Scope of works

Customer-facing web apps, server-rendered with HTMX and Alpine.js so they load fast on a phone on a bad connection and still feel instant. Ordering, booking, accounts, self-service.

Order management, stock, billing, reporting, approvals, and the role-based admin that every business needs and nobody budgets for. We have built point of sale, payroll and operations portals from scratch, so we know where the bodies are buried.

Marketing sites and e-commerce where you edit pages, menus, products and theme colours yourself. No developer on the critical path for a price change.

Headless REST APIs with django-ninja or NestJS when a separate front end, a mobile app or a partner needs to talk to the system. Documented with OpenAPI, versioned, authenticated with keys or sessions.

Home-screen icon, full-screen, service worker, one codebase. Our POS terminal, barista app and customer ordering app all ship this way and behave like native apps on the devices people actually own.

Interfaces designed for one hand, poor light and a hurry: tills, clock-in stations, checklists with photo evidence, stock-take flows. Big targets, few taps, obvious state.

When the brief needs hardware access or app-store distribution that a PWA cannot give, we scope a native iOS and Android build on top of the same API. We will tell you plainly if you do not need one.

One PostgreSQL schema per tenant where isolation matters most, or row-level security in a shared schema where scale matters more. We have shipped both and can explain the trade-off in ten minutes.

Flat plans, commission models, usage limits and add-on modules, decided at runtime by an entitlement engine so a plan change is configuration, not a deployment. Recurring billing via Paystack or Stripe.

Tenants on their own subdomain or their own domain, with certificates issued automatically when they point DNS at you. Per-tenant logos, colours and e-mail templates.

Role-based access per organisation, invitations, MFA, session revocation and append-only audit trails. The admin console the founder needs on day one, not in year two.

Yoco, PayFast, Stripe, Paystack, iKhokha and Stitch. Webhooks that survive retries, reconciliation, refunds, and per-country routing when one platform serves many markets.

Twilio WhatsApp Business API with approved templates, signed webhooks and inbound automation. Transactional e-mail through Resend, SendGrid or Mailgun with proper domain authentication.

Xero sales exports that tie out to the cent, Sage Accounting timesheets, SARS-compliant VAT, bank EFT file formats for the major South African banks, EMP201 and IRP5 outputs.

Courier APIs for live rates and tracking, espresso-machine telemetry, water-quality sensors and biometric clock-in terminals over their LAN protocols. If it has an API we will integrate it; if it does not, we will reverse-engineer it and document what we find.

ECS, RDS, WAF and multi-account landing zones with Control Tower, all in CDK. Separate accounts per environment and, for enterprise customers, per tenant. Deploys through GitHub Actions with OIDC, no long-lived keys.

A single well-kept VM with nginx, systemd and PostgreSQL is a legitimate architecture for a great many businesses. We will not sell you Kubernetes for a coffee shop.

CI that runs the tests, scans dependencies and secrets, builds one image and promotes that same verified image from development through QA and staging to production.

Sentry, CloudWatch, uptime checks and a post-deploy gate that confirms the thing actually works before the pipeline goes green. A runbook you can follow at 2 a.m.

From a findings report to a closed-out evidence pack: triage, fixes, regression tests, and the management summary the auditor asks for.

Schema separation, PostgreSQL row-level security, and access checks that run before any data is touched. Tested with a harness that tries to read across tenants and must fail.

MFA, session management and revocation, WAF rules, rate limiting, dependency and secret scanning in CI, and POPIA-aware handling of personal information.

Our open-source, agentless posture and SBOM tool for Linux fleets. Self-hosted, SSH-based, nothing leaves your network. Sheet P-08.

Bills, leases, invoices and statements read into structured data, validated against the printed totals so a model cannot quietly drop a digit or a minus sign.

WhatsApp orders and support requests parsed into orders and tickets, with a human confirming anything the model is unsure about.

We call model APIs directly through OpenRouter or the provider. No agent frameworks, no vector database unless retrieval is the actual problem, and no AI feature that does not have a measurable job.