National clinical registry modernised
A national clinical registry rebuilt behind a strangler pattern, with the data migration reviewed and signed off line by line, and 14 clinics onboarded in the first wave.
Capability · Epcotec
Web products built by one senior team.
Full-stack web apps, portals, APIs, dashboards: React/Next.js, Node, Python, Go. Delivered by named senior engineers, fixed scope, staging from week one.
Epcotec designs and builds production web applications for Australian businesses: customer portals, internal dashboards, APIs and complete products in React, Next.js, Node and Python. Named senior engineers deliver in two-week sprints with a staging environment from week one, tests and documentation included, and full IP transfer at handover. Scope and fixed price are agreed before we build, and a written estimate follows a free scope review.
What we deliver
The build scope.
Full-stack portals and dashboards
Role-based portals and operational dashboards built end to end, from data model to interface, on React and Next.js frontends with Node, Python or Go services behind them.
Typed REST and GraphQL APIs
Versioned, documented APIs with generated types shared end to end, contract tests in CI, and load budgets agreed with callers so integrations do not surprise anyone at launch.
Design systems and accessible frontends
Component libraries in React and Next.js with keyboard paths, contrast and screen reader behaviour tested, so accessibility holds as the product grows.
Realtime dashboards and live views
Live operational views over WebSockets and server-sent events, with backpressure, reconnection and stale-data states designed, so the board stays honest when the feed slows or drops.
Progressive modernisation of legacy UIs
Strangler-pattern migration that replaces screens module by module behind one domain, keeping the old system running until each piece is proven, with rollback planned before cutover.
Plain-language interfaces
Interface copy written for first-time users and auditors alike, free of internal jargon, with error messages that say what happened and what to do next, in plain words.
Rough time estimate
Window: 4-12 weeks
Team: 2 full-stack engineers
Complexity: M
Indicative only. A fixed price follows a free scope review.
Get a fixed quoteDelivery process
Cadence and checkpoints.
Week 0-1 · Discovery & fixed-scope SOW
Scoping sessions on users, workflows and integrations, then a fixed-scope statement of work with milestones, load budgets and the acceptance criteria your team will sign against.
Week 1-3 · Architecture & design system
Data model, service boundaries and the component library agreed early, so screens are assembled from tested parts each sprint.
Week 1-5 · Weekly demos, staging from week one
Staging runs from week one and demos land every week, so direction is corrected on working software in days.
Week 4-10 · Hardening, accessibility & load tests
Security review, accessibility audits with keyboard and screen reader passes, and load tests against agreed budgets, with every finding fixed and re-verified before we call it done.
Week 10-12 · Handover & 30 days support
Runbooks, monitoring and architecture notes handed over with a walkthrough session, then 30 days of support while your engineers take the pager.
Benchmark deliveries
Web builds, shipped and kept.
Exactly-once market data pipelines
Go pipelines moving market data with idempotent offsets giving exactly-once processing semantics, verified by reconciliation, so no feed produced duplicates or gaps under broker restarts.
ERP overlay integration layers
Overlay integration layers built on the strangler pattern, adding modern portals and workflows over ERP systems without forking master data, decommissioned modules tracked and retired on schedule.
More evidence in the delivery history and the complete 756-engagement register.
Standards & compliance
Secure, accessible, and owned by you.
Operations and deliverables conform to the cross-cutting standards below, and every application is built through a documented secure development process, targeted at WCAG 2.2 AA and handed over with clean intellectual property.
ISO/IEC 27001-aligned information security management
Operations and deliverables run under a documented management system aligned with ISO/IEC 27001:2022. The controls shape scoping, review, change management and evidence capture on every engagement.
Australia: Governs every Australian engagement, including hosting decisions and data residency.
Canada: Governs every Canadian engagement, including hosting decisions and data residency.
ISO 9001-aligned quality management
Quality management aligned with ISO 9001 governs scoping, review gates, acceptance criteria and handover, so every deliverable passes the same documented checks.
Australia: Applies to delivery for Australian clients across all service lines.
Canada: Applies to delivery for Canadian clients across all service lines.
Privacy Act 1988 and Australian Privacy Principles
Personal information handled in Australian engagements is processed in line with the Australian Privacy Principles, with access controls and data-handling rules carried through every environment.
Australia: Applies to all Australian engagements and to data processed on behalf of Australian clients.
PIPEDA and provincial privacy law
Personal information handled in Canadian engagements is processed in line with PIPEDA and applicable provincial law, including Quebec Law 25 where relevant.
Canada: Applies to all Canadian engagements, with Quebec Law 25 obligations observed where data or operations touch Quebec.
SOC 2-aligned controls
SOC 2-aligned controls are embedded in delivery: change management, access control, monitoring and evidence capture run on every engagement.
Australia: Evidence packs are available to Australian clients under NDA.
Canada: Evidence packs are available to Canadian clients under NDA.
Secure development standard
Every change passes documented review gates before merge; named engineers review, approve and own what ships.
Australia: Personal information handled in builds and staging environments is processed under the Australian Privacy Principles.
Canada: Personal information handled in builds and staging environments is processed under PIPEDA.
Accessibility and ownership
Interfaces are built to a WCAG 2.2 AA target, and all source code and intellectual property are assigned to the client on delivery.
Australia: Accessibility targets apply across Australian public-sector and enterprise builds.
Canada: Accessibility targets apply across Canadian public-sector and enterprise builds.
References to standards describe alignment. Certification is claimed only where an accredited certificate is published on this page.
FAQ
Questions before you sign.
How do you keep scope and price fixed?
Discovery ends in a signed statement of work with milestones and acceptance criteria. Changes are handled as explicit variations, so the agreed price stays the agreed price.
What does staging from week one mean in practice?
A running environment exists by the end of week one, and every weekly demo happens on it. You review working software on real data paths, not mock-ups or slide decks.
How do you handle accessibility compliance?
Keyboard paths, contrast and screen reader behaviour are tested as part of the build, with audits in the hardening phase and every finding fixed before handover, evidenced in writing.
Who owns the code and can we maintain it?
You own everything, including infrastructure definitions and tests. Handover includes runbooks, architecture notes and a walkthrough, followed by 30 days of support while your team takes control.