Web platform development in Mumbai
Wealth managers, brokers and insurance distributors in Mumbai run platforms with an authorisation problem most software ignores. A relationship manager should see only their own clients. A branch head sees the branch. Head office sees everything but changes nothing. Some actions, a payout or a change of bank details, need a maker and a checker, two different people, before they take effect. Built as a role column and a few if statements, this becomes the bug a client finds first.
We design the authorisation model as a first-class part of the Next.js platform: scoped access enforced in the data layer, maker-checker workflows with a full history of who proposed and who approved, SSO into the customer's own directory, and a support view that shows what a user sees without logging in as them. It ships in increments inside the product you already run, so the controls arrive without a rewrite.
Mumbai is India's financial capital. Both major stock exchanges are here, and so are many of the country's banks, NBFCs, brokers, wealth managers, insurers and fintechs. For these companies software is judged first on whether the money is right. A loan ledger that drifts from the bank statement, a payout released twice because a partner timed out, a portfolio screen showing yesterday's price: each one lands on an operations desk the next morning. What they need built is rarely a new product from nothing. It is a lending or payments backend that reconciles, a platform where each role sees exactly what it should, and approvals that need two people before money moves. Engineers who have built those systems are in demand across the city, so the work often waits for a hire.
The city's second industry is attention. The Hindi film industry, most of the country's television networks and many of its large publishers are based here, and their software problems are specific: traffic that arrives all at once on a release or a match day, rights and metadata that decide what can be shown where, and archives that are valuable only if someone can search them. A slow page on a publisher's site is lost revenue, because the readers came from search and will go straight back to it.
The third is consumer business in every size. Mumbai has D2C brands selling beauty, fashion and food through their own stores and every marketplace at once, and it is home to large family-owned groups and conglomerates whose older divisions still run on spreadsheets and exports from their accounting software. In the bigger groups the buyer is usually a digital team with a mandate, a budget and a procurement process, and the work has to survive that process as well as production.
We are in Bengaluru and share your time zone, so the working day is the same on both sides and a question asked in the morning is answered the same morning. You talk directly to the engineer who writes the code. The work happens in your repository and a shared chat channel, where every decision is written down, and the runbooks and architecture notes are written as we go rather than at the end.
We are the right fit when a Mumbai team has a defined piece of work and wants a senior engineer on it within days: a ledger that has to reconcile, a migration with an end date, or extra capacity while you hire. Start with a fixed-price two-week piece, or bring us in white-label for your agency's clients under your name.
Four ways this arrives.
We replace the role column with a permission model that can express teams, access to individual resources and roles the customer defines, add SAML or OIDC sign-in, and write the audit log their security questionnaire will ask about.
Or very nearly did. We find every query that can cross a tenant boundary, enforce the tenant in one layer rather than in every handler, and add tests that try to read across that boundary on purpose.
We build the admin side properly: search across organisations, an audited view-as-user mode, and screens for access and usage. Support stops asking an engineer to run a query against production every time a customer says something looks wrong.
An early Next.js app with auth stitched into middleware, a custom server, and a release process that lives in someone's head. We move it forward in small steps, with preview environments and a pipeline anyone on the team can ship from.
A Next.js platform scoped per organisation, where an administrator can view the app as any other user and each Tableau report opens only for people granted it.
Read the write-up →Asked by Mumbai teams.
How do you work with teams in Mumbai?+
We are in Bengaluru and share your time zone, so calls, reviews and releases fit inside your normal working day. We work in your tools, Slack, GitHub and Linear or whatever your team already uses, and every decision is written down in the repository or the channel. You talk directly to the engineer writing the code, from the first 30-minute call through to handover, with runbooks and architecture notes written as we go.
Do you build for Mumbai lenders, brokers and fintechs?+
Yes. We build the parts where the money has to be right: loan and payment ledgers that reconcile against the bank's records every day, retries that cannot turn a timeout into a double payout, maker-checker approvals where a second person signs off before money moves, and a full history of every change of state. We work inside the system you already run, in Node, Python and Next.js, and ship in increments.
How does your rate compare to hiring in Mumbai?+
PayScale puts a mid-career software engineer in Mumbai at about ₹15 lakh a year. Our published rate is $35 an hour, with a $5,000 minimum. That buys a senior engineer who writes the code, works in your Slack, GitHub and Linear, and starts within days, with no recruiting round, notice period or employment overhead. Start with a fixed-price two-week piece at $2,800 and judge us on the output before committing to more.
Can you work white-label for our Mumbai agency?+
Yes. Mumbai's digital and media agencies bring us in when a client needs a backend, a mobile app or a data pipeline alongside the design and campaign work. We work under your name, in your client's repositories and your channels, and sign an NDA before specifics. The code belongs to the client from the first commit. You keep the relationship, we write the code and the runbooks, and your team presents the work.
What is wrong with a role column?+
Nothing, until you have more than one kind of customer. A role says who a user is; most real questions are about what they can do to one specific thing, inside one specific organisation. Encoded as role checks, every new requirement becomes a code change in many places. We model permissions as data, check them in one place, and test them like any other logic.
Should we use an auth provider or build our own?+
Use a provider for identity: passwords, magic links, SSO and multi-factor. It is a solved problem and getting it wrong is expensive. Authorisation, meaning what a signed-in user may do, is specific to your product and usually belongs in your own code and database. We wire the first to the second and keep the line between them clear.
How do you handle multi-tenancy?+
Usually one database with a tenant ID on every row, enforced in one place: Postgres row-level security, or a data-access layer every query has to pass through, rather than each handler remembering. A separate database per tenant is sometimes right, for one very large customer or strict isolation, and we will say if that applies to you.
Where does it get hosted?+
Wherever suits your team. Vercel is the least effort for Next.js and fine for most platforms. If cost or long-running background work make that awkward, we run it in containers on Railway, AWS or your own Kubernetes. The repository, the cloud accounts and the bill are in your name either way.
What do enterprise customers ask for, and can you build it?+
Single sign-on through SAML or OIDC, audit logs, role management, session controls, encryption and data export. We build each of them into the platform and help you answer the technical questions on a customer's checklist accurately, so the security conversation speeds the deal up instead of stalling it.