Web platform development in Boston
Selling a web platform to universities, as many Boston edtech companies do, means every new customer arrives with its own identity provider, its own term calendar and its own idea of who counts as an instructor. A teaching assistant can grade one section but not another. A department administrator sees every course in the department and no student's grades. Each new institution is a slightly different organisation chart, and the platform has to take it on without a code change.
We build that model as data rather than role checks spread through the code: institutions, departments, courses, sections and the relationships between people and each of them, checked in one place, in Next.js and TypeScript over Postgres. Sign-in goes through each university's SAML provider, with no separate password system to maintain. Every view or change to a student's record is logged with who and when, which your support team needs when a grade changes and nobody knows why, and which a university's IT team will ask about before it rolls the platform out to every department.
Boston's software buyers mostly work in science, medicine, education and money: biotech and pharmaceutical companies in Cambridge and the Seaport, the hospital systems, digital health start-ups, the universities and the companies spun out of them, and the asset managers and insurers downtown. In most of them, software supports something else, an experiment, a patient or a portfolio. The people who commission it are often scientists and clinicians, many of whom write some code themselves and know exactly what they need the data to do. What they want from an engineer is not a new idea. It is the idea they already have, made reliable.
The work follows the science. Biotech labs need instrument output picked up as it lands and linked to the notebook entry that explains it, and internal tools that stay fast on thousands of assay results. Digital health companies need a backend that can read from a hospital's records system, and patient apps that save offline and keep the time each entry was made. Edtech companies selling to universities need platforms that know a teaching assistant from a department administrator. Lab suppliers need commerce that runs on purchase orders and negotiated prices, and the investment firms downtown need internal tools to replace the workbooks that run their operations.
Hiring has its own shape. Built In puts the average software engineer base salary in Boston at about $137,000, and the city's engineers are pulled between big tech offices, well-funded biotech and university spin-outs. The universities keep research talent in good supply. What teams more often lack is someone who has taken a system from a notebook or a prototype to something that runs unattended, is monitored, and survives its author going back to the lab. That gap, between a result that works once and a system that keeps working, is where we are most useful.
We are in Bengaluru and move our working day for Boston. Four hours of every working day overlap with your morning in Eastern time, stand-up included, so questions, reviews and decisions happen live with the engineer who writes the code. Runbooks and architecture notes are written as we go, so the system keeps running when the people who commissioned it go back to the lab.
We are the right fit for the gap between a result that works once and a system that keeps working: a pipeline, a hospital integration, a patient app, an internal tool. Senior capacity starts within days, the first piece is a fixed-price two-week engagement, and it can carry you from a funding round or grant to your first engineering hire.
Four ways this arrives.
We replace the role column with a permission model that can express teams, access to individual resources and roles the customer defines, add SAML or OIDC sign-in, and write the audit log their security questionnaire will ask about.
Or very nearly did. We find every query that can cross a tenant boundary, enforce the tenant in one layer rather than in every handler, and add tests that try to read across that boundary on purpose.
We build the admin side properly: search across organisations, an audited view-as-user mode, and screens for access and usage. Support stops asking an engineer to run a query against production every time a customer says something looks wrong.
An early Next.js app with auth stitched into middleware, a custom server, and a release process that lives in someone's head. We move it forward in small steps, with preview environments and a pipeline anyone on the team can ship from.
A Next.js platform scoped per organisation, where an administrator can view the app as any other user and each Tableau report opens only for people granted it.
Read the write-up →Asked by Boston teams.
How do you work with teams in Boston?+
We are in Bengaluru and move our working day for Boston, so four hours of every working day overlap with your morning in Eastern time, stand-up included. We join your Slack, push to your GitHub and track the work in your Linear, so progress shows up where your team already looks. The person on every call is the engineer who writes the code, whether you are a scientist, a clinician or a CTO.
Do you build for Boston's biotech and life sciences companies?+
Yes. The work is usually the software around the science: pipelines that pick up plate reader, sequencer and imaging output as it lands and link it to the notebook entry, internal tools that stay fast on thousands of assay results, and search over protocols and SOPs that always cites the current version. We work alongside your computational scientists, turning what already works in their notebooks into systems that run unattended.
How does your rate compare to hiring in Boston?+
Built In puts the average software engineer base salary in Boston at about $137,000, before bonus and benefits. Our published rate is $35/hour, or $5,400 a month for an embedded engineer, with a $5,000 minimum. There is no recruiting time and no employment overhead, and work starts within days of the call. The first piece is a fixed-price two-week engagement at $2,800, so you judge us on what it produces.
What do the first two weeks look like?+
You share the context: the code, the data and the problem. Within two days you have a 30-minute call with the engineer who would do the work, and within a week a written plan. Then comes a fixed-price two-week piece at $2,800, such as turning one notebook or prototype into something that runs on its own. At the end you have working code in your repository, notes on how it runs, and a clear view of what comes next.
What is wrong with a role column?+
Nothing, until you have more than one kind of customer. A role says who a user is; most real questions are about what they can do to one specific thing, inside one specific organisation. Encoded as role checks, every new requirement becomes a code change in many places. We model permissions as data, check them in one place, and test them like any other logic.
Should we use an auth provider or build our own?+
Use a provider for identity: passwords, magic links, SSO and multi-factor. It is a solved problem and getting it wrong is expensive. Authorisation, meaning what a signed-in user may do, is specific to your product and usually belongs in your own code and database. We wire the first to the second and keep the line between them clear.
How do you handle multi-tenancy?+
Usually one database with a tenant ID on every row, enforced in one place: Postgres row-level security, or a data-access layer every query has to pass through, rather than each handler remembering. A separate database per tenant is sometimes right, for one very large customer or strict isolation, and we will say if that applies to you.
Where does it get hosted?+
Wherever suits your team. Vercel is the least effort for Next.js and fine for most platforms. If cost or long-running background work make that awkward, we run it in containers on Railway, AWS or your own Kubernetes. The repository, the cloud accounts and the bill are in your name either way.
What do enterprise customers ask for, and can you build it?+
Single sign-on through SAML or OIDC, audit logs, role management, session controls, encryption and data export. We build each of them into the platform and help you answer the technical questions on a customer's checklist accurately, so the security conversation speeds the deal up instead of stalling it.