Skip to content
Computese home

09

Custom software development

Custom software development is building the system your business runs on when no product fits: platforms, SaaS products, customer portals, internal tools and MVPs, with the APIs, data model and failure handling behind them.

Depends onWhen it fails

  • Payment providerRecovers
  • Email providerRetries
  • AI modelFails over
  • Signing serviceFails closed

Example fallback plan, one answer per outside service

Start with
Scope and architecture sprint
Ways to engage
Fixed price, time and materials, dedicated team
Works to
ISO/IEC 25010, OWASP ASVS 5.0, OWASP API Security Top 10
Reply time
Within 24 hours

Who it is for.

If you run a business

Part of your business runs on spreadsheets, email and a tool that almost fits. You need a system built around how you actually work.

Sound familiar?

  • Orders, bookings or cases live in spreadsheets and inboxes, and someone re-types them.
  • You pay per seat for software your team works around.
  • Customers call to ask for a status a portal could show them.
  • You have a product idea and need to know what the first version must hold.

If you lead a technology team

You need a platform, product or API built to your standards: a written architecture, typed code, reviewed pull requests, tests against a real database, security checks in the pipeline and a release you can verify.

Sound familiar?

  • The prototype demos well but has no permission model, error handling or release path.
  • Nobody can say which commit is running in production.
  • Payment or email calls fail silently, or run twice.
  • The roadmap is bigger than the team, and hiring takes months.

What changes.

What you can hold the work to, in plain terms.

  1. 01

    One system of record.

    Bookings, orders, documents and payments in one data model, with roles that decide who sees and changes what, and an audit trail of who did.

  2. 02

    Failure planned before it happens.

    Every outside dependency, from payments to email to an AI model, has a written failure mode before it is built: recover, fail over, degrade or refuse.

  3. 03

    Releases you can prove.

    The same gates run on every change, and a release counts only when production reports the build that was tested.

  4. 04

    Code and knowledge you keep.

    The repository, infrastructure definitions, decision records and runbooks are handed over, so another team could run the system without us.

The shape of a business platform.

Three lanes: what people sign in to, the work that runs behind it, and every outside service it depends on, each with a written answer for the day it fails.

Serve lane: customers, staff and admins sign in to a portal, a workspace or a console. Requests pass an edge network with CDN, WAF and TLS to the application and its API, described by an OpenAPI contract, with roles, two-factor sign-in and an audit log, over a relational database, private document storage and a cache. Work lane: a transactional outbox written with each record feeds a queue and background workers; a scheduler sends reminders and follow-ups and runs retention clean-up; a reconciliation job checks payments against the provider. Depend lane: payments recover through reconciliation, email retries from the outbox, the AI model fails over to a second provider, and document sealing fails closed.

Fig. 1 Reference architecture for a business platform. Tools vary by project; every outside dependency gets a failure mode before it is built.
Blank index cards pinned in neat columns on a pale wall, like a planning board, one card orange.

What we bring.

The disciplines inside this service, and the detail we work to in each.

  • 01

    Discovery and scope

    The workflow walked through with the people who do it, then cut to a first release that can be priced and tested.

    • Walk-throughs with the people who do the work
    • Must, should and won't, written down
    • A clickable prototype of the core flow
    • Acceptance tests agreed before the build
  • 02

    Architecture and data

    Decisions recorded with their reasons, and a data model designed before the screens that depend on it.

    • Architecture decision records
    • Data model, migrations and retention rules
    • One deployable application first, services only where load or teams need them
    • Tenant isolation for SaaS products
  • 03

    Portals, workspaces and admin

    The screens people sign in to: customer and partner portals, staff workspaces and the back office behind them.

    • Customer and partner portals
    • Staff workspaces and admin consoles
    • Roles, two-factor sign-in and an audit trail
    • WCAG 2.2 AA on signed-in screens too
  • 04

    APIs, jobs and providers

    The back end that does the work: API contracts, background jobs, and the calls to payment, email and calendar providers.

    • OpenAPI contracts, versioned
    • Background jobs, queues and schedules
    • Idempotency keys and a transactional outbox
    • Payments with refunds and reconciliation
  • 05

    MVPs and SaaS products

    A first release real users can complete end to end, built on the foundation the full product will keep.

    • One core workflow, finished end to end
    • Scope cut to what tests the idea
    • Sign-up, onboarding and account settings
    • Usage analytics from the first release
  • 06

    Delivery, security and operations

    The engineering that makes a system safe to change: every change gated and scanned, and every release traceable to the build that runs.

    • A quality gate that stops at the first failure
    • Integration tests against a real database and cache
    • Browser tests on desktop and mobile
    • Secret, code, dependency and container scanning
    • Release IDs confirmed from production
    • Synthetic checks and an alert per dependency

Buy, configure, extend or build.

Most good platforms are mostly bought. We decide module by module and write down why, so custom code goes only where it pays for itself.

OptionFits whenWhat you ownTrade-off
Buy a productFits whenThe process is standard: accounting, payroll, e-signature.What you ownYour data, within the vendor's export options.Trade-offPer-seat fees, and the vendor's roadmap instead of yours.
Configure a platformFits whenA common process with your own fields and steps, such as a CRM.What you ownA configuration inside their platform.Trade-offLimits at the edges, and leaving is a project.
Extend with a custom moduleFits whenA product covers most needs, and one workflow sets you apart.What you ownThe module and its API contract.Trade-offTwo things to keep in step when the vendor changes.
Build a platformFits whenThe workflow, data or rules are the business, and no product fits.What you ownEverything: code, data model and infrastructure definitions.Trade-offYou fund its upkeep, so it needs an owner and a budget after launch.

If a product fits, we will say so and help you choose it.

How it runs.

Every stage ends with a document you keep and a gate you can check.

  1. 01

    Shape

    The workflow walked through, the first release cut to what matters, and a price for it.

    Exit gate: You sign off the phase-one scope and its acceptance tests.

    • Walk-throughs
    • Prototype
    • Acceptance tests

    You receiveWritten scope, prototype and a fixed price for phase one

  2. 02

    Foundation

    Before any feature, a bare version of the whole system runs on staging: sign-in, data model, release pipeline and alerts.

    Exit gate: A change travels from pull request to staging through every gate, and rolls back.

    • Walking skeleton
    • Release pipeline
    • Monitoring

    You receiveA walking skeleton on staging

  3. 03

    Build

    Short increments on a system that already deploys, each one shown working on staging.

    Exit gate: The phase-one acceptance tests pass on staging with realistic data.

    • Increments
    • Demos
    • Integrations

    You receiveWorking software on staging after every increment

  4. 04

    Launch and run

    Data migrated, a rehearsed release, then the first weeks watched closely by the team that built it.

    Exit gate: Production reports the tested release, and every alert reaches a named person.

    • Data migration
    • Release
    • Hypercare

    You receiveLive system, runbook and handover

What is in scope.

Written down before work starts, so nothing is assumed.

Included

  • Discovery, a written scope and a clickable prototype
  • Architecture decision records and a data model
  • Working software on staging after every increment, with a demo
  • Tests, security scans and accessibility checks in the release pipeline
  • Data migration, monitoring, a runbook and handover
  • The repository and infrastructure definitions, handed over

Not included

  • Hosting and on-call after launch (see Hosting & maintenance)
  • Marketing sites (see Web design & development)
  • Connecting existing systems without a new application (see Integrations)
  • Licences and provider fees for payments, AI models and SaaS seats, billed to you

Standards and stack.

The public frameworks we measure the work against, and the platforms we run it on.

Standards we work to

ISO/IEC 25010
Quality attributes such as reliability, security and maintainability, written into the scope as testable requirements.
OWASP ASVS 5.0
Security requirements for sign-in, sessions, access control and APIs, chosen per project.
OWASP API Security Top 10
Object-level authorisation tested on every endpoint, the first risk on the list.
NIST SSDF (SP 800-218)
Secure development practices across its four groups: prepare the organisation, protect the software, produce it well secured, respond to vulnerabilities.
WCAG 2.2 AA
Accessibility for signed-in screens and admin consoles, not only public pages.
DORA metrics
Delivery measured with DORA's software delivery metrics, such as change lead time and change fail rate.

How we choose tools

Certified engineers
AWS Solutions Architect, Azure Solutions Architect Expert, Google Cloud and security certifications, held by the engineers who do the work.
Licensed tools only
Every tool comes from an approved list: commercial software under its licence, or open source under a standard licence. Nothing cracked, nothing unlicensed.
Your platform first
Where you already run something that works, we build on it.
Not on the list?
Ask. Engineers who know the fundamentals pick up a new tool quickly, and we will tell you plainly if we have not used it before.

Platforms and tools we work with

Languages

  • TypeScript
  • Python
  • Java
  • C#
  • Go
  • Kotlin
  • SQL

Back ends

  • Node.js
  • NestJS
  • Fastify
  • Spring Boot
  • ASP.NET Core
  • Django
  • FastAPI
  • Laravel

Front ends

  • React
  • Next.js
  • Angular
  • Vue.js
  • Progressive Web Apps

Data and messaging

  • PostgreSQL
  • MySQL
  • Microsoft SQL Server
  • Redis
  • RabbitMQ
  • Apache Kafka
  • S3-compatible object storage

Identity and access

  • OpenID Connect
  • OAuth 2.0
  • Keycloak
  • Microsoft Entra ID
  • Auth0
  • Passkeys

Providers we integrate

  • Stripe
  • PayPal
  • Square
  • Amazon SES
  • Postmark
  • Google Calendar
  • Microsoft Graph

Quality

  • Playwright
  • Vitest
  • Jest
  • JUnit
  • pytest
  • Testcontainers
  • k6

Delivery

  • GitHub Actions
  • GitLab CI
  • Docker
  • Kubernetes
  • Terraform
  • Coolify

Security and observability

  • Semgrep
  • Trivy
  • Gitleaks
  • OWASP ZAP
  • Dependabot
  • OpenTelemetry
  • Prometheus
  • Grafana
  • Sentry
  • Checkly

Where we have done it.

Client cases name the industry and the stack, never the client.

Minute Notary is a notary office in Ottawa. We designed, built and run the platform behind it: booking and payment, secure documents, a workspace for notaries, and seals anyone can verify online.

09Custom software01Website02Hosting03SEO10AI & automation

How to start.

A fixed, small first engagement, then the model that fits the rest.

A first engagement

Scope and architecture sprint

A short, fixed-price piece of work before any build: the first release defined, prototyped and priced. The plan is yours even if you stop there.

You receive

  • A written scope: must, should and won't
  • A clickable prototype of the core flow
  • Decision records for build or buy, data and hosting
  • A fixed price for phase one, and a range for the rest

What we need from you

  • An owner who can decide scope
  • Examples of today's process: sheets, forms, emails
  • Access to the systems it must connect to
  • Your constraints: deadline, budget band, compliance

Then, the model that fits

  • Fixed price

    Defined projects: a website, an assessment, a migration stage

    One price for that scope

  • Time and materials

    Ongoing improvement, support and discovery work

    Billed for the time used

  • Dedicated team

    Long programs such as a platform migration

    A monthly rate per engineer

Common questions.

What is custom software development?

Custom software development is designing, building and running software around one organisation's own workflow, data and rules, instead of bending the business to a product. It covers business platforms, SaaS products, customer portals, internal tools, MVPs and the APIs behind them. It pays off when the workflow is what sets you apart and no product fits it.

How much does custom software cost?

It depends on scope, integrations and compliance, so we price in two steps. A fixed-price scope and architecture sprint produces a written scope, a clickable prototype and a fixed price for the first phase, with a range for the rest. You know what phase one costs before any build starts, and the plan is yours even if you stop there.

How long does it take to build an MVP?

It depends on how many roles, integrations and compliance needs the first release carries, so the scope sprint ends with a date as well as a price. We cut scope before we stretch the date: the first release answers one question about demand or workflow, and everything else waits until users show what matters.

Should we buy off-the-shelf software or build our own?

Buy when the process is standard, such as accounting, payroll or e-signature. Configure a platform when the process is common but has your own fields and steps. Build only the part that sets you apart, or when no product fits your data, rules or compliance needs. We decide module by module and record why, so most platforms mix bought and built parts.

What is the difference between a proof of concept, a prototype and an MVP?

A proof of concept shows that something can be built, often in code nobody ships. A prototype shows how it would work, usually as clickable screens. An MVP is working software that real users rely on, with the smallest scope that still tests the business idea. We build MVPs on the same foundation the full product will use.

Do we own the code?

Yes. Everything built for you is handed over: the repository, infrastructure definitions, decision records and runbooks, with admin access to every service the system depends on. Everything needed to build, deploy and run it is written down, so another team could take it over without depending on us.

Can you provide a dedicated development team?

Yes. Engineers are assigned to your roadmap at a monthly rate per engineer, work in your tools and routines, and stay with the product, so knowledge builds up instead of leaving with each project. It suits long programmes and growing products. For a defined first release a fixed price usually fits better, and many teams switch after launch.

What happens when a payment, email or AI provider fails?

Each outside dependency gets a written failure mode before it is built: recover, fail over, degrade or fail closed. On the notary platform we run, payment events are reconciled with the provider on a schedule, emails leave through an outbox, the assistant fails over to a second model provider, and no seal is issued without a trusted timestamp.

Can you take over software another team built, or an AI-generated prototype?

Yes, starting with a fixed-scope codebase review. We reproduce the build and deploy, run the tests and security scans, read the data model and list what blocks production: missing authorisation rules, error handling, tests or a release path. You get a ranked fix list and a straight answer on repair versus rebuild.

How do you keep custom software secure?

Requirements come from OWASP ASVS 5.0 and the OWASP API Security Top 10, and the pipeline checks every change with secret scanning, static analysis and dependency and container scans. Staff sign in with two factors, roles limit what each person can see and do, and documents sit in private storage. Independent penetration tests are scoped separately.

Do you work with businesses in Ottawa?

Yes. Our office is in Ottawa, and we designed, built and run the platform of an Ottawa notary office, Minute Notary. Most projects are for clients in other cities and countries, so we work remotely by default and meet in person when that helps the project.

Who runs the software after launch?

We can. The team that built it runs it under Hosting & maintenance: monitoring, patching, backups with restore tests and an alert for each outside dependency, with new features under time and materials or a dedicated team. If your own team takes over, the handover includes runbooks, access and a walkthrough of every alert.

Guides from the blog.

Plain-language articles on custom software development, with their sources.

Custom software17 min read

The future of software engineering: will AI replace software engineers?

AI is changing software engineering, not replacing it: what controlled trials, DORA, Stack Overflow and BLS data show, and which skills now matter.

Updated

Custom software19 min read

Augmented reality programming: how AR apps work and how to build one

How augmented reality programming works: tracking, anchors and rendering, the main SDKs (ARKit, ARCore, Unity, OpenXR, WebXR) and how AR apps are built.

Updated

Custom software17 min read

Software development process: the life cycle explained for business owners

How software gets built: the SDLC phases, waterfall, agile and DevOps, built-in security, build versus buy, cost drivers and how to judge a development partner.

Updated

Custom software19 min read

Automation testing trends in 2026: what changed since 2024

Where test automation stands in 2026: shift-left CI, Playwright, Cypress and Selenium, contract, visual, accessibility and AI testing, and what to adopt now.

Updated

Web development16 min read

AR vs VR: the difference, and which fits training and remote collaboration

AR adds digital content to your view of the real world; VR replaces that view. How each is used for training and remote work in 2026, and which one fits.

Updated

All Custom software articles →

Start with a conversation.

Tell us what you run and what is getting in the way. You get a reply within 24 hours.

Hours
Mon–Fri, 9:00–17:00 ET
Closed on statutory holidays
Office
110 Place d'Orléans Dr
Ottawa, ON K1C 2L9