Custom Software Engineering
Web, mobile and enterprise applications built to a written specification.
Bespoke business systems designed around your domain rather than around a template: data model, backend services, web or mobile interface, and an automated test suite that runs on every commit.
We start from the process the software has to support, write the domain model down, and agree it before any interface exists. Delivery is incremental — a running system at the end of every stage, deployed to an environment you control, with the source code and build pipeline handed over as part of the engagement rather than after it.
What you receive
- Written functional specification and domain model
- Backend services with an HTTP API and database schema
- Web interface, or a mobile client where the process needs one
- Automated test suite and CI pipeline
- Deployment scripts, runbook and source-code handover
Typically involves
- PHP 8.3
- Node.js / TypeScript
- React
- MySQL
- PostgreSQL
- REST
- OpenAPI
- Engagement
- Fixed-scope project or staged delivery
- Starts with
- A scoping conversation and a written specification
Enquire about this →Strategic IT Consulting & Architecture Audit
An independent read of the estate you have, and a target design you can sequence.
A structured assessment of an existing system landscape — code, data, infrastructure, delivery process — ending in a written target architecture and a change sequence a team can actually execute.
The output is a document, not a slide deck: current state as we found it, a findings register ranked by risk and cost of inaction, a target architecture with the trade-offs made explicit, and a sequenced plan broken into changes that each leave the system working. Where a finding is disputed we record the disagreement rather than smoothing it over.
What you receive
- Current-state assessment across code, data and infrastructure
- Findings register ranked by risk and cost of inaction
- Target architecture with trade-offs stated
- Sequenced roadmap in independently shippable stages
- Walkthrough session with the client’s technical staff
Typically involves
- Architecture review
- Threat modelling
- ADRs
- C4 modelling
- OWASP ASVS
- Engagement
- Fixed-scope audit, typically 3–6 weeks
- Starts with
- Read-only access to the code and a conversation with the people who run it
Enquire about this →Cloud Migration, DevOps & Microservices
Environment topology, infrastructure as code, pipelines and observability.
Moving workloads to cloud infrastructure without moving the existing problems with them: a documented target topology, infrastructure defined as code, a deployment pipeline with a rehearsed rollback, and monitoring that fires before a customer notices.
Migration work is sequenced so that every step is reversible. We rehearse the cutover on a copy of production data before the real one, and the pipeline that deploys the system is the same pipeline that rolls it back. Service decomposition is done only where a boundary already exists in the domain — splitting a system that has no seams produces distributed monoliths, which are worse than the monolith.
What you receive
- Target environment topology and network design
- Infrastructure as code (Terraform or provider-native)
- CI/CD pipeline with automated rollback
- Logging, metrics and alerting with documented thresholds
- Rehearsed cutover plan and runbook
Typically involves
- Docker
- Terraform
- GitHub Actions
- Nginx
- Linux
- Prometheus
- Grafana
- Engagement
- Project or retainer
- Starts with
- An inventory of what runs today and what it depends on
Enquire about this →Legacy Modernisation & Security Compliance
Replace an ageing system in stages, without a big-bang rewrite.
Incremental replacement of software that still earns its keep but has become expensive to change: an interface seam is introduced, components move across one at a time, and the old system keeps running until the last one has.
A rewrite that switches over in one weekend is the highest-risk plan available and is almost never necessary. We put a seam in front of the existing system, move functionality across component by component, and keep a regression suite that proves the behaviour still matches. Security remediation runs alongside: dependency currency, access control, input handling and data protection reviewed against OWASP ASVS, with each finding costed so the client decides what gets fixed and when.
What you receive
- Code and dependency risk assessment
- Interface seam in front of the existing system
- Component-by-component replacement plan
- Data migration with reconciliation reports
- Security findings mapped to OWASP ASVS, with remediation costs
Typically involves
- Strangler pattern
- OWASP ASVS
- Static analysis
- Data migration
- Regression testing
- Engagement
- Staged programme, reviewed at each stage
- Starts with
- An assessment stage that can be commissioned on its own
Enquire about this →