Web Application Development in the US

About Web Application Development

We build custom web applications from Noida, Delhi NCR: customer portals, booking and quoting systems, dashboards, marketplaces, and SaaS products on Next.js and React with a Node.js or Laravel API and PostgreSQL. You work directly with the senior engineers writing your code, get a written scope, and a flat quote back in 24 hours.

What the engagement includes

• Senior engineers on your app from day one. You talk to the people writing the code, not an account manager or a junior swapped in after the sale.
• A written scope before any code and a flat quote inside 24 hours, so the price is set before we start and does not move unless the scope does.
• A data model and roles designed up front, so the app holds up as you add features instead of collapsing under its own weight.
• Tests and CI in the build, not bolted on later. Every push runs the suite before it deploys.
• You own everything: the code, the repo, and the AWS hosting. Nothing is locked to us and you can walk with all of it at any time.
• For overseas clients we quote in flat INR and can invoice in USD, CAD, GBP, or AED through Wise, with W-8BEN and LUT on file.

What California privacy law, the DOJ data rule and Nacha ask of a US web app

The US privacy question that changes a web application's data model is who counts as a consumer, and California answers it differently from the states that copied Virginia. Since 1 January 2023 the CCPA has covered the personal information of employees, job applicants, contractors and business contacts, while Virginia's law, the template most later states followed, excludes anyone acting in a commercial or employment context. So an HR portal, a B2B dashboard or an internal tool that a buyer assumes is out of scope because it holds no shoppers is in scope in California once the business crosses a CCPA threshold. The build consequence is that every record has to be findable, exportable and deletable per person, in the search index, the analytics warehouse, file storage and the logs as well as the main tables, and a deletion has to reach every service provider the data went to. That depends on knowing where personal information lives, which is why we keep a field-level map of it from the first migration rather than reconstructing one when the first request arrives. The California regulations in force since 1 January 2026 raise the stakes. Processing that presents significant risk needs a written risk assessment, with information on those done in 2026 and 2027 due to the state's privacy agency by 1 April 2028. A business above the CCPA revenue threshold that processed the personal information of 250,000 or more consumers, or the sensitive personal information of 50,000 or more, in the preceding year needs an independent cybersecurity audit, first due on 1 April 2028, 2029 or 2030 depending on revenue. The audit's component list reads like a backlog: phishing-resistant multi-factor authentication for staff and contractors, strong unique passwords checked against a list of common ones, encryption at rest and in transit, least-privilege roles with access revoked when a contract ends, just-in-time privileged access, and personal information tagged by classification. Whether your business meets those thresholds is for your own counsel.

A US enterprise security review now asks two questions that shape the architecture. The first is how fast you can say who was affected. California's breach law, as amended by SB 446, has since 1 January 2026 required notice to affected residents within 30 calendar days of discovering a breach, and delay is allowed only for law enforcement or to determine the scope and restore the system. A SaaS company holding its customers' data usually maintains rather than owns it, and the statute requires it to tell the owner immediately following discovery, so your detection and alerting sit on your customers' critical path. Notice is not required for encrypted data unless the key or credential was taken too, a username or email with a password counts as personal information on its own, and the CCPA lets consumers sue for $100 to $750 each per incident when nonencrypted and nonredacted data leaks through a failure of reasonable security. In the app that means keys held outside the database they protect, field-level encryption on the columns that matter, and access logs detailed enough to scope an incident in days. The second is where the people who can see the data sit. The Justice Department's Data Security Program at 28 CFR Part 202, in force since 8 April 2025 with due diligence and audit duties from 6 October 2025, restricts vendor and employment agreements that give covered persons access to bulk US sensitive personal data. Bulk starts at more than 100,000 people for identifiers, 10,000 for health or financial data and 1,000 for biometrics or precise geolocation, and data counts even when encrypted or de-identified. China, Russia, Iran and North Korea are among the countries of concern and India is not, but a covered person also includes anyone primarily resident in one of them or working for a company owned from one, so buyers ask for a written answer on team location, ownership and subcontractors. Whether a dataset crosses a threshold is for your own counsel.

US buyers often expect a bank debit in a web app to behave like a card payment. Through Stripe's ACH Direct Debit a payment can take up to four business days to report success or failure, a consumer can dispute it through their bank for up to 60 calendar days and a business account for up to two business days, those disputes are final with no appeal, and a dispute cancels the mandate the payment relied on. So the app needs a payment state machine with a real processing state, entitlements that can be withdrawn after an order looked paid, and stored proof of each authorization, because a bank can ask for it. The Nacha Operating Rules add duties for the business initiating the entries, which in Nacha's terms is usually you as the Originator even when a processor sends the file. WEB debits have required a commercially reasonable fraud detection system since 19 March 2021, explicitly including validation of an account number the first time it is used and whenever it changes, by micro-entries, a validation service or an API. Since 20 March 2026 a consumer's online purchase of goods by WEB debit must carry the company entry description PURCHASE, and wage credits must carry PAYROLL. The fraud monitoring rules that reached the largest originators on 20 March 2026 have applied since 19 June 2026 to every non-consumer Originator, third-party service provider and third-party sender: risk-based processes reasonably intended to identify entries that are unauthorized or authorized under false pretenses, reviewed at least annually. False pretenses means someone misrepresenting their identity, their authority to act for another person or who owns the account to be credited, which describes the fake email asking to change a supplier's bank details. In an app that pays out to vendors, sellers or staff, a change of payout details therefore gets out-of-band confirmation, a hold period and an audit trail. What your bank expects of you is for your bank and counsel.

How we work with US clients

A US engagement gets agreed twice. Once with the person who wants the thing built, and then again with legal, security, procurement and finance, who arrive separately and rarely in the same week. That second round is where a supplier outside the country loses the calendar: a master services agreement to redline, a security questionnaire, a certificate of insurance, and a vendor portal that assumes everyone it onboards can sign a W-9. Send all of it while the scope is still being written rather than in the week you wanted to start, and where the honest answer to a row is that we do not hold something, we write that in rather than leaving it blank.

You are also buying from a company you cannot drop in on, so the evidence has to do the work an office would otherwise do. What we send is live production URLs rather than a deck, a written scope with one fixed number against it, and the names of the people who will do the work rather than a bench that changes after signature. What we will also tell you is the shape of what you are hiring: a small team in Noida that has been building since 2021, not a firm that can put four more people on your project next Monday. If that is what your timeline needs, we say so before the contract rather than after it.

Questions US clients ask

Web Application Development: common questions

Other markets we work in