Services

What's included

• Frontend — TypeScript (React / Next.js)

  App Router, Server Components, type safety with Zod. UI/UX that on-site staff can use without friction.

• Backend — Python (Flask + SQLAlchemy)

  Heavy parallel batch jobs (PDF/Excel generation), complex business logic, and SQL-injection protection via the ORM.

• Authn/authz — rigorous AWS Cognito design

  Per-attribute page- and API-level authorization separation, asset protection with signed URLs.

• Database — SQL and NoSQL, used deliberately

  RDS + ORM for transaction-heavy work, DynamoDB for scale — designed around the trade-offs of each.

• Security — OWASP Top 10 coverage

  Double validation with Zod + Marshmallow, vulnerability testing with OWASP ZAP, dependency scanning in CI.

• Infrastructure — reproducible config with Terraform (IaC)

  ECS/Fargate, RDS, CloudFront, SES, and ALB all managed as code. Zero environment drift.

What's included

• Fast APIs on AWS Lambda (Node.js / Python)

  No server management, auto-scaling, request-based billing. Cold-start mitigation included.

• Scalable NoSQL with DynamoDB

  Single-digit-ms responses, unlimited scale, global tables, optimized partition design.

• Secure APIs with API Gateway + Cognito

  JWT auth, custom authorizers, API keys, rate limiting (throttling).

• Terraform (IaC) + GitHub Actions CI/CD

  Auto-deploy on PR merge, fully separated environments, blue-green incremental migration.

• Cost optimization

  In the low-traffic early phase, production can run for a few hundred to a few thousand yen a month.

What's included

• RAG systems with AWS Bedrock / Claude / GPT

  Vector search with pgvector and Pinecone. Embeddings + LLM deliver 90%+ accuracy in responses.

• Ultra-fast development with Claude Code

  AI pair programming automates code generation, refactoring, and test authoring.

• Cloud-native design (ECS/Fargate, Vercel)

  Container-based backend, edge-delivered frontend, all managed with Terraform IaC.

• Full-stack TypeScript + Python

  Fast UX with the Next.js App Router; AI processing and data pipelines in Python (FastAPI/Flask).

• Voice AI & internationalization

  Whisper (transcription), Amazon Polly (speech synthesis), and next-i18next for global rollout.

What's included

• Tech selection & architecture review

  Technology choices with explicit trade-offs; architecture design support that weighs extensibility and maintainability.

• Code review & pair programming

  PR reviews, design reviews, and leveling up the team. Catch anti-patterns and instill design principles.

• Security-minded review & compliance support

  Within the advisory contract, design and PR reviews also through an OWASP Top 10 lens, plus organizing the authn/authz and security requirements B2B SaaS needs. A scoped, one-off audit is the separate web app security audit.

• Development process & CI/CD improvement

  Faster GitHub Actions, test strategy, deploy strategy, rollback design.

• Hiring support & technical interviews

  Acting as a technical interviewer, authoring coding challenges, and job-description design support.

What's included

• SAML / OIDC IdP integration

  Azure AD / Entra ID, Okta, Google, generic OIDC. Host multiple IdPs in one user pool and switch per customer.

• Multi-tenant token design

  Inject tenant_id into the access token with Pre Token Generation V2.0 and use it consistently in backend authorization.

• JWT verification & authorization review (RS256)

  Verify iss/aud/client_id/token_use with aws-jwt-verify, through to detecting tenant-boundary crossing on issued tokens.

• In-house Cognito vs. specialist SaaS decision

  Decide between in-house Cognito and Auth0/WorkOS by cost at scale, AWS affinity, SCIM need, and team.

• Passwordless authentication design

  A hybrid of USER_AUTH (passkeys/OTP) and federation, switching methods on the login screen.

What's included

• Source review of authorization and tenant isolation

  Whether changing an ID exposes someone else’s data (IDOR), and whether one customer can reach another’s — on every path.

• Supabase RLS and service_role paths

  Not just whether RLS is on, but whether the conditions are right — and the keys and functions that bypass it.

• Vercel and AWS / GCP configuration review

  Environment separation, preview protection, least privilege — the deployment settings checked against the code.

• Pre-launch review for AI-built apps

  Apps built with Claude Code, Cursor, Lovable and the like, reviewed for owners who can’t read the code.

• Fixes and retest

  Not just a report: fixes, regression tests, CI gates and a retest are available.

What's included

• Website review

  Find where people stop — impressions, clicks, visits or enquiries — and get the order of fixes.

• Search Console / GA4 setup

  Sort out settings and access, and measure form submissions and traffic sources.

• Ongoing monthly improvement

  Set a monthly cap on hours, then repeat: check, fix, measure.

What's included

• Contact-form fixes

  Easier input, spam protection, and confirming that messages really arrive.

• Partial page fixes

  Better structure and page speed for product, capability and recruitment pages.

• Maintenance and outside web support

  Take stock of domain, server and CMS access, and agree update and incident steps.

What's included

• Copying and totalling

  Automate loading and totalling Excel and CSV data, and catch input errors.

• Documents and PDFs

  Produce quotes, delivery notes and invoices from data.

• Quote request management

  Bring intake, assignment and status into one ledger.