Node.js Development in Singapore

No GST is charged on our invoice, and the invoice says so. Whether you account for it under reverse charge depends on your input tax position: IRAS's guidance is that a GST-registered business making only taxable supplies is not impacted, a partially exempt business or one with non-business receipts accounts for GST on imported services in its own return, and a business that is not registered should ask its accountant, because an exempt business importing more than S$1 million of services in a year can be required to register. We would rather your accountant confirmed your position before the first invoice than reconciled it at year end.

We build to it rather than claiming a certificate. The consent, purpose limitation and notification obligations shape the forms and the data model; retention limitation means records are deleted on a schedule rather than kept indefinitely; access and correction requests are features with a queue behind them rather than a manual database job. Processing happens in India, so the transfer limitation obligation applies, and the processor agreement we sign sets out the comparable standard of protection the Act asks for. The obligation to design for early is breach notification: an organisation has three calendar days from determining a breach is notifiable, which means one likely to cause significant harm or one affecting 500 or more people, to tell the PDPC, and answering what was in the breach is only possible if the logging existed beforehand. Appointing a Data Protection Officer is your obligation rather than ours, and we will say so if a design choice would make that person's job harder.

Not PSG. The Productivity Solutions Grant funds pre-scoped packages from pre-approved vendors for Singapore-registered companies, and a custom build from an overseas team is not that shape, so we will not pretend it is. The Enterprise Development Grant is assessed project by project against its own criteria, and whether a build like yours qualifies is a question for Enterprise Singapore or your grant consultant to answer before the scope is written rather than after a budget has assumed it.

We can supply what a due-diligence pack asks for, accept audit and access rights in the contract, and name every sub-processor that touches your data. What we will also tell you in the first conversation is what we do not hold: we are not SOC 2 or ISO 27001 certified, and our security page says so in those words. Whether an engagement with us is a material outsourcing arrangement under the MAS guidelines, and what that requires of you, is your compliance team's determination, and it changes the contract before it changes the code, so it belongs in week one.

Starter APIs (10-30 endpoints, basic auth, Postgres): S$620-S$1,500. Production backends (GraphQL, real-time, jobs, complex data): S$1,500-S$4,600. Multi-service / enterprise: S$4,600+. Cost scales with endpoint count, real-time complexity, and observability requirements.

NestJS for projects expected to grow past 10-15 contributors or 50+ endpoints, its opinionated structure pays back. Plain Express + custom architecture for smaller projects, MVPs, and tight deadlines. We use both regularly and pick per project.

REST when consumers are first-party (your own front-end, your own mobile app), the data model is simple, and you don't need flexible querying. GraphQL when you have multiple front-ends with different data needs, complex nested relationships, or third-party API consumers. Most of our recent backends are REST, GraphQL is over-applied for projects that don't need it.

Yes. We build full-stack, Node.js backend + React Native or Flutter mobile app + admin dashboard. One team, one codebase repository, one PM. Most clients prefer this over splitting backend/mobile across two vendors.

Honest answer: monoliths win for ~80% of projects. We only recommend microservices when there's a specific reason, compliance/data isolation, independent scaling needs, or genuine team/codebase size that justifies the operational overhead. Anyone telling early-stage startups to start with microservices is selling complexity.