.NET Development in Canada

About .NET Development

We take on .NET builds as a senior engineering service: ASP.NET Core web apps and Web APIs, enterprise backends, and moving legacy .NET Framework code onto a modern, cross-platform stack. It is a newer service line for us, so we will say so plainly. You get senior engineers, a written scope, and a flat quote, and we lean on the API design, testing, CI, and migration work that carries straight over from the rest of what we build.

What the engagement includes

• You already run on Microsoft: SQL Server, Azure, Active Directory, or a team that standardizes on C#. .NET fits that estate with far less friction than bolting on a different runtime.
• You need a fast, strongly typed backend for high-throughput APIs. ASP.NET Core on Kestrel is genuinely quick, and static typing catches a whole class of bugs before they reach production.
• You are modernizing an old .NET Framework or WebForms app and want to stay in the same language and hiring pool instead of rewriting in something unfamiliar to your team.
• Your team hires C# developers and will own the code after us. Handing a Node or Laravel app to a .NET team, or the reverse, is a real long-term cost worth avoiding.
• If none of that is true and you are starting fresh with no Microsoft ties, we will often steer you to Node or Laravel instead, the stacks we run deepest in. Saying that costs us the .NET brief and saves you money, which is the trade we would rather make.

Federal at-risk technology rules, the Government of Canada's .NET web templates and Manitoba's user-activity record in a .NET build

For a federal department, running an unsupported version is not a judgement call. The Standard on At-Risk Information Technology, Appendix H to the Treasury Board's Directive on Service and Digital and in effect since 4 May 2022, requires departmental CIOs to classify the version state of all software and hardware as future, current, supported or unsupported, keep business applications current, apply updates according to a departmental patch plan, and prohibit both unsupported technologies and those listed on the Deprecated Government of Canada Technologies page. It takes the provider's own roadmap as the authority on whether a version is supported, and treats paid extended support as a separate state. Two sets of Microsoft dates sit right on that line this autumn. Microsoft's support policy ends both .NET 8, a long-term release, and .NET 9 on 10 November 2026, which leaves .NET 10, supported until 14 November 2028, as the target for anything still in service next year. And the deprecated list, kept by the Treasury Board's Office of the Chief Information Officer, added SQL Server 2016 and SharePoint 2016 and 2019 as of 14 July 2026, next to SQL Server 2012 and 2014 and Windows Server 2012, which were already on it. A departmental .NET application is rarely just its own runtime. It is the runtime, a SQL Server instance, often a SharePoint integration and a set of NuGet packages, each with its own support state. So an upgrade we scope for a federal client starts with that inventory, places each item in one of the standard's four states, and plans the move to .NET 10 together with the database and integration targets, because upgrading the application while it still reads from a deprecated SQL Server version moves the problem rather than closing it. Whether the standard reaches your organisation, and how your department records exceptions, is for your CIO's office.

Federal ASP.NET applications usually take the Canada.ca look from the government's own packages rather than from a theme a vendor builds. The GoC.WebTemplate packages on NuGet, copyright Employment and Social Development Canada, are the DotNetTemplates that wrap CDTS, the Centrally Deployed Templates Solution, which serves the official header, footer and menus from a central location instead of copying them into each application. There are packages for ASP.NET Core MVC and, for older estates, for .NET Framework MVC and Web Forms. The Core MVC package ships layouts for default, application and transactional pages, left-menu variants, bilingual and unilingual error pages and a splash page, a gcweb theme for public sites and a gcintranet theme for employee-facing ones, and static fallback files the layout writes in when the central scripts do not load. Version 6.1.1, published on 30 July 2026, targets net8.0, while the 5.x line, updated the same day, still targets net6.0, which left Microsoft support in November 2024. Three build decisions follow. The layout and theme are chosen at the start, because a public form service and an internal tool use different ones and switching later touches every view. The fallback files are a snapshot of CDTS content at packaging time, so they drift from the live header until the package is updated, and they are what users see whenever the central scripts are blocked, which is worth testing on the client's own network rather than assuming away. And the template is a dependency with a support state of its own: an application held on the 5.x line inherits a runtime the at-risk standard treats as unsupported, so the template upgrade is planned with the move to .NET 10 rather than after it. Which template, theme and version your department expects is for its web or digital team to confirm.

In Manitoba, a .NET system holding personal health information comes with a logging rule that most frameworks do not meet out of the box. Section 4 of the Personal Health Information Regulation under The Personal Health Information Act requires a trustee to create and maintain a record of user activity for any electronic information system it uses to maintain personal health information, identifying whose information was accessed, who accessed it, when, in which system or component, and whether it was then disclosed under section 22 of the Act. The trustee must audit those records to detect security breaches, keep them for at least three years and make sure each is audited at least once before it is destroyed, and section 8 adds an audit of security safeguards at least every two years. The word that matters is accessed. The usual .NET auditing tools record changes: an Entity Framework Core SaveChanges interceptor sees inserts, updates and deletes, and SQL Server temporal tables keep the history of rows that changed, but a clinician opening a chart and reading it changes nothing and leaves no trace in either. So the record of user activity is built as a feature. Reads of personal health information go through query paths that write an access event with the patient identifier, the user, the time and the screen or API that served it, a command interceptor acts only as a backstop for queries that bypass those paths, and disclosures are logged with their legal basis. The log sits apart from the clinical database with its own retention of at least three years, and a reporting view lets the privacy officer run the breach audits the regulation calls for without asking a developer for a query each time. Reports listing identifiable patients log each patient they touch, while aggregate statistical reports follow the regulation's own exception. Whether you are a trustee, and what the minister's guidelines require of you, is for your privacy officer or counsel.

How we work with Canadian clients

Two things shape Canadian projects more than anything technical. The first is language: if you serve Quebec, French is a legal requirement rather than a nice addition, and the rules tightened considerably under Bill 96. The French version has to be available on equal terms with the English one, which is a design constraint from the first wireframe rather than a translation task at the end.

The second is anti-spam law. CASL is stricter than most teams expect, and the penalties are real. Consent has to be express or clearly implied, records of it have to be kept, and every commercial message needs a working unsubscribe and accurate sender identification. We build those into the product rather than leaving them to whoever configures the mailing tool later, because that is where the exposure usually sits.

Questions Canadian clients ask

.NET Development: common questions

Other markets we work in