Custom software development in London.

• London agency

  A limited company registered at Companies House, on UK time all day, able to put people in your office. You are buying proximity, a domestic invoice and eligibility for frameworks that require a UK-established supplier. The right answer when the work is stakeholder-heavy, needs people on site, or runs through a procurement process that expects a local vendor.

• Contractor or staffing firm

  Individual engineers billed by the day into a process you already run, with the status questions that come with engaging individuals. You are buying capacity; architecture, review, testing and release stay with your own lead. The right answer when you already have an engineering manager with room to direct more people.

• Remote engineering partner

  A small senior company team that owns a defined build, works your day from outside the country and hands over the repository at the end. There is no UK entity, so contract, VAT treatment and the due-diligence questionnaire are dealt with at the start. The right answer when you know what the system must do and want it built properly the first time.

We are the third of those. If one of the first two is the better fit for your firm, we say so on the first call, not after a deposit has been paid.

• Hire a remote partner when

  • ✓Somebody on your side can describe the process and make decisions about it without a partners’ meeting.
  • ✓The work has a defined shape, a first release, a rebuild or a set of modules, rather than an open-ended programme whose sponsor keeps changing.
  • ✓Six live hours a day cover what needs a conversation, and the rest can run on a written handover.
  • ✓You want the source, the pipeline and the documentation in your own company’s accounts when the work is finished.
  • ✓Personal data is in scope in the ordinary way, and your DPO or compliance lead will set the rules and check our evidence against them.

• Hire in London instead when

  • ✓A framework agreement, a client’s terms or a public-sector procurement rule requires a supplier established in the United Kingdom.
  • ✓People have to be physically present: a trading-floor rollout, a clinic go-live, hardware in a comms room, a warehouse cutover in Park Royal.
  • ✓Your security policy forbids production access from outside the UK and the work cannot be done on masked data.
  • ✓Delivery has to run on UK time until 18:00 because the stakeholders who decide are only free late in the day.
  • ✓What you really want is a contractor under your own architect, in which case a staffing firm costs you less management overhead.

• 01

  Start with the rows we lose.

  A table where one column wins everything is a brochure. Two rows above are reasons to hire somebody else, and it is better to find them here than in month four of a contract you cannot exit cleanly.

• 02

  Where the data lives and where the developers sit are separate questions.

  Your platform can run in the AWS London region, in your own account, with personal data never leaving the UK at rest, while the engineers writing it work elsewhere under access controls your DPO has approved. Most due-diligence conversations resolve once that distinction is on the table.

• 03

  A company contract is a different thing from a contractor.

  This is an engagement between two limited companies, with a statement of work, not an individual working through an intermediary. The status questions that attach to engaging individuals are not what is being bought here. Your accountant and counsel confirm the position for your firm.

• 04

  Staffing adds hands; it does not add a system.

  Contract developers are capacity for a process you already run. If nobody on your side holds architecture, review and release quality, that capacity produces code faster than it produces working software.

• Onboarding

  Client onboarding, KYC workflow and case management

  The system a regulated firm or a partnership actually runs on: intake, identity checks routed to your chosen provider, approvals, exceptions and reporting, built around your process rather than a vendor template. Usually replacing six inboxes and a tracker spreadsheet.

• Portals

  Client, member, tenant and patient portals

  A portal over the system you already own, with role-scoped access, document handling and an audit trail that survives a due-diligence review. The fastest way to take volume off a service desk or a partner’s PA.

• SaaS

  SaaS products and first releases

  Multi-tenant products with billing, roles and usage limits for a founding team in Shoreditch or King’s Cross, or for a firm turning an internal tool into something it sells. This is the shape of the CyberFind vendor decision engine: one system of record, a comparison engine over it, four years in production and no rewrite since launch.

• Mobile

  Apps that work on the Tube

  One Flutter codebase for iOS and Android, capturing offline and syncing when the signal returns, for couriers, field staff, members and patients who are not always above ground.

• Integrations

  Practice system, CRM, payments and NHS integration

  Message queues, retries and a reconciliation view sitting between your system of record and everything around it, so that a failed sync is noticed by a person instead of buried in a log file.

• Cloud

  Cloud environments and release pipelines

  AWS accounts in your company’s name, in the London region where residency matters, defined as code and released in stages with monitoring and the change history a due-diligence questionnaire asks you to show.

1. Discovery and written scope

   One call about how the work moves, who touches it, where it breaks and what personal data is involved. Then a written scope with the exclusions named. The document is yours whatever you decide.

   A scope, a first-phase price range and the name of the engineer who would lead it.

   48 hours

2. Prototype and architecture

   Clickable screens in week one so your head of operations or compliance lead argues with something real. Alongside them: data model, access control, the UK hosting region, retention rules and the rollback path, agreed in writing before an editor is opened.

   Approved screens, an architecture your technical lead has challenged, a data protection position your DPO has seen.

   1 to 2 weeks

3. Build in two-week slices

   Working software demonstrated every fortnight in your morning, on your real records. Each slice is checked against the scope with you on the call, so progress is watched rather than reported.

   Working modules proven against real scenarios, and a backlog you shaped along the way.

   6 to 14 weeks, by scope

4. Harden, then release

   Permissions, load behaviour, backups, monitoring and a rehearsed rollback signed off before a London user logs in. Where subject access tooling or an audit trail is required, it is produced here rather than promised.

   A release your security reviewer and your DPO can sign off, evidence included.

   2 to 3 weeks

5. Run and extend

   Monitoring, a support window across UK office hours, a critical fix within 48 hours, and the next feature chosen from what your people actually use.

   A platform that keeps earning its place, and a team that hands it to yours whenever you ask.

   Monthly, 30 days notice

• First build

  Replacing the spreadsheet that runs the firm

  An onboarding desk, a matter list or an operations team held together by workbooks, email and one person who knows the exceptions, rebuilt as a system with roles, approvals and a history of who did what. Bloomford, a recruitment agency in Belgium, went from four inboxes to one pipeline this way. For operations, compliance and finance teams at growing firms.

• Rebuild

  Retiring a tool the vendor no longer supports

  An old desktop application or an early web tool rebuilt as a maintainable platform without losing years of records or retraining a firm over a weekend. For firms whose core tool has outlived its maker.

• Data protection

  Bringing a system up to UK GDPR properly

  Adding subject access tooling, retention enforcement, deletion that reaches backups, consent records and an audit trail that cannot be edited to a platform built before anyone asked. An ICO enquiry, a client audit or a new DPO is usually the trigger. For teams facing a data protection review or a client due-diligence audit.

• Extension

  Building around the system of record

  Portals, dashboards and custom modules over a practice management system, a CRM or a booking platform, so the core stays put and the retyping around it disappears. Plugin, a tennis club management platform, took bookings, members and payments into one system and cut double-booked courts sharply. For firms extending rather than replacing a core system.

1. 01

   Financial services and fintech in the City and Canary Wharf

   Client onboarding, KYC workflow, operations tooling and reporting for asset managers, brokers, payment firms and lenders. Four-eyes approvals, segregation of duties and a complete audit trail shape the build, and where the firm is FCA-authorised the operational resilience and third-party expectations decide how we document what we run.

2. 02

   Law, accountancy and professional-services partnerships

   Matter and engagement management, conflict checks, client portals, time and billing integrations and document workflows for firms from the Magic Circle down to a ten-partner practice in Holborn, where confidentiality is the product and the audit trail proves it.

3. 03

   Media, publishing and production

   Subscription and paywall platforms, rights and asset management, production scheduling and the integrations between them for the publishers, studios and agencies around Soho, Fitzrovia and King’s Cross.

4. 04

   Retail and e-commerce

   Order management, stock across stores and warehouses, returns, supplier portals and the customer-facing storefront integrations for the brands headquartered in London, with card data kept out of your code by tokenising at the payment provider.

5. 05

   Proptech and property management

   Tenant and landlord portals, lettings and block-management workflows, compliance certificate tracking and maintenance scheduling for the agencies and platforms managing property across the boroughs.

6. 06

   Healthtech and private healthcare

   Booking, triage, patient portals and clinician tooling around an existing clinical system for private clinics, digital health start-ups and the suppliers that sell into the NHS, built with the Data Security and Protection Toolkit standards in mind where NHS data is in scope.

Not on the list? The opening question does not change: what does a day of this work look like, and at which point does it break?

1. 01

   UK GDPR and the Data Protection Act 2018

   Any London system holding personal data sits under the UK General Data Protection Regulation and the Data Protection Act 2018, enforced by the Information Commissioner’s Office. The principles that reach the code are lawful basis, purpose limitation, data minimisation, storage limitation, integrity and confidentiality, and accountability, along with the rights of access, rectification, erasure, restriction, portability and objection. The Data (Use and Access) Act 2025 amends parts of this regime, and its provisions commence in stages, so the position is re-verified before each publish. For software that means a data inventory that matches what the system actually stores, retention rules enforced by the system rather than remembered, deletion that reaches backups and exports, subject access answered from the system inside the statutory period, consent records where consent is the basis, and an audit trail that shows who read a record as well as who changed it. Where we process personal data on your behalf we sign your processor terms under Article 28, and where data leaves the UK, the transfer mechanism is agreed with your DPO before any data moves. Lawful basis, whether a data protection impact assessment is needed, and the transfer position for a supplier in India are decisions for your DPO and your counsel. What we build is the machinery that lets you honour the decisions they make. Sources: UK GDPR · Data Protection Act 2018 · Data (Use and Access) Act 2025 · Information Commissioner’s Office.

   Personal data

2. 02

   FCA expectations for regulated firms

   A firm authorised by the Financial Conduct Authority is expected to identify its important business services, set impact tolerances and show it can remain within them through disruption, and to retain oversight and control of the third parties that support those services. For software that means the system has to be documented, monitored, recoverable and auditable in a way the firm can evidence to its regulator, and the supplier has to be someone the firm can actually oversee. We build to that: tested backup and restore, staged releases with rollback, monitoring with alerting your operations team receives, access logs the firm can inspect, and a written description of what we run that fits into your third-party register. Where a firm asks for exit provisions, the code, the infrastructure definitions and the documentation are already in the firm’s name, so exit is a handover rather than a migration. Whether an arrangement is material, and what your firm must notify or record, is for your compliance function. We supply the evidence and the contractual terms your policy requires, and we say plainly where we cannot meet a requirement. Sources: FCA Handbook SYSC 15A (operational resilience) and SYSC 8 (third-party arrangements) · Financial Conduct Authority.

   Financial services

3. 03

   PCI DSS, kept out of your codebase

   The simplest way to handle card data is never to hold it. We tokenise at the payment provider, so the card number is captured by the provider’s hosted field or SDK and your platform stores a token, the last four digits and a scheme. Your application never sees a primary account number, which keeps most of PCI DSS scope out of the code we write. Responsibility under PCI DSS stays with your firm, and the self-assessment questionnaire you complete depends on how payments are taken. We keep the scope as small as the design allows and flag any feature that would grow it. Sources: PCI DSS v4.0.1 · PCI Security Standards Council.

   Payments

4. 04

   NHS Data Security and Protection Toolkit

   A supplier or system handling NHS patient data is expected to meet the standards of the Data Security and Protection Toolkit, the annual self-assessment against the National Data Guardian’s data security standards. For software that means role-based access with unique identities, an audit trail of access to patient records, encryption in transit and at rest, tested backups, patching discipline and a documented incident process, with the evidence produced by the system rather than assembled for the assessment. The Toolkit submission is your organisation’s, not ours, and whether a given dataset is NHS data in scope is a question for your information governance lead. We build to the standards and hand over the evidence they need. Sources: NHS Data Security and Protection Toolkit · NHS England · National Data Guardian data security standards.

   Health data

5. 05

   Cyber Essentials and supplier due diligence

   Many London buyers, and every public-sector one, ask their suppliers about Cyber Essentials and send a due-diligence questionnaire before signing. The engineers complete ours rather than a sales team, and the answers describe what we operate: least-privilege access, review-gated change management, environment separation, logging and retention, tested restores, staged releases, incident handling and offboarding when an engineer rolls off. If the truthful answer to a question is no, the questionnaire says no and names the compensating control. Suppliers who pad their answers tend to be removed from the shortlist at the final stage, and deservedly. Where your policy requires a specific certification from the supplier itself, raise it on the first call. You will get our current position in plain words, including where we fall short of the bar. Sources: Cyber Essentials scheme · National Cyber Security Centre.

   Vendor risk

We build systems that produce this evidence natively rather than bolting a compliance module onto software that resists it. Where an ICO enquiry, a client audit or a regulatory deadline drives your timeline, that date is where we plan backwards from.

1. 01

   The contract

   Your master services agreement and statement of work, governed by English law, with the jurisdiction, liability and termination clauses your counsel asks for. We never ask a London buyer to sign under Indian law, and we never run a project on an exchange of emails in place of a contract. This is a contract between two limited companies, not an engagement of an individual.

   English law

2. 02

   Currency, VAT and invoicing

   Invoices are raised in pounds sterling against the milestones or the monthly rate fixed in the contract, with your purchase order reference on each one. We are a supplier outside the UK, so the VAT treatment of our invoices is a matter for your accountant, and we provide whatever supplier details your finance team needs to record it correctly.

   GBP

3. 03

   Data protection terms

   Where we process personal data on your behalf we sign your processor terms, and the transfer position for a supplier in India is agreed with your DPO before any data moves. Where the work can be done on masked or synthetic data, we say so, because it removes the question entirely.

   Article 28

4. 04

   Intellectual property

   Everything produced for you, code, designs, documentation, infrastructure definitions, is assigned to your company at the moment it is created rather than when the last invoice clears. Repositories, cloud accounts and domains are yours from the first commit, and each engineer on the account has signed the same assignment and confidentiality terms.

   Assignment

5. 05

   Confidentiality

   A mutual non-disclosure agreement, on your firm’s template or ours, is signed before anything confidential is shared. We never name you, your product or your project as a reference without written permission.

   NDA

6. 06

   Insurance, questionnaires and vetting

   Certificates of insurance on request. Due-diligence questionnaires completed by the engineers who would do the work. Background checks on named engineers arranged through your process where your policy requires them, raised at contract stage because they add time before anyone can start.

   Due diligence

7. 07

   What the lack of a UK entity rules out

   There is no QalbIT entity in the United Kingdom, no London office and nobody we can send to Canary Wharf on a Tuesday. If a framework agreement, a client’s terms or a public-sector procurement rule requires a UK-established supplier or on-site delivery, we are simply not eligible, and we say so on the first call instead of discovering it after a proposal.

   The limit

Nothing above argues against a remote partner. It argues for doing the paperwork properly at the outset, which is why we raise every item on this list before the estimate and not after the signature.

• Backend and business rules

  • ✓Laravel on PHP 8 for modular business systems with a complete audit trail.
  • ✓Node.js and NestJS where integrations and event-driven flows dominate.
  • ✓Queues, schedulers and retries for syncs, alerts and end-of-day reports.

• Interface

  • ✓React and Next.js, rendered on the server where search traffic counts.
  • ✓Keyboard-first data entry for onboarding, case and operations screens.
  • ✓Flutter for a single iOS and Android codebase that works offline first.

• Data and integration

  • ✓PostgreSQL and MySQL with constraints that protect record integrity.
  • ✓Append-only audit trails and versioned records where evidence is demanded.
  • ✓REST and GraphQL connections to practice systems, CRMs and payment providers.

• Security and delivery

  • ✓AWS in your name and the London region, defined in Terraform.
  • ✓Logged least-privilege access, with any break-glass use reviewed after the fact.
  • ✓GitHub Actions pipelines with staged, reversible releases.

• A note on sourcing

  A note on sourcing

  You will not find market statistics here: nothing about London salaries, nothing about agency day rates, none of the project-failure percentages that circulate without a primary source. Every number on the page is either ours or a case-study outcome, and each one says where it came from. If one of them matters to your decision, ask for the source; we will send it or take the claim down.

1. 01

   The figures we can evidence

   We have delivered 120+ engagements for 50+ clients since 2018, hold a 5.0 on Clutch from 8 reviews and a 4.9 on Google from 18, and carry 100% job success on Upwork. Each of those can be checked on a public profile, which is why they are the only figures we put on a page.

2. 02

   Six live hours, the most of any market we serve

   09:00 to 15:00 UK time is inside our working day all year, which is 13:30 to 19:30 for us in summer and 14:30 to 20:30 in winter. Workshops, demos and decisions happen when you would hold them anyway, and a written handover goes out before we close.

3. 03

   We say what we are not

   No London office, no UK staff, no UK entity, and no implied presence anywhere on this site. The compliance and contract sections above exist because we would rather lose a deal at the scoping call than at the due-diligence review.

4. 04

   The proposal names the people who build it

   We do not subcontract, and we do not move engineers off your project to cover somebody else’s. The developers you interviewed are the developers whose names are on the commits, and the founder answers his own email rather than routing you through an account manager.

5. 05

   Proof from production, not promises

   The CyberFind vendor decision engine has run in production for four years, with 500+ verified CISOs and 2,000+ peer reviews on it and no rewrite since launch. Bloomford, a recruitment agency in Belgium, went from four inboxes to one pipeline. Plugin cut a tennis club’s double-booked courts sharply. The write-ups are on this site, including what we got wrong first.

• Services

  • Custom Software Development→
  • SaaS Product Development→
  • Backend Development→

• Case studies

  • CyberFind · 500+ Verified CISOs→

• How we would run it

  • Dedicated Team→
  • Staff Augmentation→

• Plan your project

  • Our Process→