Web Application Development in Singapore

About Web Application Development

We build custom web applications from Noida, Delhi NCR: customer portals, booking and quoting systems, dashboards, marketplaces, and SaaS products on Next.js and React with a Node.js or Laravel API and PostgreSQL. You work directly with the senior engineers writing your code, get a written scope, and a flat quote back in 24 hours.

What the engagement includes

• Senior engineers on your app from day one. You talk to the people writing the code, not an account manager or a junior swapped in after the sale.
• A written scope before any code and a flat quote inside 24 hours, so the price is set before we start and does not move unless the scope does.
• A data model and roles designed up front, so the app holds up as you add features instead of collapsing under its own weight.
• Tests and CI in the build, not bolted on later. Every push runs the suite before it deploys.
• You own everything: the code, the repo, and the AWS hosting. Nothing is locked to us and you can walk with all of it at any time.
• For overseas clients we quote in flat INR and can invoice in USD, CAD, GBP, or AED through Wise, with W-8BEN and LUT on file.

What the PDPC's NRIC deadline and its breach decisions put inside a Singapore web application

For a Singapore web application the date that matters this year is 31 December 2026. On 2 February 2026 the PDPC gave private organisations until then to stop using NRIC numbers, in full or in part, to authenticate anyone, and said that from 1 January 2027 it will step up enforcement, including directions or financial penalties, because authenticating with an NRIC number can be a failure to make reasonable security arrangements under the PDPA. The joint advisory with CSA behind it, last updated on 7 May 2026, separates authentication, proving someone is who they claim to be before giving them access, from identification, which only tells people apart, and says an NRIC number must be assumed to have been disclosed to at least a few other people. That rules out familiar patterns: an NRIC as the default password, a statement PDF locked with the last four characters and a date of birth such as 567A01Jan80, and a password reset or helpdesk lookup that treats knowing the number as proof. The advisory's replacements are an account login with multi-factor authentication for documents the user will come back to, or an expiring single-use link with a unique password sent through a separate channel. Collection is a separate rule, applied since 1 September 2019. The PDPC's guidelines allow a full number only where the law requires it or where identity has to be established to a high degree of fidelity, and they treat FIN, work permit and birth certificate numbers the same way. So the account key is an email address, a mobile number or an ID the system generates. A partial number, where useful, is the last three digits and checksum letter and nothing more. A full NRIC, where one is justified, sits in its own encrypted field that list views, CSV exports and logs never touch. Those guidelines are due to be updated, so whether your case justifies a full number is for your own counsel.

The PDPC's decisions show what it looks for after a web application is breached, and testing that features work is not it. In Singapore Data Hub [2025] SGPDPC 2, decided on 7 April 2025, an attacker found a vulnerable URL on an enterprise client's website that led to the company's hosted point-of-sale application, made at least 1,370 SQL injection attempts against it, exported customer tables, and used a local file inclusion flaw to read database credentials hardcoded in the source files. A second attacker got in through a dormant web application kept for training. The company released changes almost monthly and checked only that they worked. The Deputy Commissioner held that security checks were needed before changes went live, that the SQL injection could have been caught in pre-launch testing of its web applications, and that it had no web application firewall, which the PDPC's own guide for ICT systems lists as an enhanced practice against SQL injection and cross-site scripting. The penalty was S$17,500, with directions to complete within 90 days including rate limiting on login attempts, strict input validation, production kept apart from training environments, no usernames or passwords in cleartext configuration files, and a documented vulnerability assessment and penetration test at least once a year and after major upgrades. The PDPC's advisory on common data protection lapses, issued with the NRIC announcement in February 2026, adds testing before go-live after any change, a test environment kept off the internet during development, and a check that no credentials or personal data are left behind in it. In a Next.js and NestJS build that means parameterised queries through the ORM, secrets held in the deployment environment rather than the repository, a security scan in the release pipeline rather than once a year, and staging environments taken down when they stop being used. Who runs the penetration test is your decision; we scope the build so it can be tested before launch.

If other Singapore businesses will put their customers' data into the application, as with a SaaS product or a portal you license out, the PDPA gives you a second role. For each client you are likely to be a data intermediary. Section 4(2) of the Act leaves an intermediary processing under a contract evidenced or made in writing with the protection and retention obligations, plus a duty under section 26C(3) to tell the client without undue delay once it has reason to believe a breach has occurred, after which the client assesses whether the breach is notifiable. Section 4(3) keeps the client's own obligations as if it had processed the data itself, so its procurement team will ask you the questions the PDPC would ask it. The Singapore Data Hub decision speaks to this too: the company was a SaaS vendor, and the PDPC said that holding a high volume of personal data for its clients called for security commensurate with that. Your terms of service are the written contract, so they say what you process and on whose instructions. Every record carries its tenant, and the tenant boundary is enforced in the data layer rather than only in the interface, so a flaw reached through one client's site does not open every other client's tables. Access logs can be read client by client, because each client makes its own notification decision on what you tell it, and offboarding returns or deletes one tenant's data on a schedule. The February 2026 advisory adds two more. Onboarding a client by migrating its legacy records is where a field-mapping error sends one customer's bill to another, so imports are reconciled before they go live. And admin exports are watched, with alerts on unusually large downloads or access outside normal hours. Whether your arrangement makes you an intermediary or an organisation in your own right is for your own counsel.

How we work with Singapore clients

Singapore is the one market we serve where the working day is simply shared. We are two and a half hours behind you and neither country moves its clocks, so our morning starts partway through yours and the whole of your afternoon is live time for both sides. That changes the shape of an engagement more than anything technical does: a call is booked for the same afternoon rather than the same week, a question raised before your lunch is answered after it, and the written-first method we run for North American clients is a courtesy here rather than a necessity. We keep the written record anyway, with a default chosen on every open decision, because it is the thing an auditor or a new hire can read later and a call is not.

Invoicing is worth stating plainly because the GST position confuses buyers on both sides. We are outside Singapore, so no GST appears on our invoice. Whether you account for it yourself is the reverse charge question, and IRAS's own guidance is that a GST-registered business making only taxable supplies is not affected, while a partially exempt one accounts for it in its own return. We quote in Singapore dollars, the figure holds for the project whatever the rupee does, and payment by bank transfer or Wise avoids the card fees a five-figure invoice does not need. The contract can sit under Singapore law with Singapore courts, and unusually among our overseas markets that clause has teeth: Singapore is a reciprocating territory under section 44A of India's Civil Procedure Code, so a judgment of the Singapore High Court can be executed in India directly rather than re-litigated.

Questions Singapore clients ask

Web Application Development: common questions

Other markets we work in