Our tech stack: the web platforms we build on and the marketing tools we connect
Two audited platforms do the work of a dozen cloud services, so the first weeks of a project go on your screens, not on plumbing. Here is what we build with, the marketing tools we connect, why we chose each one, and who looks after what.
Trusted by clients from global brands to local charities
Why this stack
Every web app we build runs on the same two platforms. Vercel runs the screens and stops attacks before they reach your system. Supabase holds the data, sign-in and files in the region you choose, with the rules about who sees what built into the database. Between them they do the work of ten or twelve separate cloud services, so a project starts on what your team will use.
Everything in it is open and widely used. There is nothing proprietary to leave behind: the code lives in a repository you can hold, the data comes out with standard tools, and another supplier could pick it up. Where FileMaker is the better fit, we use FileMaker, and plenty of our clients run both.
Two platforms, and the tools around them
Next.js, Vercel and Supabase do the building, running and holding. GitHub keeps the code, Aikido checks it, Claude works alongside our engineers, and Sentry and PostHog watch what's live.
What runs a live app, and who looks after it
A live system has layers. Here is what sits on each one, which tool does the work, and who keeps it running.
The screens
We look after itThe same code serves a desk and a phone, and a release reaches everyone at once.
Next.js
Sign-in and access
We look after itStaff sign in with their Microsoft work account. The rules about who sees what live in the database, so they hold in the app, in reports and in every integration.
Microsoft sign-in, Supabase
Code and delivery
We look after itEvery change on its own branch, reviewed by a second engineer, scanned, and previewed before it goes live.
GitHub, Aikido, Claude
Watching it
We look after itErrors reported as they happen, usage understood, security checked on every change.
Sentry, PostHog, Aikido
- Our managed hosting
Hosting and delivery
We set it up, the platform runs itScreens served from a global network, every change built and previewed, attacks absorbed before they reach you.
Vercel
Database, files and backups
We set it up, the platform runs itPostgres in the region you choose, with sign-in, file storage and point-in-time backups joined to it.
Supabase
The infrastructure underneath
The platform looks after itServers, network and patching, independently audited every year.
Vercel and Supabase
Every tool, and why it's there
Nine tools, each with one job. Nothing gets added to the stack without a reason, and nothing stays without one.
- Screens
Next.js
The framework our web apps and websites are built on. One codebase for the desk and the phone, and screens that install from the browser.
- Running it
Vercel
Hosting and deployment. Every change gets its own preview, and attacks are absorbed before they reach the app.
- Data
Supabase
Postgres, sign-in, file storage and backups, in the region you choose, with the access rules held in the database.
- Code
GitHub
Where the code lives. Every change is reviewed, and the history is yours to keep.
- Security
Aikido
Scans every change for security issues, in the code and in what it depends on, and runs penetration tests.
- Engineering
Claude
AI-assisted development alongside our engineers. Every change it helps with is reviewed like any other.
- Watching
Sentry
Error tracking and performance monitoring, so a problem is seen before anyone rings.
- Watching
PostHog
Product analytics, session replays and feature flags: how the app is used, and what to improve next.
- Email
SendGrid
The emails an app sends: confirmations, reminders and alerts, from your own domain.
Facts for IT and security
The parts that take weeks on a bare build come ready on this stack. The detail, and the certificates, are in our trust centre.
- Certifications
Independently audited platforms
Vercel and Supabase are audited to SOC 2 Type 2 and ISO 27001, every year.
- Data residency
Your choice of region
The database, user accounts and files sit in the region you choose, the UK included, with the server code beside them.
- Encryption
At rest and in transit
Your data is encrypted in the database and on the wire. Secrets are held by the platforms, never in the code.
- Identity
Work-account sign-in
Staff sign in with their Microsoft work account. When IT switches an account off, that person can't sign in again.
- Access control
Rules held in the database
Row-level rules decide who sees what, so they hold in the app, in reports and in every integration.
- Recovery
Point-in-time backups
On our standard set-up the database can be wound back to a moment before something went wrong.
How a change goes live
The same route for every change, from a one-line fix to a new module, so live systems stay stable.
The marketing tools, connected to your CRM
We choose marketing tools that pass what they learn back to your CRM, so you can see which campaign brought in which enquiry.
Where buyers find you
- Google Ads: search and display
- LinkedIn Ads: roles and companies
- Meta Ads: Facebook and Instagram
- Search, measured in Search Console
What each tool adds
- ClayEnrichment and qualification behind outreach
- LeadfeederThe companies visiting your site, named
- BrevoEmail journeys and newsletters on your contacts
- WebflowLanding pages your team can edit, where speed matters more than a full build
- AhrefsKeywords, competitors and rank tracking
- Google AnalyticsTraffic and conversions, page by page
- n8nAutomation between the tools
How we choose a marketing tool
The same tests every time, so your stack stays small and joined up.
- It passes what it learns back to your CRM
- The account and the data are yours
- It is priced for the size of business you are
- It does a job nothing else in your stack already does
Questions about the stack
You can. The app can run in our managed space or in your own Vercel, Supabase and GitHub accounts, or a mix. Either way the code and the data are yours.
In the Supabase region you choose, the UK included, with the server code in a Vercel region beside it. Both platforms are independently audited to SOC 2 Type 2 and ISO 27001, and the data is encrypted at rest and in transit.
Yes. Everything is open and widely used, so your own team or another supplier could run it. Most clients choose our managed space so they don't have to.
The platforms charge by usage, paid either by you directly or through our managed hosting. We show you the expected running cost before the build starts, alongside the range for the work.
You could assemble the same thing from ten or twelve separate services. Two platforms that do that work between them mean less to set up, less to secure and less to look after, so the first weeks go on your screens.
Our engineers use Claude alongside their own work, and we build it into clients' systems where it earns its place. Every change it helps with goes through the same review, scan and preview as any other.
Where FileMaker is the better fit, we use FileMaker. Many of our clients run both, and when a system is ready to move to the web we move it a piece at a time, while the business keeps running.
No. We connect to the one you have; we've worked with HubSpot, Pipedrive, Capsule and Monday.com, and we build bespoke CRMs where those don't fit.
We agree it tool by tool at the start: your own accounts, or ours run for you.
More in Technologies
The platforms we build on, each with its own family of pages.