Web platform development in Bengaluru
A pattern we see often in Bengaluru: a B2B platform that grew up selling to Indian small businesses, where one admin login per customer was enough, now closing its first enterprise or GCC account. The new customer wants single sign-on, custom roles, a record of who changed what and confidence that one tenant can never see another's data. The existing permission model is a role column and a handful of if statements.
We redesign authorisation before it becomes an incident. Tenancy enforced in the data layer rather than remembered in every query, roles and permissions that the customer's own admin can manage, SSO through SAML or OIDC, an activity log, and an impersonation view so your support team can see what the user sees without asking for their password. The work happens inside your Next.js application, in increments that ship, so the enterprise deal does not wait for a rewrite.
Bengaluru is where we live and work, so this page is less a pitch than a description of the market we see every week. The defining fact about it is that startups and global capability centres, the in-house engineering offices of foreign companies, are competing for the same engineers. A GCC can offer a larger salary, a guaranteed bonus and a stable employer. A Series A startup offers equity and a harder job. The engineer you want usually has more than one offer, a notice period to serve, and a counter-offer waiting. So the roadmap slips while the hiring plan catches up.
The companies that call us here come in a few recognisable shapes. Startups whose first backend was written by an engineer who has since left, often for one of those GCCs. SaaS companies built in Bengaluru and sold to customers in the US and Europe from the first year, now closing their first enterprise account and the feature list that comes with it. Deep tech teams in space, robotics, semiconductors and applied AI, where the core work is research or hardware and the software around it, the dashboards, device APIs and data pipelines, is nobody's job. And GCC leaders who need a working proof of concept before headquarters will approve the headcount to build the real thing.
What they need built is usually a defined piece rather than a whole product. A backend mapped, documented and made safe to change. Single sign-on, custom roles and tenant isolation for the enterprise deal. A device API and a dashboard for a robotics team whose engineers would rather be working on the robot. A proof of concept a GCC can demo to its parent company. We build those in your repository, in increments that ship, and write the architecture notes and runbooks as we go, so whoever you hire next can read them in their first week.
We share your time zone, so the working day is the same on both sides and a question asked in the morning is answered in the morning. Because we are in the same city, a kickoff or an architecture session can happen at your office rather than on a call. Most of the work still happens in writing, in your repository and your chat, because a decision written down survives the people who made it.
We are the right fit when you have a defined piece of work and want a senior engineer on it this month rather than after a hiring round. Start with a fixed-price two-week piece and judge us on what ships. We also cover the months before your next hire joins, and work white-label for Bengaluru agencies under your name.
Four ways this arrives.
We replace the role column with a permission model that can express teams, access to individual resources and roles the customer defines, add SAML or OIDC sign-in, and write the audit log their security questionnaire will ask about.
Or very nearly did. We find every query that can cross a tenant boundary, enforce the tenant in one layer rather than in every handler, and add tests that try to read across that boundary on purpose.
We build the admin side properly: search across organisations, an audited view-as-user mode, and screens for access and usage. Support stops asking an engineer to run a query against production every time a customer says something looks wrong.
An early Next.js app with auth stitched into middleware, a custom server, and a release process that lives in someone's head. We move it forward in small steps, with preview environments and a pipeline anyone on the team can ship from.
A Next.js platform scoped per organisation, where an administrator can view the app as any other user and each Tableau report opens only for people granted it.
Read the write-up →Asked by Bengaluru teams.
Can we meet in person?+
Yes. We are in Bengaluru, so a kickoff, a design review or a whiteboard session at your office is easy to arrange. We share your time zone, so calls happen inside your normal working day. Day to day we work in your tools, Slack, GitHub and Linear or whatever you already use, and you talk directly to the engineer writing the code. In-person time is best spent on the first architecture discussion and the handover.
Do you build for Bengaluru SaaS companies selling abroad?+
Yes, and it is one of the most common pieces of work we see here. We build what the first overseas enterprise customer asks for: single sign-on, custom roles, tenant isolation that holds under a missing filter, a log of who changed what, and billing through Stripe that copes with several currencies. The work happens inside your product, in increments that ship, so the deal keeps moving while the list gets shorter.
How does your rate compare to hiring in Bengaluru?+
PayScale puts a mid-career software engineer in Bengaluru at about ₹18 lakh a year. Our published rate is $35 an hour, with a $5,000 minimum. For that you get a senior engineer who writes the code, works in your Slack, GitHub and Linear, and starts within days, with no recruiting round, notice period or employment overhead. Begin with a fixed-price two-week piece at $2,800 and judge us on what ships.
We keep losing engineers to GCCs. How can you help?+
We add senior capacity while you rebuild the team. An engagement starts within days, so the roadmap keeps moving through the notice periods and counter-offers. We take a defined piece of work, ship it in your repository, and write the architecture notes and runbooks your next hire reads in their first week. The code belongs to you from the first commit, so picking it up later is a conversation, not a project.
What is wrong with a role column?+
Nothing, until you have more than one kind of customer. A role says who a user is; most real questions are about what they can do to one specific thing, inside one specific organisation. Encoded as role checks, every new requirement becomes a code change in many places. We model permissions as data, check them in one place, and test them like any other logic.
Should we use an auth provider or build our own?+
Use a provider for identity: passwords, magic links, SSO and multi-factor. It is a solved problem and getting it wrong is expensive. Authorisation, meaning what a signed-in user may do, is specific to your product and usually belongs in your own code and database. We wire the first to the second and keep the line between them clear.
How do you handle multi-tenancy?+
Usually one database with a tenant ID on every row, enforced in one place: Postgres row-level security, or a data-access layer every query has to pass through, rather than each handler remembering. A separate database per tenant is sometimes right, for one very large customer or strict isolation, and we will say if that applies to you.
Where does it get hosted?+
Wherever suits your team. Vercel is the least effort for Next.js and fine for most platforms. If cost or long-running background work make that awkward, we run it in containers on Railway, AWS or your own Kubernetes. The repository, the cloud accounts and the bill are in your name either way.
What do enterprise customers ask for, and can you build it?+
Single sign-on through SAML or OIDC, audit logs, role management, session controls, encryption and data export. We build each of them into the platform and help you answer the technical questions on a customer's checklist accurately, so the security conversation speeds the deal up instead of stalling it.