from search, paid media, web, ecommerce, outreach, automation, lead generation, messaging, content, creative and operations. The agreed scope sets what is active, in what order and at what capacity.

Pricing approach

One price for everything, not a stack of separate retainers.

You get one price for your whole marketing, not a separate retainer for every service. SEO, paid ads, your website, automations, cold email and newsletters, we run all of it as a single scope, so you get the most result for what you pay. Agencies sell each of these on its own, so the invoice climbs whether or not that line drives a single lead.

Bought separately, service by service

A different agency or retainer for each service. The bill stacks up fast, and keeps climbing whether or not each one moves a single lead.

SEO (technical, on-page, content)$2,000–3,500/mo
Local SEO+$750–1,500/mo
Programmatic SEO+$1,000–2,500/mo
CRO & landing pages+$2,000–3,500/mo
Paid ads (Google & Meta)+$2,500–4,000/mo
Marketing automations+$1,500–3,000/mo
Cold email outreach+$1,500–2,500/mo
Email marketing & newsletters+$750–1,500/mo
Website management & care+$750–1,500/mo
WordPress build & setup+$2,500–6,000 once
10 separate services$12,750–23,500/mo

Plus the one-off build, and a fresh contract, kickoff and onboarding delay for every new service you add.

All of it, one scope

We run your whole marketing as one engagement, so you get the most result for what you pay, not a pile of disconnected invoices.

  • SEO: technical, on-page, content, local and AI search
  • Template-built pages (programmatic SEO), links from other websites (backlinks) and authority
  • CRO and landing pages
  • Paid ads across Google and Meta
  • Automations, cold email and newsletters
  • WordPress build, setup and ongoing care
  • One team, one roadmap and one point of contact
  • Reporting tied to qualified leads and revenue
Everything above. One flat monthly fee.A fraction of the cost of the stack on the left
Plus free access to our own platforms
Post InstantlyVerified WidgetsTrending FunnelsBrands for CreatorsDarnItSEOGoHighLevel

Priced to your site after the audit. No sticker price, and no per-service creep.

What shapes your quote
Site sizePage count, templates and how much of the site actually needs work.
Market competitionHow hard the terms you want to win are, and who you are up against.
Content needsHow much new writing, rewriting and production the plan calls for.
Build complexityYour website platform (CMS, the system you edit your site in), your other tools and how involved the changes are to make.
Final pricing comes after the audit, once we have seen the four things above on your actual site. You get a written scope and a fixed quote before any work begins: no lock-in, no surprise line items, and no upfront number that ignores your market.
Request a custom scope
Questions, answered

What to know before you commission custom software.

These answers cover whether it's worth building, what's included, discovery, scope, technology, timeline, pricing, ownership, security, permissions, data, connections, offline use, testing, AI, hosting and guarantees.

Filter
What's included in your custom web application development services?

Your plan can include build-or-buy analysis, product and workflow discovery, defining the first version (MVP), design and accessibility, business rules and data design, front end and back end development, sign-in and permissions, APIs (secure links between software systems) and connections, files and reporting, automatic testing, security and privacy controls, moving data, putting it live, monitoring, recovery, documents, training, support and code and service accounts set up in your business's name. Your proposal names every user, workflow, feature, system, test and live setup, test and owner.

How is a custom web app different from a website, a SaaS product or automation?

A custom web app is business software that runs in a web browser, built around interactive workflows, records that move through stages, users and permissions. A marketing website mainly publishes content and brings in interest. Our SaaS builds service covers a software product you sell to many customers, with subscriptions, billing and account management. Automation can connect approved systems without a new app. We choose and link the right types of work instead of calling all software a web app.

When should we build custom software instead of buying SaaS or using low-code?

Custom development makes more sense when your workflow, data, permissions, connections or user experience are genuinely different in a way that matters to your business, and the value justifies owning it long term. Ready-made SaaS set up for you, or low-code, can be better for common workflows, quick in-house trials and simpler admin. We compare fit, limits, being locked in to one supplier, security, accessibility, control of your data, cost, time and upkeep before recommending a custom build.

What kinds of custom web apps can you build?

Examples include in-house operations tools, client and supplier portals, admin systems, dashboards, case and workflow apps, quoting and eligibility tools, apps for staff working in the field, reporting tools and customer self-service. These examples aren't a promise that every feature or regulated use will fit. Your product, data, security, connection and running needs decide what goes in the proposal.

What do you need from us during product discovery?

We need access to the people who own the process and typical users, your current tools and workarounds, sample data and documents, business rules and exceptions, roles and permissions, connections, volumes, speed and recovery needs, past incidents, required approvals and a real decision-maker. Discovery can stop, simplify or reshape the build when software isn't what's holding you back.

How long does custom web app development take?

Expect the "is it worth building?" brief in week 1, the approved first version and technical design in weeks 1 to 2, and a working core piece in weeks 2 to 4, once users, rules, data, access and reviewers are ready. A controlled live launch often falls in weeks 8 to 12, but only when the scope, data moves, connections, security, recovery and sign-off allow it. Your proposal sets the real milestones and doesn't promise a fixed finish date.

How is a custom web app priced?

Pricing follows discovery and the agreed users, workflows, record stages, screens, permissions, data, APIs, files, connections, data moves, test and live setups, needs such as speed and security, how deep testing goes, launch, documents and support. Your proposal separates our fees, cloud and supplier costs, licenses, optional extras, assumptions and how changes are handled. We don't quote on the number of screens alone.

Which technology do you use?

We choose the technology once we understand your business rules, team, connections, security, speed, hosting and upkeep needs. It may use frameworks and platforms such as React, Next.js, Node.js, Python, .NET, PostgreSQL and managed cloud services, or a suitable low-code platform. These names are examples, not claims of partnership. We write down versions, third-party code, how easy it is to move elsewhere and who runs it.

Who owns the source code, accounts and intellectual property?

Ownership, licenses, third-party components, materials that existed before the project, access to the source code, code storage, cloud accounts, domains, logins, data, documents and help if you move to another supplier are all set out in the signed proposal and agreement. Don't assume any ownership terms from this page. We prefer that you, or an organization you agree on, visibly control the key live assets, rather than an unrecorded handover.

Do you provide hosting, upkeep and ongoing support?

They can be included or coordinated with others. Your proposal names who owns hosting and the cloud account, test and live setups, monitoring, backups, incidents, expected response times, updates to third-party code, security fixes, support, roadmap work, costs and how you'd move away. Launching doesn't mean endless upkeep, 24-hour support or an uptime promise unless the written service agreement says so.

How do you approach web app security?

We base security requirements on the app's users, data, actions and risks, then apply the right controls for secure development, sign-in, permissions, input checks, secrets, third-party code, logging, threats and testing. Current public security guidance, such as OWASP ASVS and the OWASP API Security list, and NIST's secure software (SSDF) and digital identity guidelines, can shape the scope. Following a framework is not a certification, and no app can be promised to be unhackable. Your security and risk owners approve the target and the risk that remains.

How do roles, customer accounts and permissions work?

We define the customer account or organization, who the user is, role, ownership, relationships, user details, and rules for each record, field and action, before building the screens and the endpoints behind them. The server and database enforce the agreed rules, not just hidden buttons. We test attempts to reach other accounts' data or gain extra access, plus new users, handing access to others, role changes, people leaving, system accounts and emergency access. You approve who has authority in your business and any exceptions.

Can you connect our existing systems and move our data?

Yes, when it's in scope. We list your source systems, IDs, fields, APIs, files, limits and owners; agree the rules between systems and which one is in charge; map, clean and test the data; use practice runs and cross-checks; and control the switch-over and recovery. Reusable middleware or wide-ranging connection products belong to our API integration services. We don't promise that old data that's undocumented or poor quality can be moved without exceptions.

Can the app support several organizations or customer accounts?

Yes, when your business model needs it. We design checked customer-account context, sign-in and membership, separation across the database, cache, file storage, queues and logs, usage caps for each account, onboarding, export, closing accounts and tests that one account can't reach another. A software product you sell to many customers also needs subscriptions, billing, plan limits and wider account management, and is scoped under our SaaS builds service.

Can you build a PWA, an offline workflow or a native mobile app?

A PWA (progressive web app: a website that can be installed and used like an app) or a limited offline workflow can be included when browser support and how staff work in the field allow it. We define what data is stored on the device, queued actions, showing users when data may be out of date, settling conflicting changes, permissions, device storage and backups for browsers that aren't supported. A native iPhone or Android app is a separate product unless it's clearly named, and not every browser supports every background feature.

How do you test quality, accessibility and recovery?

Testing can include checks on business rules and calculations, rules for APIs and events, permissions, tests that connections and workflows still work, browsers and devices, keyboard and screen reader use, speed and heavy load, misuse and third-party code checks, moving data, undoing and restoring from backup. We use realistic edge cases and failure cases and record the proof and its limits. Automatic checks don't replace manual accessibility, security or user testing by qualified people.

Can the app include AI features, or be built with AI help?

Only under conditions. Code written with AI help still goes through requirements, human review, tests, and third-party code and security controls. An AI feature needs an approved task and limits on data, versioned models, prompts, data lookup and tools, realistic tests and tests against people trying to trick it, a way for people to override it, the least access needed, logs, speed and cost monitoring, checks for changes over time and an off switch. A full AI product or agent program may belong under our AI-powered tools service.

Can you guarantee security, adoption, uptime, compliance or business results?

No. Requirements, user behavior, data, connected systems, suppliers, cloud services, threats, staffing and market conditions all change. We can commit to the written scope for discovery, technical design, building, checking, launch, documents and support, and report what the proof supports. Certifications, compliance conclusions, uptime guarantees, response times and business results all need clearly named, qualified owners and signed terms.

Related services and industries