Five steps, the same on every project.
Step 01: Understand
We follow how the work happens today: who does it, what they use and where it breaks. No assumptions.
Step 02: Agree in writing
Scope, stages and deliverables are written down and agreed before any work starts, so you know exactly what you are getting.
Step 03: Build in stages
Each stage ends with something you can use, approved by you before the next one begins. You see progress, not a black box.
Step 04: Check every change
Type checks, automated tests, a secret scan and a dependency scan run on every change, every time.
Step 05: Hand over
Code, domain and accounts in your name, with documentation and a runbook. You are never locked in.
What runs on every change.
OWASP ASVS 4.0.3 Level 1 is the baseline, Level 2 on request. We follow NCSC secure development guidance throughout.
Type checks
The code is type-checked, so a whole class of mistakes is caught before it runs.
Automated tests
The behaviour you depend on is covered by tests that run on every change.
Secret scan
Every change is scanned so no password or key is ever committed to the repository.
Dependency scan
Dependencies are scanned for known vulnerabilities, so you are not shipping an old hole.
You always know what was done and why.
A status note, a decisions log and a change log, every week. No status meeting required to find out where things stand.
Status note
What was done, what is next, and anything that needs your input.
Decisions log
Each decision and the reason behind it, so nothing is a mystery later.
Change log
What was added, changed and fixed, stage by stage.
Popular, well-documented tools.
We favour tools your next engineer will already know, so you are never dependent on us. The exact stack depends on the job.
Languages
TypeScript for application code, with types on by default. The right language for the job, never for fashion.
The web
Standards-based HTML, CSS and JavaScript. This site is built with Astro and ships almost no client-side code.
Data
Well-understood relational databases such as PostgreSQL, and the tools your business already uses.
Hosting and delivery
Cloudflare for this site; your project is hosted in accounts in your name, in the region you need.
Version control
Everything in Git, with a readable history, so any change can be traced and reverted.
Checks in the pipeline
Type checks, tests and scans wired into how changes ship, not run by hand and forgotten.
Secure, accessible and private by default.
Security
OWASP ASVS 4.0.3 Level 1 baseline, Level 2 on request, following NCSC secure development guidance.
Accessibility
WCAG 2.2 AA, tested by a person, and reported honestly until a full manual audit passes.
Privacy
No tracking cookies, and a GDPR Article 28 data processing agreement as standard.
We hold ourselves to the same standard.
The site you are reading is built the way we build for clients. You can check it.
About 17 KB a page
Light, fast pages with no heavy frameworks and no raster hero images.
No tracking cookies
Cookieless by design, which is why there is no cookie banner.
A strict policy
A Content Security Policy that blocks third-party scripts. Read the security page →
An honest statement
Our own accessibility is stated plainly. Read the statement →
Hold us to it.
Tell us what you need built. We reply within 2 business days.