Web platforms & custom software
Most of what we build is the software a business runs on, not the software it shows off: booking systems, field data apps, the dashboard a manager opens at 9am for one number. We like that work. It has to be right, and it has to be easy to change next year when the business changes.
01In detail
What we build
Web applications & portals
Customer portals, booking and application systems, member areas. Things with logins, roles and real data behind them.
Internal tools
Admin panels and dashboards that replace the spreadsheet everyone is scared to sort.
Integrations & APIs
Connecting what you already have: ERPs, payment gateways, SMS providers, accounting software, government APIs.
Map & GIS applications
Asset registers, survey viewers and route tools where location is the main thing on the screen.
Python services & data pipelines
APIs in FastAPI or Django, background workers and scheduled jobs that move and clean data between systems.
Takeovers
Half-built projects from another vendor. We review what is there, tell you honestly what is worth keeping, and finish it.
02Process
How it runs
If an off-the-shelf tool will do the job for a fraction of the cost, we will tell you. We would rather lose a project than build something you did not need.
Define
1 – 2 weeks
We sit with the people who will use the system, map the workflow as it actually happens and agree what the first release must do. You leave with a written scope and a fixed price for phase one.
Design
Parallel
Clickable screens for the main flows, tested with real users before anyone writes production code. Cheap to change at this stage.
Build
2-week cycles
Working software every two weeks on a staging link you can open yourself. No big reveal at the end.
Launch & support
Ongoing
We handle deployment, train your staff, and stay available for fixes and the next round of features.
03Deliverables
What you get
- Source code in a repository you own from the first day
- A staging environment you can test on at any time
- Technical documentation and an admin guide
- Automated tests on the parts that handle money, data or permissions
Tools we reach for
- Laravel
- PHP 8
- Python
- Django
- FastAPI
- Node.js
- Vue
- Nuxt
- PostgreSQL
- MySQL
- Redis
- Docker
04Related work
Related work
Security checks
Six security checks before every launch.
Before anything goes live, we test it the way an attacker would, then write down what we found and how we fixed it. The same six checks run on every project, from a one-page website to a government portal.
- 01
Scan for known weaknesses
We check your code, the libraries it uses and the server for weaknesses attackers already know how to exploit.
OWASP Top 10 · CVE database
- 02
Try to break in
Our engineers attack it the way a real attacker would: logins, permissions, file uploads, pages that should be hidden.
OWASP ASVS
- 03
Check every public link
Every public page and address is crawled for files, folders and test pages that should never have been online.
OWASP Top 10
- 04
Look for malware
The code, the server and anything users can upload are checked for malware and hidden backdoors.
Before every launch
- 05
Try to trick the AI
For AI agents, we try to make them leak data, ignore their instructions or use access they should not have.
OWASP Top 10 for LLM Applications
- 06
Write it all down
Every finding, how we fixed it and the re-test that proves it, in a report your auditors can read.
ISO/IEC 27001-aligned process
Our process follows ISO/IEC 27001 controls. Prospiral is not ISO certified. VAPT means vulnerability assessment and penetration testing: the first two checks above.
05Questions
Questions we get asked
You do. The repository sits in your account from the start, and you receive full rights to everything we write for you.
Both, depending on how well defined the work is. After discovery most first releases are fixed price. Ongoing development after launch is usually a monthly retainer.
Yes. We start with a short paid review so you know what you have before committing to anything bigger.
Start a conversation
Tell us what’s broken.Or what you want built.
Send a few lines about the system or the idea. One of the engineers who would actually do the work will reply, usually within a working day.