Loading…
How we build · Powered by Forge
Forge is the engine behind every Canarlo build. Auth, data models, payments, search, file uploads, admin tooling, security posture and deployment structure — already built, already audited, already proven.
That means a twelve-week engagement is spent on the product that belongs to you, not four months of plumbing every serious SaaS needs anyway.
Where the value comes from
12 weeks
from kickoff to production
Where a hand-written equivalent might take six months, and a traditional agency build can run to nine.
~50%
of a hand-written cost
£25k–£75k for what a custom-built equivalent quotes at £100k+ on the same scope.
18 patterns
of security, day one
Enforced structurally in every project. Not aspirational. Audited at every regen.
0 lock-in
plain TypeScript and Postgres
Your repo, your keys, your domains. Any competent engineer can read it.
Why Forge exists
Failure
01
A six-week discovery phase is a six-week tax on the prospect's hope that the project might still be on time. It produces decks. Decks do not authenticate users. Decks do not survive a customer trying to upload a 200MB PDF.
→ Forge starts with the foundation already built — so the first conversation is the only one that needs to be exploratory.
Failure
02
Auth. Authorisation. Per-row security. Payments. Webhooks. Audit trails. Search. File uploads. CSP. CSRF. Rate limiting. Migrations. These are solved problems. Every agency that solves them again from scratch is charging you for their team's learning curve.
→ Forge ships eighteen security patterns enforced structurally, by default, in every project — not aspirationally, in writing, on a slide.
Failure
03
The discovery call is with the principal. The Slack messages, three weeks in, are with someone who joined six months ago. The architecture, the schema, the security choices — made by the people with the least context. The cost of correcting course is paid by you.
→ At Canarlo, the person on the discovery call is the person designing the system, writing the code, and owning the decisions. Always.
How to use Forge
Week 1
01
We map the data model on a shared screen. The questions are about your domain, not your tech. By the end, we both know the schema, the failure modes you have already lived through, and the assumptions you have outgrown.
Week 2
02
I produce the typed configuration that Forge will assemble from. Content types, fields, relations, RLS posture, public routes, SEO targets, integrations. You sign it off. Once signed, the build is predictable.
Weeks 3–10
03
Forge emits the foundation on day one. The remaining eight weeks are spent on the part that is actually yours — domain logic, custom flows, the page-by-page surface, the integrations that earn the engagement. Staging is live and inspectable throughout.
Weeks 11–12
04
Production cutover, monitoring on, your team in the admin, a live playbook for the first two weeks of real users. Then the codebase is yours, on your domains, with your keys, with the regen path documented if you want to keep evolving.
Versus the alternatives
Traditional agency
Cost
£100k–£300k
Timeline
6–9 months
PM, producer, brand strategist, senior pitch, rotating delivery team. The foundation gets rebuilt from scratch, and you pay for the team's learning curve. By month five most of the budget is gone, the senior is on the next pitch, and you are correcting course in Slack with whoever picked up your ticket.
Best for: Right when the brief is fuzzy enough to need decks and the budget can carry the overhead.
Freelance developer
Cost
£20k–£60k
Timeline
4–8 months
Faster than an agency, cheaper, often genuinely skilled — but no foundation, no security baseline, no opinionated stack. The first month is auth. The second is the data model. The third is realising the deployment story was never thought through. Quality is whatever the freelancer's last three projects looked like.
Best for: Right for a known, narrow piece of work where the foundation already exists.
No-code platform
Cost
£3k–£15k
Timeline
2–6 weeks
Bubble, Webflow + Memberstack, Glide. Quick to a demo, fine for a landing page or an internal form. Hits a wall the moment the business needs custom workflows, real data integrity, real security, or any kind of scale — and you cannot escape the platform without rebuilding from scratch. The thing you save on month one becomes the rebuild you fund in month twelve.
Best for: Right for a validation prototype with a known exit if the business proves out.
Canarlo Forge
Cost
£25k–£75k
Timeline
12 weeks
The foundation is already built. Eighteen security patterns enforced from day one. Plain TypeScript and Postgres, your repo, your keys. The senior engineer is the person writing the code. Discovery is a call, maybe two — not a six-week deck-building exercise. The codebase is yours, regenerable, and reads like code a competent engineer can take in-house.
Best for: Right when the brief is real, the budget is finite, and the system has to outlive launch.
Side by side
Security baseline
Not aspirational. Not on a slide. Every Forge-shipped project carries them by default — caught at the generator, audited at every regen, present in code with a name on it.
Built to stand up to a security review
Studio principle
You can prompt your way to a demo. You cannot prompt your way to a business.
Founder-led
Canarlo is deliberately small. You are not passed from sales to project management to a rotating delivery team. You work directly with the engineer responsible for architecture, delivery, launch, and handover.
One inbox, one project thread, one person whose name is on the commits. The path from "we have a question" to "the question is answered" is measured in minutes, not handoffs.
Small on headcount, not on capacity. The parallel work runs across a rack of Apple Silicon in our Leeds office, around the clock — while the decisions and the code stay founder-led.
Engagement model
Most projects fall between £25,000 and £75,000. Twelve-week engagement: one week discovery, one week architecture, eight weeks production, two weeks launch support. The codebase is yours. The keys are yours.