Java Development in Singapore

About Java Development

We build Java backends, Spring Boot REST APIs, and enterprise integrations for teams that run on the JVM. This is a newer service line for us, so here is the honest version: our highest-volume work is in Node.js and PHP, and what carries straight into Java is the part that decides whether a backend lasts, clean API design, a real test suite, CI on every push, and the PostgreSQL, Redis, and AWS work we already do every week. You work directly with the senior engineers writing the code, on a written scope and a flat quote.

What the engagement includes

• Spring Boot as the base, with a layered structure of controllers, services, and repositories that a new developer can navigate, not a tangle only the author understands.
• REST APIs documented with OpenAPI and Swagger UI, so your front-end and mobile teams build against a contract instead of a moving target.
• A real test suite: JUnit 5 and Mockito for units, Testcontainers and Spring Boot Test for integration tests that hit an actual PostgreSQL, so regressions get caught before your users do.
• CI that runs the build and the full test suite on every push, with Maven or Gradle, so the main branch stays in a shippable state.
• Database changes kept as versioned migrations in Flyway or Liquibase, never hand-edited straight into production.
• Containerized with Docker and deployed to AWS, with configuration and secrets kept out of the code.
• You own the repository, the pipeline, and the infrastructure from day one. Nothing is locked to us, and any competent Java team can pick it up.

IM8's published controls, TradeNet and the Health Information Act in a Singapore Java build

For a Java system built for a ministry or statutory board, the security controls now come from a published catalogue rather than a tender annex nobody outside government has seen. The Singapore Government ICT&SS Policy Reform portal, where GovTech's developer site sends anyone looking for IM8, says it publishes the same control requirements to agencies and industry partners so that both can apply them together. Each system gets a System Security Plan by type: low-risk on-premises, low, medium or high-risk cloud, CII, generative AI, digital services or sandbox. Controls are graded, with Level 0 cardinal and mandatory, Level 1 basic hygiene applied according to risk and Level 2 best practice, and the catalogue is written in OSCAL, so a plan can be read by machines rather than retyped into a spreadsheet. Several entries land squarely on Java. AS-6 requires passwords stored as salted hashes, with a salt of at least 32 bits from a cryptographically secure generator, and gives java.security.SecureRandom rather than java.util.Random as its example. AS-4 recommends limiting authentication to three consecutive failures in 15 minutes or another reasonable rate. SC-4 and SC-6 require direct and transitive dependency versions pinned in the manifest and only those versions installed at deployment, which is awkward in Maven, because a pom has no lockfile and a version range or SNAPSHOT resolves to whatever is newest that day. So the build fails on dynamic versions through the Maven Enforcer plugin's banDynamicVersions rule, or the project uses Gradle's dependency locking. SC-2 has the repository reject unsigned commits, so our engineers sign theirs from the first day, and SC-7 and SC-8 require the JAR or container image to be signed during the build and the signature checked before deployment. We map each applicable control to the build configuration or code that meets it, which becomes evidence for the plan. Which risk tier and plan your system falls under is the agency's decision.

Logistics software in Singapore ends at TradeNet, and the way in is gated before it is technical. TradeNet is the National Single Window for trade declarations: import, export and transhipment permits and certificates of origin go through it to Singapore Customs and the competent authorities, and approved permits come back the same way. Declarations reach it through a front-end solution from an approved provider, and only registered declaring agents can submit new declarations, amendments, cancellations and refund applications. A forwarder or trader that wants its own Java platform to talk to TradeNet therefore either integrates with an approved provider's system-to-system interface or applies to Singapore Customs to become a provider. That application asks for the company's UEN, whether it is based or has a registered office in Singapore, the type of solution, and where its servers and its support team are, naming the country if either is overseas, and the message specifications are released only to successful applicants. So the permit module sits behind an adapter with the provider's interface on the far side. Three TradeNet details then shape the module. Every application carries a Unique Reference Number made of the declaring agent's identifier, the creation date and a sequence number, and that URN has to be quoted on documents sent to the competent authorities, so it is generated once, stored against the shipment and used as the idempotency key when an application is resubmitted. Rejections come back with error codes such as DCS ERROR or CA/SC REJECT, which belong in a work queue someone owns rather than in an email inbox. And TradeNet is unavailable on Sundays from 4am to 8am for maintenance, so scheduled submission jobs are planned around that window. Controlled goods add a layer, since each competent authority, from the Health Sciences Authority to the Singapore Food Agency, sets its own requirements, which the product master records item by item. Whether your goods are controlled is for the relevant authority or your customs adviser to confirm.

Healthcare software in Singapore is about to answer to a statute that names the vendor. The Health Information Act 2026, passed on 12 January 2026 and published in February, puts a national electronic records system, the role NEHR plays today, on a statutory footing, and it comes into force on a date the Minister appoints; on 2 October 2026 Singapore Statutes Online still listed it only in the Acts Supplement. Specified contributors, healthcare licensees and retail pharmacies listed in its First Schedule, must contribute prescribed health information, and section 14 lets the format and the software, Application Programming Interfaces included, be prescribed, with every contributor bound by the System Operator's technical requirements. A relevant health data intermediary is one that processes health information on a provider's behalf through a system that helps organise healthcare and is interconnected with the national system, and Part 2 applies equally whether a clinic contributes directly or through one. That intermediary carries duties of its own: reasonable controls for secure processing under section 66, reasonable safeguards against unauthorised access, interference or tampering under section 68, each backed by fines of up to S$1 million for a company, and under section 87, practices for transferring a provider's health information, accurately, completely and in a timely way, to the provider or to another intermediary it designates. For a Java team that means three design decisions. The national records interface sits in its own module, because the format and API are whatever is prescribed, so HAPI FHIR or an HL7 v2 library is chosen to fit that specification rather than chosen first. Corrections are made in the source system, since Synapxe's own guidance is that NEHR data is the data entered at source and has to be corrected there. And a full export, in a documented format another vendor's system could load, is a tested feature rather than a clause in the contract. Whether your organisation is a contributor or an intermediary is for your own counsel.

How we work with Singapore clients

Singapore is the one market we serve where the working day is simply shared. We are two and a half hours behind you and neither country moves its clocks, so our morning starts partway through yours and the whole of your afternoon is live time for both sides. That changes the shape of an engagement more than anything technical does: a call is booked for the same afternoon rather than the same week, a question raised before your lunch is answered after it, and the written-first method we run for North American clients is a courtesy here rather than a necessity. We keep the written record anyway, with a default chosen on every open decision, because it is the thing an auditor or a new hire can read later and a call is not.

Invoicing is worth stating plainly because the GST position confuses buyers on both sides. We are outside Singapore, so no GST appears on our invoice. Whether you account for it yourself is the reverse charge question, and IRAS's own guidance is that a GST-registered business making only taxable supplies is not affected, while a partially exempt one accounts for it in its own return. We quote in Singapore dollars, the figure holds for the project whatever the rupee does, and payment by bank transfer or Wise avoids the card fees a five-figure invoice does not need. The contract can sit under Singapore law with Singapore courts, and unusually among our overseas markets that clause has teeth: Singapore is a reciprocating territory under section 44A of India's Civil Procedure Code, so a judgment of the Singapore High Court can be executed in India directly rather than re-litigated.

Questions Singapore clients ask

Java Development: common questions

Other markets we work in