Laravel Development in the UK

About Laravel Development

Laravel is the framework we reach for when a project needs more than a CMS but less than a microservices platform, internal tools, B2B SaaS, admin dashboards, custom CRMs, and REST/GraphQL APIs. We've shipped 6+ Laravel projects across healthcare, fintech, logistics, and education, with clean architecture, proper test coverage, and admin panels that ops teams actually enjoy using.

What the engagement includes

• Custom Laravel web app development
• REST and GraphQL API development
• Laravel Filament admin panels
• Laravel Nova admin panels (when budget supports it)
• Livewire and Inertia.js full-stack apps
• Multi-tenant SaaS architecture (Tenancy for Laravel)
• Database optimization and query tuning
• Spatie Permission, ActivityLog, and Media Library setup

What Cyber Essentials, card authentication and the new complaints duty ask of a UK Laravel build

If your customer is a central government department, one of its agencies or an NHS body, PPN 014 says contracts that handle citizens' personal information or supply ICT systems for OFFICIAL data should require Cyber Essentials, and on a Laravel build the scheme lands on the server and the accounts around it rather than on the code. The current requirements, version 3.3, apply to assessment accounts opened from 27 April 2026, and they put bespoke components of web applications out of scope while keeping the servers and cloud services underneath them in. A server Forge provisions on EC2 is infrastructure you manage, so the PHP on it has to be licensed and supported, which the scheme defines as a vendor committed to fixes that publishes the date they stop. PHP publishes exactly that: 8.1 is already past its date and 8.2 reaches it on 31 December 2026. Forge applies Ubuntu's security updates weekly but deliberately does not upgrade PHP, and it runs each installed version as its own FPM process, so the 8.1 left behind after the sites moved to 8.3 is unsupported software on an in-scope server, and the requirements say it comes off. Updates the vendor rates critical or high, or that score 7 or more on CVSS v3, go on within 14 days, so PHP patch releases and composer update become a fortnightly routine. The accounts matter as much as the packages. The requirements say third-party accounts, such as those used by support services, are yours to control, so our engineers sit as named members of your Forge organisation with their own SSH keys, never a shared login, and are removed the day the engagement ends. Administrative work is done from separate accounts, authentication to cloud services must always use multi-factor authentication, which reaches Forge or Laravel Cloud, AWS and GitHub, and the Filament panel's own MFA, set as required, belongs on the same list. Whether the contract also calls for Plus is for the buyer to say.

Card billing is the other place a UK build trips over the framework's own documentation. Cashier's guide introduces Strong Customer Authentication as an EU regulation imposed in 2019, and a team reading it after Brexit can conclude it no longer applies here. It does. The FCA onshored the technical standards and expected full compliance for e-commerce by 14 March 2022, so UK cards get challenged by their issuers and the subscription code has to expect it. In Cashier the challenge arrives as an IncompletePayment exception on the first charge, which the application catches and sends to the bundled cashier.payment confirmation page, and later as subscriptions sitting at incomplete or past_due in the stripe_status column, which are not active until the customer confirms. Renewals are where projects come unstuck, because the customer is not on the site when the bank asks for authentication. Cashier will email them, but only if CASHIER_PAYMENT_NOTIFICATION is set, which it is not by default, only if the invoice.payment_action_required webhook is enabled in Stripe, and only if the billable model uses the Notifiable trait. Miss any of the three and the first sign is a customer locked out on the morning the plan renews. So we set all three, put webhook handling on the queue so a slow response does not leave Stripe retrying, and give the Filament panel a list of every subscription waiting on authentication with the date it started waiting, which is also what support needs when someone rings. Cashier offers keepPastDueSubscriptionsActive and keepIncompleteSubscriptionsActive to paper over the gap, and we switch either on only as a written decision about how long unpaid access should last, never as a default nobody chose. The documentation also warns that the notification goes out even when the customer is paying by hand at that moment, so its wording has to make sense to someone who has just confirmed. Which exemptions your acquirer applies to your mix of cards is for them and Stripe to confirm.

Since 19 June 2026 the Data (Use and Access) Act 2025 has given people a statutory right to complain to the organisation holding their data, and the duty that comes with it is workflow, which in a Laravel back office means a model, the scheduler and a panel. The ICO's guidance, published on 12 February 2026, says a controller must give people a way of making data protection complaints, acknowledge receipt within 30 days, take appropriate steps without undue delay, including making appropriate enquiries, keep people informed, and tell them the outcome without undue delay. The complaint will not always arrive through the form you build. It turns up in a support ticket, a reply to a marketing email or a message to an account manager, so the model is a complaint record any member of staff can raise from the Filament panel against the customer it concerns, with a received date that drives everything after it. The scheduler then works the clock: a job runs each morning, flags complaints with no acknowledgement and escalates the ones approaching day 30, instead of relying on someone remembering. Enquiries made, messages sent and decisions taken are stored against the record as they happen, because the record is what you would show the ICO if the person takes it further. Two links in the data model save trouble later. A complaint about a subject access request points at that request, so whoever handles it sees what was sent and when, and a complaint about marketing points at the consent record, so the reply can say exactly when permission was given and through which form. The acknowledgement and outcome letters are notifications like any other, queued and logged, so there is proof of the date each one left. None of this replaces the judgement about whether a complaint is justified, which stays with your data protection lead, and whether a particular message counts as a complaint at all is a question for your own counsel.

How we work with UK clients

UK engagements tend to start with procurement questions rather than technical ones. Who holds the data, which law governs the contract, whether you can produce a record of processing if the ICO asks. We answer those in the proposal instead of leaving them to a legal review three weeks in, because that review is where UK projects usually stall.

Invoicing is the other thing worth settling early. We are outside the UK, so services we supply generally fall under the reverse charge and your finance team accounts for the VAT rather than paying it to us. Our invoices say so explicitly. We quote in pounds, the figure does not move with the exchange rate mid-project, and payment by bank transfer avoids the card fees that make a five-figure invoice unnecessarily expensive.

Indicative pricing in GBP

Converted from our published Indian rates and rounded. Exchange rates move, so the figure on your quote is calculated on the day it is issued.

Questions UK clients ask

Laravel Development: common questions

Other markets we work in