How we build

How We Engage

Every Zypher project begins with a free discovery call. We listen first — understanding your business goals, technical constraints, and user needs before suggesting any solution. After discovery, we produce a written specification that becomes the shared contract for delivery.

We operate in two-week sprints with a demo at the end of every cycle. You review, give feedback, and we adjust. There are no hidden surprises at handoff because you see the product being built in real time.

A typical Zypher discovery session — we listen before we build.

Project Kickoff

The kickoff call happens within 48 hours of contract signing. It covers team introductions, tooling setup, communication channels, and a walkthrough of the agreed specification. By the end of week one, your codebase exists, CI is running, and the team is shipping.

Communication Norms

We believe great software is built on great communication. Here's what every Zypher engagement looks like from a communication perspective:

Handoff & Ownership

Full IP and codebase ownership transfers to you on final delivery. We don't retain any rights to the code, designs, or documentation produced during your engagement.

Every project ends with a handoff session — we walk your team through the architecture, deployment process, and known gotchas. We also produce a written runbook so any engineer can take over confidently.

Code Review Policy

No code merges to main without a peer review. Every pull request must have at least one approval from a Zypher engineer who wasn't the author, with automated checks passing first.

Git Branching Strategy

We follow a trunk-based development model with short-lived feature branches. main is always deployable.

Testing Requirements

We bake testing into the development cycle — not bolted on at the end. Every service has unit, integration, and a subset of end-to-end tests before it ships to staging.

Deployment Workflow

Deployments are automated, gated, and reversible. Every push to main triggers a pipeline that promotes code through environments only after all checks pass.

Frontend Architecture

We default to Next.js App Router with React Server Components for web projects, and Flutter for cross-platform mobile. All UIs are built against a component library generated alongside the design system.

Backend & API Design

REST by default, GraphQL when the client demands it. Every API is versioned, rate-limited, and returns standardised error shapes so frontend teams never have to guess.

Database Conventions

PostgreSQL is our default. We use Prisma as an ORM for type safety, with raw SQL for complex queries. All schema changes go through versioned migrations — never direct schema edits in production.

Cloud & Infrastructure

All infrastructure is defined as code (Terraform), version-controlled, and reproducible across environments. We avoid console-clicking infrastructure at all costs.

LLM Integration Patterns

We integrate LLMs as structured services with retries, fallbacks, and cost caps — not fire-and-forget API calls. Every prompt is versioned and monitored.

Data Pipeline Setup

Data pipelines are built for reliability first. Every pipeline has a dead-letter queue, alerting on failure, and idempotent processing so re-runs never duplicate data.

Model Evaluation

Before shipping any model change to production, we run a structured evaluation against a golden dataset. Regressions in accuracy, latency, or cost block the release.

OWASP Top 10

Every project goes through an OWASP Top 10 checklist before launch. Here's how we address the most common categories:

Auth & Session Management

We use proven auth providers (Auth.js, Clerk, Supabase Auth) rather than custom implementations. Session tokens are short-lived, rotated on use, and invalidated server-side on logout.

Secrets Management

No secrets in source control — ever. All credentials are injected at runtime via environment variables, secret managers, or Vault, depending on the project's compliance requirements.

Penetration Testing

We conduct penetration testing before every major release and on an annual schedule for long-running products. Tests are performed by a third-party firm — not the build team.