PROPELOO

CUSTOM SOFTWARE / PRODUCT ENGINEERING

Software built for your problem, not adapted from someone else's solution.

PROPELOO engineers custom software from first principles — from architecture design and API development through frontend, testing, deployment and long-term evolution. Off-the-shelf software is someone else's solution to someone else's problem. When your business process is your competitive advantage, the software that supports it should be engineered to match — not constrained to what a SaaS vendor decided to build.

The architecture decisions made in week two determine what the system can do in year two.

Most software projects do not fail because the developers were incompetent. They fail because the architecture was chosen for speed of initial delivery rather than correctness for the problem domain, because requirements were implemented without questioning them, because the data model was designed for the MVP and never revisited as the product scaled. A decision to build a monolith when the deployment model required independent scaling of components costs six months of re-architecture at the worst possible time. A data model designed for single-tenancy that needs to become multi-tenant requires a migration that touches every table. PROPELOO starts every engagement with the architecture — before a line of code is written — because the cost of getting it right early is always less than the cost of getting it wrong.

What full-stack custom software delivery looks like.

Custom software is not a single skill. It is a coordinated set of engineering disciplines that must all be executed correctly to produce a system that holds under production load.

System Layers

  • Architecture & Design Layer: System design, data modelling, API contract design, technology selection, ADR documentation
  • Backend Engineering Layer: Business logic, service design, database, queues, background jobs, integrations
  • Frontend Engineering Layer: Web application, admin interfaces, design system, performance optimisation
  • Infrastructure & DevOps Layer: Cloud infrastructure, CI/CD, monitoring, alerting, deployment automation
  • Quality & Security Layer: Automated testing, security review, performance testing, code review standards

Core Technical Capabilities

  • System Architecture

    Architecture design documented in Architecture Decision Records — technology selection justified against requirements, not habit. Monolith vs microservices, SQL vs NoSQL, synchronous vs event-driven — each decision justified and recorded.

  • API Engineering

    REST, GraphQL or gRPC APIs designed for the consuming client, not the implementation convenience. OpenAPI specification, versioning strategy, authentication, rate limiting and developer experience built in from day one.

  • Data Architecture

    Schema design that supports the access patterns of the application — not just the entities. Indexing strategy, query performance, migration management, caching layer and eventual data pipeline requirements all modelled before the first migration file.

  • Third-party Integrations

    Payment processors, identity providers, communication services, data providers and business system integrations — implemented with appropriate error handling, retry logic, webhook verification and graceful degradation.

  • Automated Testing

    Unit, integration and end-to-end test coverage with CI enforcement. Test strategy matched to system risk: high-coverage for business-critical paths, pragmatic coverage for supporting features. No feature ships without tests.

  • Deployment & Infrastructure

    Cloud infrastructure as code (Terraform), containerised deployment (Docker/Kubernetes), CI/CD pipeline, environment management, secrets management and monitoring from day one.

How we think about custom software.

The best software decision is often the one that eliminates the most future decisions. Simplicity is a feature. The monolith that ships in 3 months beats the microservices architecture that takes 8 months and breaks in ways you did not anticipate.

  • Monolith first, extract on pain

    A well-structured monolith is faster to build, easier to test, simpler to deploy and has fewer failure modes than a microservices architecture. Extract services when you have a specific scaling requirement that the monolith cannot meet — not as a default architectural choice. The majority of successful software products ran as monoliths at the scale where they found product-market fit.

    Axiom:

  • The data model outlives the code

    Application code is easy to change. Database schema is hard to change after data is in it. A data model designed correctly for the domain will outlast multiple rewrites of the application layer. A data model with the wrong abstractions will create friction in every feature built on top of it for the lifetime of the product. We spend disproportionate time on the data model — because it deserves it.

    Axiom:

  • API contracts are product decisions

    An API that is convenient to implement is not necessarily convenient to consume. API design must start from the client's perspective — what data does the client need, in what shape, with what latency? OpenAPI-first development, where the spec is written before the implementation, produces better APIs because the design is reviewable without running code.

    Axiom:

  • Delivery visibility prevents surprises

    A fixed-scope, fixed-price project with a single delivery date is a recipe for disappointment. Milestone-based delivery with working software at every milestone gives clients visibility into progress, allows course correction before significant rework is required, and aligns incentives toward shipping useful software rather than completing a specification.

    Axiom:

The decisions that define a software system.

These are the questions we work through in the architecture phase — before implementation begins.

  • Monolith vs microservices?

    Impact: Start with a modular monolith. Extract microservices only when you have a demonstrated need — specific scaling requirements, independent deployment velocity or team autonomy at scale. Premature microservices are the single largest source of unnecessary complexity in software projects.

    • Monolith — simple to build, test and deploy, harder to scale specific components independently
    • Modular monolith — internal module boundaries, single deployment, best of both for most applications
    • Microservices — independent scaling and deployment, network complexity, distributed system challenges
    • Serverless functions — low ops overhead, cold start latency, vendor lock-in
  • Synchronous vs event-driven?

    Impact: Event-driven architecture solves real problems — decoupling, resilience, audit trails — but introduces observability and debugging complexity. Use it where the problem justifies the complexity, not as a default.

    • Synchronous REST/GraphQL — simple, easy to debug, tight coupling between services
    • Async message queue (SQS, RabbitMQ) — decoupled, at-least-once delivery, harder to trace
    • Event streaming (Kafka) — ordered, replayable, high throughput, operational complexity
    • Hybrid — synchronous for reads, async for writes and side effects
  • SQL vs NoSQL?

    Impact: PostgreSQL with JSONB handles 90% of use cases that people reach for MongoDB for, with ACID guarantees and a mature ecosystem. Choose NoSQL when the access patterns genuinely require it, not for novelty.

    • PostgreSQL — ACID, flexible schema via JSONB, best default choice for most applications
    • MongoDB — document model, flexible schema, weaker consistency guarantees
    • DynamoDB — serverless, infinite scale, restrictive query patterns, high cost at volume
    • Right tool per domain — PostgreSQL for transactional, Redis for cache, Elasticsearch for search
  • Multi-tenancy data model?

    Impact: Retrofitting multi-tenancy into a single-tenant data model requires touching every table and query. Design for your final multi-tenancy model on day one, even if all initial tenants share a schema.

    • Shared DB, shared schema with tenant_id column — simplest, lowest cost, hardest to isolate
    • Shared DB, separate schema per tenant — good isolation, manageable at <1000 tenants
    • Separate DB per tenant — maximum isolation, highest cost and operational complexity
    • Hybrid by tier — shared for free/small tenants, isolated for enterprise tenants
  • Authentication approach?

    Impact: Authentication is not a differentiator. Use managed auth (Auth0 or Clerk) unless compliance requirements mandate self-hosting. Custom auth implementations have a poor security track record.

    • Managed auth (Auth0, Clerk, Supabase Auth) — fast, handles edge cases, ongoing cost
    • Self-hosted (Keycloak) — full control, operational burden, appropriate for compliance requirements
    • Custom JWT implementation — maximum flexibility, high implementation risk if done incorrectly
    • Social auth only — zero password management, limits to OAuth providers
  • API design approach?

    Impact: REST with OpenAPI is the right default for public or partner-facing APIs. GraphQL is justified for complex, multi-client data requirements. tRPC is excellent for TypeScript monorepos with shared frontend/backend. gRPC for internal microservice communication.

    • REST with OpenAPI spec — universal, well-understood, good tooling
    • GraphQL — client-defined queries, good for complex data graphs, over-fetching prevention
    • tRPC — end-to-end type safety for TypeScript full-stack, internal APIs only
    • gRPC — performance, strong typing, ideal for backend-to-backend communication

What PROPELOO builds.

  • SaaS Product Engineering

    Full-stack SaaS from architecture through multi-tenant data model, subscription billing, admin portal, API and deployment — built to scale from 100 to 100,000 customers without re-architecture.

  • Enterprise Internal Tools

    Custom internal applications replacing spreadsheets, legacy systems or off-the-shelf tools that do not fit the workflow — with SSO integration, audit logging and role-based access control.

  • API Platform

    Public or partner-facing API products — OpenAPI-first design, developer documentation, API key management, rate limiting, usage analytics and webhook infrastructure.

  • Platform Migration

    Legacy system migration to modern architecture — strangler fig pattern, zero-downtime migration strategy, data migration pipeline and parallel-run validation before cutover.

  • Marketplace / B2B Platform

    Two-sided marketplace with buyer/seller workflows, transaction management, review system, commission accounting and the notification infrastructure that keeps both sides engaged.

  • Operational Systems

    Complex operational software — logistics management, scheduling systems, inventory platforms — where the business logic is intricate and the cost of errors is real.

The stack follows the problem.

We have no preferred vendor. We have preferred outcomes. Every technology choice is justified against the specific requirements of your system.

  • Backend

    Stack: Node.js (TypeScript), Go, Python, Rust (performance-critical), PostgreSQL, Redis, Kafka

  • Frontend

    Stack: React, Next.js, TypeScript, Tailwind CSS, Tanstack Query, Zustand

  • API

    Stack: REST + OpenAPI, GraphQL (Apollo/Pothos), tRPC, gRPC, WebSockets

  • Infrastructure

    Stack: AWS, GCP, Terraform, Docker, Kubernetes, GitHub Actions, ArgoCD

  • Auth & Payments

    Stack: Auth0, Clerk, Stripe, Paddle, Supabase, Keycloak

  • Observability

    Stack: Datadog, Prometheus + Grafana, Sentry, OpenTelemetry, PagerDuty

Security is a design constraint, not a post-launch review.

Every engagement includes security as a standard part of delivery.

  • Authentication & Authorisation

    Secure session management, JWT handling with appropriate expiry and rotation, RBAC implementation at the API layer (not just the UI), and OAuth 2.0/OIDC integration with established providers. Authorisation logic belongs in the backend service layer, validated on every request — not only in the UI where it can be bypassed.

  • Input Validation & Injection Prevention

    SQL injection via parameterised queries (never string concatenation), NoSQL injection prevention, XSS prevention via output encoding, CSRF protection, file upload validation and rate limiting on all user-facing endpoints. Input validation at the API boundary, not only in the database layer.

  • Secrets Management

    No secrets in source code or environment variable files committed to version control. AWS Secrets Manager, HashiCorp Vault or similar for production secrets. Secrets rotation without downtime. Least-privilege IAM roles — application services access only the resources they need.

  • Dependency Security

    Automated dependency scanning (Dependabot, Snyk) in CI pipeline. Regular security audit of the dependency tree. Pinned versions for production dependencies. No development dependencies in production builds. Supply chain attacks via compromised npm packages are an active threat.

  • Data Encryption

    Encryption at rest for sensitive data fields, not just full-disk encryption. TLS 1.3 in transit with HSTS. Appropriate key management — encryption keys separate from encrypted data. PII fields identified and treated with appropriate access controls, retention limits and deletion capability for GDPR compliance.

  • Threat Modelling

    STRIDE threat modelling at the architecture phase — identifying trust boundaries, data flows and potential attack vectors before implementation. Not every threat requires mitigation, but every threat should be explicitly acknowledged and the risk acceptance documented. Threats discovered during development are 10x cheaper to address than threats discovered post-launch.

How we deliver custom software.

  1. 01. Discovery & Architecture

    Requirements workshop, domain modelling, system architecture design, technology selection and milestone plan. Deliverable: architecture document and project plan.

  2. 02. Foundation Sprint

    Project scaffolding, CI/CD pipeline, development/staging environments, database schema, authentication, and core API structure. The boring infrastructure that everything else depends on.

  3. 03. Core Feature Development

    Feature development in two-week sprints with working software demonstrated at the end of each sprint. Every sprint ends with deployable, tested code — not just completed tickets.

  4. 04. Integration & QA

    Third-party integrations, end-to-end test suite, performance testing under realistic load, security review and UAT with the client.

  5. 05. Production Deployment

    Zero-downtime production deployment, monitoring setup, alerting configuration, runbook documentation and on-call handoff.

  6. 06. Stabilisation

    Post-launch bug fix period with SLA-backed response times. Performance monitoring, user feedback integration and optimisation of the highest-impact bottlenecks.

  7. 07. Long-term Partnership

    Ongoing development retainer, feature velocity maintenance, dependency upgrades, security patching and architectural evolution as the product and business scale.

Frequently Asked Questions

How do you scope a project without a complete specification?

We run a paid discovery sprint — typically 5–10 days — that produces an architecture document, data model, API contract design, technology stack justification and milestone plan. This document becomes the contract baseline and significantly reduces scope risk for both sides. Projects that skip discovery and go straight to development almost universally experience scope disputes and re-architecture costs that dwarf the cost of a proper discovery phase.

What is your development methodology?

Two-week sprints with working software demonstrated at the end of each sprint. Requirements are prioritised into a backlog and refined at the start of each sprint. Changes to requirements are processed via a change order that documents scope, effort and timeline impact — not silently absorbed until they cause delays. We do not use daily standups as a progress reporting mechanism; we use asynchronous video updates and a shared delivery board updated daily.

Who owns the intellectual property?

You do, unconditionally and from day one. Every deliverable — code, architecture documentation, design files, database schemas, infrastructure configuration — transfers to you at the milestone it is invoiced. We retain no licence, no attribution requirement and no ongoing dependency. You can take the codebase and work with any development team after our engagement ends.

How do you handle changing requirements?

Requirements change — this is normal and expected. Any change to agreed scope is processed as a change order: we document what is changing, estimate the effort impact, agree the timeline adjustment and confirm before work begins. This is not bureaucracy — it is the mechanism that prevents "just a quick change" from accumulating into months of unacknowledged delay. We welcome changes when they are managed transparently.

Do you work with our existing codebase?

Yes. Before committing to a scope of work on an existing codebase, we conduct a code review to understand its current state, identify technical debt that will affect delivery speed, and assess whether the architecture supports the planned features. We are honest about what we find — a codebase in poor condition takes longer to work in than a clean one, and that must be reflected in the timeline estimate.

What happens after launch?

We offer structured post-launch support: a 30-day stabilisation period with SLA-backed response for production issues is included in every project. After that, we offer a development retainer for ongoing feature development and maintenance, or a support-only contract for security patching and dependency management. We do not disappear after the invoice is paid.

How do you ensure the system can scale?

Scalability is designed at the architecture phase, not added after the fact. We design the data model, caching strategy, background job architecture and API design to support the scale the product will need at 12-18 months of growth — not just what it needs on launch day. Horizontal scaling via stateless services, database connection pooling, Redis caching of expensive queries and async processing of non-critical operations are standard patterns in every production system we build.

Can you build both the backend and frontend?

Yes. Full-stack delivery — backend API, frontend web application and mobile app if required — under a single team is more efficient than coordinating between separate backend and frontend vendors who blame each other when APIs do not match the frontend requirements. We use TypeScript end-to-end where possible to share type definitions between client and server, reducing API contract mismatches.