Enterprise Web Application Development
Software that a business runs on is judged on different things from software a business sells. Mostly on who can see what, who changed it, and what happens when it is down.
- Typical duration
- Nine to eighteen months
- Team shape
- Four to eight senior engineers
- Starts with
- A four-week diagnostic
The requirements that are never in the brief
An enterprise application is usually specified as a set of workflows, and then assessed on things nobody wrote down: who is allowed to approve this, why did that number change, which system is right when two disagree, and how long does the record have to be kept.
Those are not late-stage concerns that can be added once the workflows work. Access control, audit and reconciliation are structural, and retrofitting them is most of the reason enterprise rebuilds go long. We put them in the data model in the first month, and design the workflows on top of them rather than the other way round.
What usually goes wrong, and what we do instead
The pattern is consistent enough that we now design for it from the first sprint.
Where enterprise builds get stuck
- Permissions that model today's org chart and break at the first reorganisation
- An audit trail added after an auditor asks for one
- Two systems that both believe they own the same record
- Integrations to systems nobody currently has a contact for
- A migration plan that assumes the old system can be switched off
How we build it instead
- Roles modelled as capabilities, so a reorganisation is configuration
- Every write attributable and exportable, from the first release
- One owner per record, with the others explicitly reading from it
- Integration contracts agreed with the owning team before we build
- Both systems running in parallel until the new one has earned trust
What we build
The surfaces an operational system needs before it can be trusted with the work.
Access control
Role and attribute-based permissions enforced at the data layer, not repeated in each screen.
Audit and retention
Every change attributable, queryable and exportable, with a retention policy the system enforces.
Workflow and approvals
Multi-step processes with delegation and escalation, configurable without a release.
Enterprise integration
SSO, directory sync and the line-of-business systems the process actually depends on.
Reporting and reconciliation
Numbers that agree with the systems of record, and an explanation when they do not.
Resilience
Defined recovery objectives, tested restores, and a degraded mode rather than a blank page.
What you end up with
Stated from your side rather than ours.
Answers ready before the audit
Who changed what, when and under whose authority is a query rather than a project, because the model carried it from the start.
A system that survives a reorganisation
Permissions describe capabilities rather than the current org chart, so a restructure is configuration and not a release.
Process owners who can change the process
Approval routing and thresholds are configuration, so the business stops queueing behind engineering for policy changes.
A cutover you can reverse
The old system stays live until the new one has proven itself on real work, so go-live is a decision rather than a leap.
How the build runs
The same five stages as every engagement, applied to a system the business runs on.
Diagnose
The real process rather than the documented one, who owns each record, and what the auditors will ask.
Decide
Permission model, audit scope, integration contracts and the cutover approach, written down with their trade-offs.
Prove
One department, one workflow, end to end in production, running alongside the existing system.
Deliver
Workflows migrated in slices, each live and reconciled before the next is scoped.
Hand over
Your team runs it with us watching, then without us.
What we build it with
Chosen for what an operational system has to prove, not for novelty.
Interface
- TypeScript
- React
- Next.js
- Angular
Services
- Java
- Spring Boot
- Node.js
- REST
- Temporal
- Kafka
Data
- PostgreSQL
- MySQL
- Row-level security
- Elasticsearch
- Redis
Platform
- AWS
- Azure
- Kubernetes
- Terraform
- Datadog
What you get, and when
Handed over as it is produced, not assembled at the end.
- The permission model and the audit scope, written down
- Integration contracts agreed with each owning team
- A cutover plan with its rollback, and what would trigger it
- Source in repositories you own
- Infrastructure as code, in your accounts or tenancy
- A reconciliation report per slice against the system it replaces
- Audit trail schema and the retention policy it enforces
- Access review evidence and a tested restore
- Runbooks and an on-call handover your team wrote with us
The rest of our web work
Most web engagements touch two or three of these. If you are not sure which, the consultation is the way in.
Where we have built this
Sectors where the system is the operation rather than a view onto it.
Fintech & BFSI
Secure, reliable systems for businesses built on trust.
We build and modernize financial platforms, workflows, integrations, and customer-facing applications where reliability, data integrity, auditability, security, and performance are fundamental to the business.
Healthcare
Technology that connects complex care and operational workflows.
We help build digital healthcare platforms, operational workflows, integrations, and data-driven applications designed around reliability, secure information handling, usability, and the realities of interconnected healthcare systems.
HRMS
Workforce systems built around how organisations actually operate.
We build and improve workforce platforms spanning recruitment, onboarding, employee management, attendance, operational workflows, reporting, and integrations, reducing friction across the employee lifecycle.
Food & Travel
Digital experiences that keep customers and operations moving.
We build customer journeys and operational platforms around ordering, booking, marketplaces, partner integrations, administration, and real-time workflows where experience and operational efficiency need to work together.
Related work
Engagements where the business could not stop while the system changed.
Questions about enterprise builds
The ones we are asked most often before a first conversation.
Should we buy a package instead of building this?
Can you get us through SOC 2, ISO 27001 or a similar audit?
Will it work with our identity provider?
We have systems nobody fully understands. Is that a problem?
How do you handle go-live?
Who runs it once it is live?
Replacing a system the business runs on?
Tell us what the process is and who audits it. We will tell you what has to be true before anything can move.