← All expertise

03

Custom applications

Portals and apps for the people at the desk and the people in the field

We don't start from the screens. We start from who the actors are, what they may see and what happens when they get it wrong: the data model, the permissions and — last — the interface follow from there.

From the problem to the application
  1. Actors and permissionsWho they are, what they may see and what happens when they get it wrong
  2. Data modelThe entities and the boundaries between companies, before any screen
  3. Clickable prototypeTouched and discussed before building, while changing is still cheap
  4. Development in slicesEvery slice reaches someone's hands and brings an opinion back
  5. Automated testsThe paths that matter are repeated on every change
  6. Release and measureIn production with the numbers in view, not on a hunch

The database decides who sees what

In a platform used by several companies the real question is not how the client list looks, but what happens the day a query forgets the company filter. If the check lives only in the code, that day one customer sees another customer's data and nobody notices.

So isolation goes inside PostgreSQL, and the application connects with a role that cannot bypass it. Code can be wrong; the database cannot. The permission becomes readable, revocable data instead of a branch scattered across thirty files.

Fast from the first paint, in every language

Pages arrive already rendered from the server: it matters for the reader, who sees them at once, and for Google, which doesn't run JavaScript. The browser only takes over the parts that genuinely need to react.

Multilingual is structure, not translation bolted on: clean addresses per language, reciprocal links between versions and an explicit decision about what to show when a translation is missing.

For the people working away from a desk

The mobile app is the edge of the system: the point where data is born. If it is comfortable there, everything downstream works; if it is awkward, people go back to paper and the ERP tells a false story.

It has to survive gloves, sunlight, hurry and one free hand: few taps for the most frequent action, large type, clear confirmations. One codebase for iOS and Android, and where value or identity is involved, credentials stay inside the device's secure enclave.

Portfolio

What we did on this, project by project.

SOS Bollette

CRM for a network of energy agencies

  • A three-level model — network, company, person — where the tool perimeter is data owned by the network: a menu entry the partner doesn't have is never drawn.
  • Isolation enforced by the database through row-level policies and an application role that cannot bypass them; the head office is a company with a different kind, not a privileged code path.
  • Passwordless access: email links and passkeys, with sessions that remember which company you are working on.
  • Full Italian tax profile (VAT number, tax code, SDI, certified email), company sheet read-only for operators who are not owners.
  • Next.js
  • React
  • Prisma
  • PostgreSQL
  • Tailwind
  • Playwright

ASC Buildings

Site app for a construction company

  • Flutter app for construction site access management, designed for use on the move by people who are not sitting at a computer.
  • Direct link to the company's ERP: what is recorded on site reaches the back office already assigned to the job.
  • Flutter
  • Dart
  • iOS and Android
  • Odoo

Manora

Mobile wallet of a blockchain platform

  • Cross-platform app to operate on the chain: balances, transfers, history and multilingual notifications.
  • Private keys never leave the device's secure enclave and biometric confirmation is mandatory to sign.
  • On-device integration tests beyond unit tests, because on a wallet a mistake cannot be patched the next day.
  • Flutter
  • Dart
  • secure enclave
  • biometrics

BigFishIta

This site: showcase, blog and private area

  • Canvas hero with 300 frames following the pointer, progressively loaded and with an alternative for people who ask for reduced motion.
  • Bilingual blog on PostgreSQL with a block editor in the private area: SEO, tags, scheduled publishing.
  • Private area protected with mandatory second factor.
  • Next.js
  • PostgreSQL
  • Drizzle
  • Docker

Need this?

Tell us the problem and we'll tell you how we would tackle it — and if it isn't worth doing, we'll tell you that too.

Let's talk