No fixed menu. These are the categories where we do our best work — if your project sits between them, that's usually still us. Based in Knoxville, TN; working remotely with clients across the United States.
Custom Web Applications
Laravel, a modern frontend, real auth. Production systems.
We build custom web applications end to end in Laravel — the schema, the API, the frontend, the deploy, the on-call. Most builds use Blade + Tailwind for a fast, server-rendered UI; React or Vue shows up only when the product genuinely needs a single-page app. We do real authentication (sessions, CSRF, password reset flows that survive a security audit, 2FA where it matters), real authorization (role + permission models that hold up under multi-tenant access), and migrations you can run on a 50-million-row table without taking the site down. The deliverable is a working system you can hand to another engineer, plus the documentation to keep it running.
LaravelPHPCustom web appBladeTailwindMulti-tenant
Backend & APIs
OAuth, PKCE, server-authoritative APIs, integrations that don't go down at 3am.
APIs are where most projects quietly fail — bad token flows, optimistic clients, no idempotency, retries that double-charge. We design backends that assume the network is hostile and the client is wrong: server-authoritative state, idempotent writes, OAuth 2.0 + PKCE for mobile and game clients, refresh-token binding, rate limits that distinguish abuse from a burst of legitimate traffic. We have shipped OAuth flows for Unity game clients, webhook integrations with Mailgun and Stripe, and signed APIs that survive replay attacks. If your existing API is brittle, we will rewrite the parts that are dangerous and leave the rest alone.
Audit-logged, encrypted, hardened. Built like the data matters, because it does.
For systems that sit alongside protected health information, we work under a Business Associate Agreement and follow your security officer's controls. Default posture: encryption at rest and in transit, append-only audit logging on every read and write of sensitive records, role-based access tied to provisioned identities (not shared logins), session and token expiration that errs short, secure self-hosted backups with documented restore drills, and an incident playbook before launch. We are not a covered entity ourselves — we are the engineering team that builds the system to your compliance standard and walks your auditors through it. If you are pre-BAA and trying to figure out scope, we will help you map it.
HIPAABAAComplianceAudit logEncryption at restHealthcare software
Game & Real-Time Systems
Unity clients, online sync, persistent state. The whole loop.
We build the whole game loop, not just the part you see. Unity (C#) for the client, Laravel for the persistence and economy layer, OAuth/PKCE for the launcher login, server-authoritative saves so cheating costs more than playing honestly, and a card / inventory / currency system that survives reconciliation. The studio's own Foduel — a real-time, multiplayer browser trading card game with a dedicated rules engine — runs all of the above in production as a live testbed; it is the same architecture we recommend to clients building games with persistent state, live ops, or multi-device sync. If you have a Unity prototype and need the backend to make it real, that is the work we want.
Bring your stack onto your own metal. Set it up, harden it, hand you the keys.
Managed PaaS is convenient until the bill is a multiple of bare-metal and you cannot answer where your customers' data physically lives. We set up self-hosted Linux infrastructure end to end — nginx, PHP-FPM, Postgres or MySQL, Cloudflare Tunnel (no exposed ports), self-hosted mail relay through Mailgun, automated backups, log shipping, monitoring. We harden the box (SSH key-only, fail2ban, unattended-upgrades, audit logging, least-privilege service accounts) and hand you a runbook so your team can operate it without us. We will also operate it for you under a maintenance retainer if that is what you want.