How we build software

Every project follows the same path and the same quality standards, from the first conversation to long-term support.

From first call to long-term support

First conversation
We learn about the problem and check that it is work we can do well.
You receive
An honest answer on whether this is work we can do well.
Discovery
We agree the scope, the assumptions and the risks.
You receive
Written scope, assumptions and risks, with written acceptance criteria for each feature.
You approve
The scope and the acceptance criteria.
Proposal
A written proposal with an estimate range, a timeline and the risks.
You receive
An estimate range, a timeline and the risks, in writing.
Contract
We sign and set up the project.
You receive
A signed agreement, and your own view of the code repository, task board and staging site.
Delivery
We work in one- to two-week iterations, each ending with a demo or a written update.
You receive
A demo or written update every one to two weeks, and a staging site you can check at any time.
You approve
Each feature against its acceptance criteria, at each demo.
Handover
Runbooks, final documentation and a handover checklist.
You receive
Runbooks, final documentation and a handover checklist, plus a backup and restore plan.
Support
Monitoring, updates and a monthly report.
You receive
Monitoring, updates and a monthly report.

Anything outside the signed scope is written up as a change request with an estimate, and work starts only after you approve it.

Our quality standards

Code review.
Every change goes through a pull request and is reviewed by a person before it is merged.
Automated testing.
Core logic has automated tests, and all checks must pass before a change is merged.
Staging before production.
Every release is tested in a staging environment first.
Regular progress.
One- to two-week iterations, each ending with a demo or a written update.
Documentation.
Each project keeps a README, a record of key decisions and a runbook, so anyone can maintain it.
Maintainable over clever.
When a clever solution conflicts with one the next person can understand, we choose the one they can understand.
Clear estimates.
Every quote gives a range, includes testing, documentation, deployment and handover, and states what is out of scope.
Acceptance criteria.
Each feature has written 'done' criteria agreed with you before it is built, and you sign off at each demo.
Visibility.
During the project you can see the code repository, task board and staging site, so you can check progress at any time.

Security and data protection

We use the minimum data needed.
Everyone has their own account, with no shared logins, and multi-factor authentication on email, code hosting and cloud.
Access is granted per project and removed when the project ends.
Passwords and keys are never stored in code or documents.
Confidential data only goes into tools we have approved, after checking each tool's data-retention settings.
If your industry or country has stricter rules (for example GDPR or healthcare privacy rules), we follow the stricter rule.
If a data incident happens, we contain it and notify you as the contract and the law require.
Code and dependencies are scanned for known vulnerabilities, and reviewed against secure coding practice such as the OWASP Top 10, before every release.
Data is backed up with a tested restore plan, and every release has a rollback plan.