Angular Development in the US

About Angular Development

We build Angular single-page apps, enterprise dashboards, and TypeScript-heavy front ends from our team in Noida, Delhi NCR. Angular is a newer service line for us, so we will be straight with you: we write TypeScript, React, and Node in production every day, and we bring that same discipline, strict typing, tests, CI, a written scope, and a flat quote, to an Angular build. You work directly with the engineers writing your code, not an account manager.

What the engagement includes

• A written scope before any code, and a flat INR quote with GST inside 24 hours. Overseas clients pay in USD, CAD, GBP, or AED via Wise, with W-8BEN and LUT on file.
• TypeScript in strict mode, typed API models, and a component structure your next developer can actually read, not a pile of any types.
• Tests in the build and CI on every push, so a green pipeline means the app still works, not just that it compiled.
• Reactive forms and RxJS used on purpose. We keep state as simple as the app allows before reaching for NgRx, rather than adding ceremony you will pay to maintain.
• Straight talk about this being a newer service line for us. We take Angular on and deliver it well; we do not invent a ten-year Angular history or fake case studies to win the work.
• You own the repo, the code, and the hosting from day one. Nothing is locked to us, and you can walk with everything at any point.

CISA's XSS alert, unsupported-component controls and federal analytics rules in a US Angular front end

American security reviewers now have a federal document to quote when they ask an Angular team about cross-site scripting. On 18 September 2024 CISA and the FBI published a Secure by Design Alert calling XSS a preventable class of defect that should not be present in software products, and telling technical leaders to use modern web frameworks that handle output encoding, then to follow the framework's own guidance for the edge cases that remain. Angular is the kind of framework the alert means: it treats every interpolated value as untrusted and sanitizes it before it reaches the DOM. The edge cases are the escape hatches. The five bypassSecurityTrust methods on DomSanitizer switch sanitization off for a value, and anything written through ElementRef to the native element skips Angular altogether. So the useful answer to a reviewer citing the alert is enforcement rather than a promise about code review. Angular ships named Trusted Types policies, and an application that calls any bypass method has to enable the angular#unsafe-bypass policy in its response header, while an AngularJS hybrid running through the upgrade package needs angular#unsafe-upgrade as well. The header therefore becomes a written inventory of exactly which exceptions the application relies on, which is what the reviewer is really asking for, and a new kind of exception cannot slip in without someone editing it. The other half is the Content Security Policy nonce. Angular reads it from the ngCspNonce attribute or the CSP_NONCE token, its documentation warns that a nonce generated at the origin and then cached by a CDN is the same for every visitor, and for static hosting it offers the autoCsp build option, which hashes inline scripts instead but cannot be combined with server-side rendering. Choosing among those is a hosting decision as much as a coding one, so it is settled when the deployment target is chosen rather than in the week of a security review.

The second question on a federal or federally assessed system is whether the framework is still supported, because NIST SP 800-53 Revision 5 makes that a control rather than a preference. SA-22, Unsupported System Components, sits in the low, moderate and high baselines alike. It requires a system to replace components once the developer no longer supports them, or to provide alternative sources of support, and assessors look for documented approvals and justification for any unsupported component still in use. For Angular the support calendar changed this year. The project now supports each major release for 24 months, twelve active and twelve on long-term support with only critical fixes and security patches, and with version 22 on 3 June 2026 it moved to one major release a year, with version 23 expected around June 2027. Version 20 leaves long-term support on 28 November 2026, version 21 in June 2027, and versions 2 to 19 are already outside support. AngularJS is a separate and older problem: its support officially ended in January 2022, yet hybrid applications that run AngularJS screens beside modern Angular through the upgrade module are still common in agency and contractor estates, and each one carries an SA-22 finding until the last AngularJS route is gone or an alternative source of support is documented. The control's own guidance names contracts with open-source value-added vendors as one route, which is a stopgap with a renewal date rather than a plan. So the upgrade cadence goes into the system's maintenance plan as a dated line item: one major version a year while it is still in its active window, ng update run on a branch the week a release lands, and the AngularJS screens migrated in order of exposure, public routes first, so the justification an assessor reads gets shorter each year rather than longer.

A public-facing federal Angular application also has to be measured in a prescribed way. OMB memorandum M-23-22 requires agencies to participate in GSA's Digital Analytics Program, and GSA's instructions are to put the DAP code on every public-facing website and on sign-in pages that lead to authenticated content, with authenticated pages added only case by case after the DAP team approves. In a single-page application that code sees one page load and then nothing, because route changes never reload the document. DAP's documentation provides a gas() function for virtual pageviews for exactly this case, so the Angular router's NavigationEnd event is what reports a page. What it reports needs care. GSA says agencies are forbidden to pass personally identifiable information into DAP, and an Angular route for a case or an application carries its record identifier in the path, with search terms and email addresses often riding in query parameters. The listener therefore sends the route template rather than the resolved URL, strips query strings, and stays silent on authenticated routes the program has not approved. Anything the application keeps between visits falls under OMB memorandum M-10-22, which sorts web measurement and customization technologies into three tiers. Single-session use, and multi-session use without PII, are allowed with notice in the agency's privacy policy and an easy way to opt out. Multi-session use that collects PII requires opt-in and review by the Senior Agency Official for Privacy, and retention should be one year or less unless something requires longer. A filter preference saved in localStorage, or a service worker cache that outlives the session, is the kind of persistent technology the memo describes, so each one is listed with its tier before release, and a visitor who opts out still gets comparable information and service. Which tier a given feature falls into is for the agency's privacy office.

How we work with US clients

A US engagement gets agreed twice. Once with the person who wants the thing built, and then again with legal, security, procurement and finance, who arrive separately and rarely in the same week. That second round is where a supplier outside the country loses the calendar: a master services agreement to redline, a security questionnaire, a certificate of insurance, and a vendor portal that assumes everyone it onboards can sign a W-9. Send all of it while the scope is still being written rather than in the week you wanted to start, and where the honest answer to a row is that we do not hold something, we write that in rather than leaving it blank.

You are also buying from a company you cannot drop in on, so the evidence has to do the work an office would otherwise do. What we send is live production URLs rather than a deck, a written scope with one fixed number against it, and the names of the people who will do the work rather than a bench that changes after signature. What we will also tell you is the shape of what you are hiring: a small team in Noida that has been building since 2021, not a firm that can put four more people on your project next Monday. If that is what your timeline needs, we say so before the contract rather than after it.

Questions US clients ask

Angular Development: common questions

Other markets we work in