Skip to content

01.03 / Build

Web apps and internal portals.

Internal portals, back office apps and operating systems built on Supabase, with row level security, roles, audit logs and Microsoft single sign on. Fixed price for a first phase, senior led from discovery to launch.

repository for the internal platform, the directory and the public siteGlobalia
1
modules delivered in Phase 1Elite Smart Build
11
The internal portal of a renovation company on a monitor in a site office: open tasks per job, material requests waiting for approval and who is on site today.

In detail

What you should know.

A supervisor in a glass booth overlooks a bus depot at twilight, his monitor showing a vehicle list and route map, radios charging on the desk

For example: 11 modules delivered in Phase 1. Elite Smart Build

What it is

An internal web application for the work your company actually runs on: the operations board, the back office, the client or supplier portal, the tool that today lives in a shared Excel and a chain of emails. Polargate builds it as a real application on Postgres, with named users, roles, permissions and a record of who changed what. It runs in the browser on any device, and it can be wrapped as an iOS and Android app when the work happens away from a desk.

How we do it

We start from your process, not from a template. In the Discovery Sprint we read the spreadsheets, the procedure documents and the email threads where the work is coordinated, and we turn them into a data model, a role map and a written scope for a first phase. Then we build. Security lives in the database: row level security enabled and forced on every table, roles as a Postgres enum checked by a function, sensitive fields such as commercial margin masked by role through a view, and an immutable audit log written by a trigger with an admin only viewer. People sign in through Microsoft Entra ID with the account they already have, or by email with a hardened password flow on your own domain. Every screen ships with its loading, empty and error states, keyboard access and 44 pixel touch targets. Before anything is handed over, the build goes through repeated adversarial audits: on the operating system we built for a hotel refurbishment contractor, one round produced 59 confirmed findings across bugs, security, interface and accessibility, all fixed before delivery.

What you get

What you take away.

Everything is written down before we start, and everything stays in accounts your company owns.

01Deliverables

  1. 01

    Data model built from your real spreadsheets, procedure maps and email threads, with an entity diagram you approve before we write code

  2. 02

    Row level security enabled and forced on every table, roles as a Postgres enum checked by a database function, sensitive fields masked by role through a view

  3. 03

    Immutable audit log written by a database trigger (who, what, when) with an admin only audit viewer

  4. 04

    Microsoft Entra ID single sign on, or email sign in with a hardened reset flow sent from your own domain

  5. 05

    Operational modules such as planning calendar, tasks by department, checklists, incidents with photos, material reception, suppliers and people

  6. 06

    Business day email alerts from scheduled jobs, plus file and photo storage and an in-app notification centre

  7. 07

    Mobile first interface with loading, empty and error states, keyboard access, focus management and WCAG AA contrast

  8. 08

    Handover of your own Supabase project, repository and hosting account, including schema, migrations, source code and keys

02How it runs

  1. 01 · Week 1 to 2

    Discovery Sprint

    Interviews with the people who will use the thing, an audit of the systems you already run, a data model, an architecture decision and a scope written in plain language. It ends with a fixed price and a delivery plan, and the document is yours whether or not you continue.

  2. 02 · Week 2 to 4

    Foundations

    Design direction, database schema with row level security from the first migration, environments, continuous integration and the first screens in a place you can open. Nothing is built on a platform you cannot leave: the repository, the backend and the hosting are created in your accounts.

  3. 03 · Week 4 to 8

    Build to the first shipped iteration

    Weekly deployments, a short written update with each one and a running list of decisions. The goal of this stage is a version in production with real data where someone can finish an actual task, not a demo. Scope changes are priced before they are built.

  4. 04 · Week 8 onwards

    Audit, launch and handover

    Several review passes over correctness, architecture, accessibility, performance and security, with every finding checked by a second reviewer before it counts as real. Then the launch, the handover pack and, if you want it, a move to the CARE retainer for maintenance and evolution.

For example: 11,421 characters of real content an AI crawler gets from a news page. Globalia

Who it is for

We don't take every project.

We would rather tell you now than halfway through. If you recognise yourself on the left, let's talk.

It fits if

  • You need a website, a portal or an app that does not exist yet, or one that has run out of road
  • You want the code, the data and the hosting in accounts your company owns
  • You prefer a fixed price before work starts to an open hourly bill
  • Someone on your side can decide and give the project a few hours a week
  • You care that Google and AI assistants can read it from day one

It is not for you if

  • You are after a cheap template or a site put together over a weekend
  • You want it to live on a platform you cannot leave later
  • Nobody on your side can review screens or make decisions
  • You need people to bill hours without a clear goal

For example: 23 Postgres tables with row-level security forced. Elite Smart Build

Timing and budget

How we quote.

No price list and no hourly billing during a build. After a short call you get a written quote for your project.

Timeline
Discovery Sprint of about two weeks, then a first testable version roughly one month after development starts. A complete first phase is around eight effective weeks of work, which usually spans three to five calendar months depending on your review and decision cycles.
Team
Our team runs the discovery with you, models the data and builds the portal through to launch. Pedro Ciordia, founder and CTO, signs off the data model and the architecture and reviews every release. No juniors learning on your budget.
How the price is set
Fixed price for a first phase, closed after a Discovery Sprint and payable in monthly instalments if that suits your cash flow. Care after launch. The quote is private and comes in writing after a first call.
The stack
ReactViteTypeScriptTailwind CSSshadcn/uiSupabasePostgreSQLDenoMicrosoft 365Microsoft Entra IDResendVercelGitHub ActionsTanStack QueryZodVitestCapacitor

For example: 707 archived news articles now readable by AI crawlers. Globalia

FAQ

What people ask us.

How much does an internal portal or back office app cost?
It depends on how many modules, roles and integrations the first phase carries. Polargate closes the price before work starts, based on the written scope produced in the Discovery Sprint, and sends it to you privately. We do not bill by the hour, and the build can be spread over monthly instalments. Book a call and you get a first read of scope, timeline and price.
How long does it take to build an internal web app?
Expect a first testable version about a month after development starts, and a complete first phase in roughly eight effective weeks of work, which normally spans three to five calendar months. The calendar time depends mostly on your side: decisions, content and access to the people who know the process. We deploy to production continuously, so your team is using parts of the system long before the phase closes.
Can our employees log in with their Microsoft account?
Yes. Polargate connects the portal to Microsoft Entra ID, so people use the corporate account they already have and your own conditional access and offboarding rules apply. We have done this on the employee portal of a corporate group with several brands, whose directory is synced from Microsoft Graph. Where Entra ID is not available, we set up email sign in with a hardened reset flow sent from your own domain.
How do you stop one department from seeing another department's data?
Permissions live in the database, not only in the interface. Every table has row level security enabled and forced, roles are a Postgres enum checked by a database function, and sensitive fields such as commercial margin are masked by role through a view. That means data cannot leak by calling the API directly or through a mistake in one screen. A trigger writes every change into an immutable audit log with the user behind it.
Do we own the system, or are we locked into your platform?
You own it. The application runs on your own Supabase project, your own repository and your own hosting account, and you receive the schema, the migrations, the source code and the keys. Polargate does not keep your data on a shared platform and charges no licence fee for software built for you. If you stop working with us, the system keeps running and another team can pick it up.

For example: 10 role-based accounts live on the client's own domain. Elite Smart Build

Get started

Tell us what you want to build.

Websites, apps, custom systems and AI for companies that need them in production in weeks. Fill in the form or book a 30 minute call: a senior engineer answers within 48 business hours with a first take on scope, timeline and price.

What do you need?
Budget
When

At least ten characters.

Answer in writing within 48 business hours. No newsletter, no automatic sequence.

Rather answer the full brief?

First step

Discovery Sprint

Two weeks to close scope, architecture and price before anything is built.

No price list. You get a private quote, in writing, after a short call.

Then, to build, always at a fixed price

Not ready yet?

AI-native digital studio for mid-market companies

POLARGATE, S.L. · CIF B24895005
Calle Electrónica 6, 28027 Madrid, Spain