Approach
Handing over a repository is not delivery.
We deploy, monitor, and maintain what we build. This page is the standard that applies to every engagement — published in full, so you can hold us to it rather than take our word for it.
The stack
Deliberately narrow.
Narrowness is the point. It makes one engineer as productive as three, and it makes the next engineers cheap to onboard. A new tool enters this list only when something already on it genuinely cannot do the job — and then it is supported forever, or deliberately removed.
- Backend
- Django / Django REST Framework
- Performance-critical services
- Rust / Axum
- Web frontend
- Next.js / TypeScript
- Mobile
- Flutter
- Database
- PostgreSQL
- Cache & queue
- Redis, Celery
- Runtime & deploy
- Docker Compose, Caddy, Hetzner
- CI/CD & registry
- GitHub Actions, GHCR
If you need something we do not run, we will tell you that — and either decline it or subcontract it with your written knowledge. We do not claim technology we do not operate in production.
Definition of done
Six things, all true at once.
Partially done is not done, and is never reported to you as done.
- It works against realistic data, not the happy path only
- Automated tests cover the critical paths, and they pass in CI
- It is deployed to the target environment, not just to a branch
- Errors surface in monitoring rather than in a client phone call
- The deploy and rollback procedure is written down
- The client can perform the task the feature was built for, unaided
Security baseline
Three tiers. Each one is a gate, not a wish list.
Tier 1 is not negotiable: no client system of ours goes live without every item on it.
Tier 1
Before any client system goes live
- Secure authentication and authorisation, with least-privilege roles
- TLS everywhere; no plaintext transport, internal or external
- Automated backups with a tested restore — an untested backup is not a backup
- Error monitoring and alerting that reaches a human
- Documented development and deployment process
- Privacy policy and terms of service published
Tier 2
Within 90 days of the first paying user
- Support channel with a stated response time
- Personal data encrypted at rest; payment credentials never stored by us
- Access control reviewed and reduced to least privilege
- Written incident response runbook, with who is called and in what order
- Audit logging on sensitive actions
Tier 3
Before making enterprise claims
- Service-level commitments with defined credits
- Disaster recovery with a stated recovery time and recovery point objective
- Scheduled security reviews and dependency audits
- Data-controller registration and a documented data-processing basis
When something breaks
Severity decides the response.
- SEV-1
- System down, or data at risk
- SEV-2
- Major function broken, workaround exists
- SEV-3
- Minor defect, cosmetic issue
Every SEV-1 produces a written post-mortem: what happened, why, and what prevents recurrence. Post-mortems are blameless, and they are kept permanently.
We have not published response-time commitments here. We hold internal targets, but we will not advertise a number we have not yet had to meet under real conditions — a missed commitment on paper is worse than no commitment at all. Response times are written into the retainer agreement, where they are specific to your system.
What we hold to
Six principles that decide arguments.
Production or nothing
Work is not real until it serves real users under real load.
Your outcome outranks our elegant solution
We optimise for what makes you money, not for what makes us feel clever.
Own the stack we choose
Deep in a small number of tools beats shallow in many.
Nothing ships without a named owner
If nobody's name is on it, it does not get built.
Reputation is the only durable asset
One badly maintained deployment costs more than five signed contracts.
Write it down
Agreements, decisions, incidents, and architecture. An undocumented company cannot be handed to anyone.
Hold us to it.
If anything on this page does not match what you experience working with us, that is a legitimate complaint and we would want to hear it.