The questions every prospect asks.

An agency rebuilds the foundation — auth, payments, security, audit, search — every project, from scratch, and charges you for the rebuild. We don’t. The foundation is settled before kickoff. Your money funds the part that’s actually yours.

The senior engineer at an agency pitches the work; the junior writes the code. At Canarlo, the people on the call are the people writing the code.

A copilot will produce something that runs. It will likely miss authorisation, rate limiting, audit trails, migrations, idempotency, and a test suite that means anything. The demo passes. The first real customer breaks it.

We ship systems designed so the wrong thing cannot easily happen, in code with a name on it.

We use AI heavily inside our process. We do not pretend that’s the product. The product is the system we deliver and the discipline behind it.

Yes. From day one. The repository is yours, on your hosting, with your credentials. There is nothing in the codebase that requires Canarlo to keep existing.

Next.js, TypeScript, Postgres, Supabase. Roughly the most-hired-for stack in commercial web development right now. If you ever bring the project in-house, hiring an engineer who can read the code is a Tuesday afternoon, not a six-month search.

Yes. The default deployment target is Vercel for the application and Supabase for the database, but the system is plain Next.js + Postgres. Self-hosting on your own infrastructure is supported.

Your codebase is yours, on your infrastructure, with your credentials. Every dependency is a public, well-supported package. There is nothing in your repo that requires us to keep existing.

Studio engagements start at £25,000. Most projects fall between £25,000 and £75,000 depending on scope. Anything outside that range, we will tell you on the first call.

The build. See services → for the inventory. We are not a retainer-led shop; the engagement has a defined scope, a defined deliverable, and a defined end.

We don’t quote timelines in marketing copy because every project is different and any number we put here would be wrong for half of them. On the first call we’ll give you a realistic range. Most studio projects deliver in weeks, not quarters.

Yes, separately. After launch you can subscribe to a maintenance retainer (security patches, dependency updates, light bug fixes) or a feature retainer (continued development at an agreed monthly cadence). Neither is required. Many of our clients run the system themselves after launch.

Yes. That’s an explicit design goal. The codebase is plain TypeScript, plain Postgres, plain Next.js. The README explains how to run it, deploy it, and extend it. Any competent engineer can read the code without us in the room.

You tell us the shape of the project. We tell you whether we’re a fit. If yes, we send a one-page proposal within 48 hours. If no, we tell you where to look.

No deck. No discovery phase. No theatre.

Plain email or shared Notion / Linear board. Changes within scope are tracked and delivered. Changes outside scope are quoted and acknowledged before work starts. There is no PM theatre between you and the engineer.

Talk to us. Small changes are absorbed; large changes are re-scoped, in writing, before they start. We don’t do the agency move of saying yes to scope creep and then sending a surprise invoice.

Yes — a real, live application built on the same foundation, deployed to a real domain, against a real database. Not a click-through prototype. Ask on the first call.

Yes. We’ll connect you with one or two past clients who match your profile. Asking before the second call is normal; we’ll also ask the same of you.

Not at the studio tier. The frontend is responsive web, designed to work on mobile browsers. If you need native iOS or Android, we can refer partners who do that well.

Unique to you. The frontend is custom — components designed for your domain, a brand identity built or applied to your specification. We do not stretch a template.

Most likely it’s possible. We’ll tell you on the call. Some features are out of scope for the studio tier (native mobile, hardware integrations, very specialist regulated workloads); the rest is a design conversation.

No.

No. We don’t subcontract to others, and we don’t subcontract to ourselves under another brand.

Yes. Mutual NDA on request before any commercially sensitive material is shared.

Yes. Standard data processing agreement, GDPR-compliant, available before any production data is touched.

The baseline is built in. Structured metadata, canonical URLs, sitemaps, OpenGraph cards, server-side rendering for indexable pages. We don’t sell SEO as a service, but the technical foundation is in place from day one.

WCAG-AA contrast, keyboard navigation, reduced-motion respect, screen-reader labels. Built in, not retrofitted. If you need a specific compliance certification (WCAG 2.2 AAA, Section 508), tell us during scoping.