Web App and Client Portal Build

What does the web app build cover?

A web app is any application your customers or staff log in to through a browser: a customer portal where clients see their invoices, documents and job status; a booking or quoting tool that talks to your existing systems; a dashboard that replaces the spreadsheet three people update by hand. It is the core app offering because it solves the most common business problem at the lowest cost.

Every build starts with the discovery and prototype sprint. The sprint fixes the requirements, the architecture and the price, and its fee is credited against the build if it proceeds within 30 days. We do not quote a portal off a phone call.

Why a web app before a mobile app?

Web apps, portals and dashboards cost 30–50% less than the equivalent mobile build, because they skip app store requirements and platform-specific code. There is no review queue between you and your users and no second codebase to keep in step. A change ships the moment it passes the test suite.

Most business apps do not need to be native. A customer checking an invoice, a tradesperson updating a job, a manager reading a dashboard: all of these work in a browser on a phone. When the product genuinely needs the phone itself, the camera, offline use or push notifications as the core experience, the iOS and Android app is the right build and the sprint will say so.

How is a client portal secured?

Portals for businesses handling customer financial or health data are the niche this service is built around, and security is where most portal builds quietly fail. The pattern is the same on every build:

• OAuth 2.0 authentication, with sessions managed on the server rather than in the browser.
• Backend-only tokens. Credentials for third-party services live on the server and never reach the client, so a compromised browser cannot leak them.
• IDOR prevention. Every request for a record checks that the logged-in user is allowed to see that record, not just that they are logged in. Changing an ID in the address bar returns nothing.
• Single-tenant deployment where the data warrants it, so your customers' records never share a database with anyone else's.

These are not features on a menu. They are checked by the security tests in the handover suite, and the CI pipeline refuses to deploy a build that fails them.

What is included in every build?

Test automation and release assurance are built into the price of every build above the discovery sprint. They are never an optional line and never negotiated away, because a portal without tests becomes expensive at the first regression. Every build includes:

• An automated end-to-end test suite in Playwright, handed over with the code
• API contract tests against every integrated service
• Load and rate-limit testing with K6 where third-party API caps apply
• Failure-mode coverage: token expiry, webhook retry, partial failure, duplicate delivery
• Security checks for IDOR prevention, no client-side tokens and backend-only credential handling
• A CI pipeline on GitHub Actions with the test suite gating deployment
• Test documentation the next developer can run without asking us

Where the portal must exchange data with an accounting system, CRM or booking platform in both directions, that work is scoped as a two-way sync integration and priced alongside the build, with the same contract and failure-mode tests.

What does a web app cost?

Builds are priced from $12,000 + GST. A focused portal with one user role, one integration and a handful of screens is the starting price. Bespoke workflow portals with logged-in areas, dashboards and multi-step processes start from $25,000 + GST. The sprint fixes the figure before any code is written.

Two costs are disclosed in every quote rather than discovered later. The first is compliance. Businesses turning over more than $3 million a year, or handling health information, fall under the Privacy Act 1988 and need a compliant privacy policy, data handling disclosures and reasonable security steps; that adds 10–40% depending on the data type. The second is third-party API usage after launch, which bills by volume: roughly $50 a month for a quiet app, four figures monthly for a growing one. Every third-party platform and API fee is named in the quote and who pays is settled in writing before work starts.

The app maintenance plan is quoted as a line item with every build from 15% of the build cost per year, so the running cost is on the page next to the build cost.

What you own when the build is handed over

Everything. The repository, the test suite, the CI configuration, the hosting accounts, the domain and the analytics are in your name from the first day, and the handover documentation is written for a developer who is not us. That ownership stance is the same across every service line, from the launch website build to the integration work. A tested build is cheaper to maintain, and a client with the tests is never hostage to the people who wrote them.