Web Apps · Canarlo, Leeds
Production web apps for technical founders
Next.js 16, Supabase, your cloud, your code. Canarlo builds production web apps for technical founders — SaaS, ecommerce, CRMs, content systems — deployed to your account, owned by you, with eighteen security patterns enforced by default.
The buyer
When you need a real web app (not another Wix site)
You have outgrown the no-code build, or you are starting something that was never going to ship on Bubble in the first place. A real auth model. A real audit trail. A migration path that does not require rebuilding when the vendor pivots. The seams in Webflow and Wix do not show until a real customer pastes in real data — then the missing RLS, the brittle integration, the lack of a queue all surface at once.
We build for technical founders. The buyer who can read the diff. Who has already costed the no-code path and noticed the per-seat pricing does not stay sane past fifty users. Who needs a custom checkout, a custom data model, a custom admin surface — not a theme dressed up as a product.
We are not the right fit for a marketing brochure site — a static page on Framer costs a hundredth of what we do. Not the right fit for a pre-validation throwaway — go validate it on no-code, come back when the spreadsheet breaks. Not the right fit for a hobby project — the work is for businesses with paying customers and a P&L.
What we ship
Four solutions we ship
Solution
SaaS
A product your customers log into and pay for monthly. Multi-tenant from day one, Stripe wired to real webhooks, audit trail on every write. Not a Bubble app dressed up.
Solution
Ecommerce
A storefront with custom checkout, real inventory rules, and the integrations Shopify charges per-app for. For brands that have outgrown the theme store and need their margin back.
Solution
CRM
Your sales process, not HubSpot's idea of it. Custom pipelines, role-based access, the seven workflows your team already does in spreadsheets — moved into one tool they will actually open.
Solution
CMS
An editorial system marketing can run without a developer. Draft, preview, schedule, publish. Block-based pages, custom content types, structured data on every URL. No WordPress plugin tax.
Foundations
What every build ships with
Authentication with MFA and audit trails
Sign-up, sessions, password reset, magic link, TOTP. Every login event logged with IP and user agent. Roles enforced at the database, not just hidden in the UI.
Stripe payments, billing, subscriptions
Real webhooks, dunning, grace periods, refunds, the billing portal your customer service team will not have to email Stripe to use. Receipts, invoices, tax handling.
Hybrid search (keyword + trgm)
Full-text plus trigram fuzzy matching inside Postgres. Typos do not break results. Indexed at the database layer — no Algolia bill, no third service to keep alive.
RLS-backed data isolation
Per-row security enforced at the database, not in the page that renders the list. A misrouted query returns nothing — not someone else's data.
File uploads with MIME validation
Magic-byte check before the file lands in storage. Per-field size limits, filename sanitisation, automatic rollback on database failure. Renamed `.pdf.exe` does not slip through.
Observability (logs, traces, metrics)
Structured JSON logs with sensitive fields redacted. Error reporting wired to Sentry. Latency and error-rate dashboards live before launch — not retrofitted after the first outage.
CI/CD with deployment previews
Every pull request gets a live URL. Tests run on every push, type-check and lint gate merges. Deploys are a button, rollback is a button.
Deployment to your cloud (Vercel + Supabase)
Your Vercel team, your Supabase project, your domains, your keys. We deploy with your credentials and walk off at handover. No agency-held infrastructure.
Recent builds
Recent builds
Case study · Placeholder
Specialist recruitment platform
Candidate-to-role matching, role-based admin, structured search. Built as a production system. The client owns the code, the schemas, the data — we keep one retainer day a month.
Case study · Placeholder
Subscription scoring platform
Custom scoring, live leaderboards, Stripe billing, an admin tool the founder runs without us. Multi-tenant from day one. Profitable, owned outright, still running on its own keys.
Case study · Placeholder
DTC ecommerce migration
A storefront moved off an off-the-shelf platform. Custom checkout, inventory rules per drop, email wired to real events. Their cloud, their code, their margin back.
Pricing
Pricing
Fixed fee, scope written down before billing starts. The £25k MVP is a single domain, the foundations in full, one paid integration. The £100k engagement is a multi-tenant SaaS with payments, search, an admin tool, and a year of headroom in the schema.
Tiers from £25k MVP builds (12–16 weeks) to £100k+ production engagements. Pricing transparent on our cost page.
Full pricing rationale and cost breakdown: How much does AI engineering cost?
Frequently asked
Questions technical founders ask before they engage.
What's your tech stack?
Next.js 16, plain TypeScript, Supabase Postgres with row-level security, Vercel for hosting by default — self-hosted on your infrastructure if you prefer. Stripe for payments. No framework magic, no proprietary runtime. Any competent engineer can read the diff. The on-call engineer can debug at two in the morning.
How long does a typical build take?
Three phases. Two weeks discovery, two weeks architecture, eight to twelve weeks production. An MVP from twenty-five thousand ships inside that window. Full builds run longer — sized in the architecture phase, not guessed at kickoff. Every phase ends with a concrete artefact: a brief, a schema, a deployment.
Who owns the code?
You. Your repo, your Vercel account, your Supabase project, your Stripe account, your domains, your keys. No Canarlo SaaS in the loop. No licence fees. The handover doc names every environment variable and every cron. You can sack us tomorrow and the system keeps running.
What if our scope isn't clear yet?
Then we start with discovery. Two weeks, fixed-fee — one scoping call, a written brief, the load-bearing pieces named and the failure modes mapped. No decks. No workshops. You leave with enough to commit to architecture or to take the brief to another studio. Either is fine.
Can we extend the build after launch?
Yes. Either retainer from fifteen-hundred a month for continued development, or scoped follow-on engagements for larger features. Same engineer leads — not a new account team. Or take it in-house: the codebase is plain TypeScript, the handover doc is thorough. Most clients do a mix.
What about hosting?
Vercel and Supabase by default — billed direct to your accounts, never marked up through us. Self-host on your own infrastructure if you prefer; the stack is portable. Backups automatic, logs structured, uptime monitored. The hosting bill is yours from day one.
Start here
Ship a real product. Own the code. Sleep on Friday.
Twenty-minute call to scope the work. Or send a written brief — proposal in your inbox inside forty-eight hours.