Technology

Back end, data and hosting: the parts nobody sees until they fail.

Users judge a product by its screens. You will judge it, over years, by whether it stays up, keeps data safe and costs what you expected. Those depend on the parts behind the screens. Here is how we think about them.

The back end: keep it simple and well-organised

The back end holds the rules of your product: who can do what, how a booking is confirmed, how an invoice is totalled. For most businesses we favour one well-structured application split into clear modules — sometimes called a modular monolith — written in TypeScript. It is the quickest to build, test and run at this scale, and it can be split into separate services later if real load demands it.

Splitting into many small services early sounds modern but adds cost and failure points. It is worth it only when the scale or the team justifies it.

The database: a dependable default

  • PostgreSQL is our usual choice: a mature, widely understood relational database that suits the great majority of business applications without tying you to a niche product.
  • Managed services run it for you, including backups and updates, so your team is not the one watching it at 3 a.m.
  • Other databases have their place — a document store, a search engine or a cache for particular jobs — but we add them when a need appears, not before.
  • Firebase and similar services can speed up simple apps and prototypes. We weigh the speed against how closely it ties you to one vendor and how it handles your reporting and data-export needs.

Hosting: where it runs

  • Managed cloud platforms reduce operational work and scale with demand. They are our default for applications.
  • Simple static hosting is enough for many websites, and very cheap.
  • Location matters. Hosting in or near Hong Kong can improve speed for local users and may matter for your data policies. Some providers have regions in Asia; check what each offers.
  • Accounts in your name. You should own the hosting and domain accounts, with us given the access we need.

Security and reliability basics

  • Encryption in transit with https, and for sensitive data at rest.
  • Access control. Role-based access, strong sign-in and, where the risk justifies it, two-factor authentication.
  • Secrets management. Keys and passwords kept out of the code and out of the browser.
  • Backups that are tested. A backup is only real if someone has restored from it.
  • Updates. Dependencies and platforms need regular security patching.
  • Monitoring. Alerts when the service is down or behaving oddly, and a plan for who responds.
  • A recovery plan. What happens, in what order, if something goes badly wrong.

We do not claim security certifications. For regulated work, your own requirements decide which controls are needed; see finance and insurance.

What it costs to keep running

Hosting for a small business application is often modest, but it grows with usage. Add third-party services (payments, email, messaging, maps, AI), monitoring, and the time spent on updates and fixes. Ask for these running costs, in writing, alongside the build price. See what apps and websites cost.

Keep reading

Related guides: security basics for small business software.

Worried about reliability or data?

Tell us what the product holds and what an outage would cost you. We will propose a proportionate set-up.

Request a project quote