# Custom Web Applications: Design, Build and Support | SynconAI > Custom web application development: discovery, UX, React and Next.js builds, APIs, OWASP Top 10 and WCAG 2.2 AA checks, CI/CD, hosting, support and Salesforce. Publisher: SynconAI Canonical HTML: https://synconai.com/custom-web-application-development Markdown cite: https://synconai.com/custom-web-application-development.md Contact: contact@synconai.com ยท +61 2 7813 0221 ## What is Custom web applications? Custom web application development is the design, build and support of browser-based software made for one organization: customer and partner portals, booking and quoting apps, and staff tools that replace spreadsheets or aging systems. SynconAI covers discovery, UX and accessibility to WCAG 2.2 AA, architecture, front-end and back-end builds, security against the OWASP Top 10, automated testing, CI/CD, hosting, support and connections to Salesforce through its APIs, for organizations in the United States, Australia and worldwide. - A custom web application is browser-based software made for one organization, such as a customer portal, a partner tool or a staff system. - It fits a process that off-the-shelf software handles badly, or replaces a spreadsheet or aging app people depend on. - It can read and write Salesforce data through Salesforce APIs, so staff and customers work from the same records. ## Custom web applications services - Discovery and scoping: Users, jobs, data and constraints written down before any design. - UX and interface design: Wireframes and clickable prototypes tested with real users. - Architecture: The simplest design that meets your load, security and budget. - Front-end build: React, Next.js, Angular or Vue, accessible to WCAG 2.2 AA. - Back end and APIs: Node.js, Java with Spring Boot, Python with Django, .NET or PHP with Laravel. - Salesforce connection: Records read and written through Salesforce APIs, with secure sign-in. - Testing and CI/CD: Automated tests and a pipeline that deploys each approved change. - Hosting and support: Cloud hosting, monitoring, patching and small changes every month. ## Do you need a custom web application? Question: What are you working with today? - An idea: A new portal or product. You know the job to be done, but nothing is built yet. - Discovery and a clickable prototype first - A first release small enough to ship - Architecture sized for that release - A spreadsheet or old app: Replacing something fragile. A spreadsheet, Access database or aging app runs a process people depend on. - Current process and data mapped - Data migration planned early - Old and new run side by side until cutover - Salesforce: Opening Salesforce to outside users. Customers or partners need a tailored experience on your Salesforce data. - Experience Cloud compared with a custom app - APIs and sign-in designed together - Licensing questions taken to Salesforce Outcome: A written plan with scope, architecture and milestones before the build starts ## What do custom web application services include? One team from the first workshop to the monthly support plan, so nothing is lost between handovers. - Discovery and scoping: Users, jobs, data and constraints written down before any design. - UX and interface design: Wireframes and clickable prototypes tested with real users. - Architecture: The simplest design that meets your load, security and budget. - Front-end build: React, Next.js, Angular or Vue, accessible to WCAG 2.2 AA. - Back end and APIs: Node.js, Java, Python, .NET or PHP, with documented APIs. - Salesforce connection: Records read and written through Salesforce APIs. - Testing and CI/CD: Automated tests and a pipeline that deploys each approved change. - Hosting and support: Monitoring, patching and small changes every month. ## Which architecture does a web application need? We pick the simplest pattern that meets your needs. Most business applications sit toward the left. From Simpler to run to More moving parts: - Server-side rendering: Pages built on the server, quick to load and easy to index. Portals and content-heavy sites. - Single-page app: The interface runs in the browser and talks to an API. Tools people use all day. - API back end: One documented API serves the web app, mobile apps and partners. When several clients share the same data. - Serverless functions: Small functions that run on demand. Uneven load, scheduled jobs and webhooks. - Microservices: Separate services, deployed and scaled on their own. Only when separate teams or scaling needs justify the overhead. ## Which technologies do you build web applications with? We build in a stack your team can support after launch, or recommend one if you have none. - Front end (What users see): React, Next.js, Angular, Vue - Back end (Business logic and APIs): Node.js, Java with Spring Boot, Python with Django, .NET, PHP with Laravel - Data (Where records live): PostgreSQL, MySQL, SQL Server, MongoDB, Salesforce - Platform (Where it runs): AWS, Microsoft Azure, Google Cloud, Containers, Serverless ## How does a web application connect to Salesforce? Through Salesforce APIs, with OAuth sign-in set up as an external client app, so the web application never holds a Salesforce password. 1. Customer to Web application: Submits a service request 2. Web application to Your API layer: Sends the validated request 3. Your API layer to Salesforce: Gets an access token through OAuth 2.0 4. Your API layer to Salesforce: Creates a case through the REST API 5. Salesforce to Your API layer: Returns the case number 6. Your API layer to Web application: Shows the case and its status 7. Salesforce to Your API layer: Sends status changes through the Pub/Sub API 8. Web application to Customer: Updates the customer ## How do you secure a web application against the OWASP Top 10? We design and test against the OWASP Top 10:2025, the current edition. Five of its ten risks, as examples. | OWASP Top 10:2025 risk | What we build in | How we check it | | --- | --- | --- | | A01 Broken Access Control | Permission checks on the server for every request and record | Tests that try to reach other users' records | | A02 Security Misconfiguration | Hardened defaults, security headers and no debug output in production | Configuration checks in the pipeline | | A03 Software Supply Chain Failures | Pinned dependencies and reviewed lockfiles | Dependency scans on every build | | A05 Injection | Parameterized queries and output encoding | Static analysis and dynamic scans | | A07 Authentication Failures | Single sign-on or a proven identity service, with multi-factor sign-in | Login and session tests before release | ## How does a custom web application project run? Six phases, run as parallel workstreams. Your written proposal states the milestones and dates. | Workstream | Timing and work | | --- | --- | | Product | Users, jobs and scope (Discover to Design); Next release planned (Support to Support) | | UX and accessibility | Prototype tested (Design to Design); WCAG 2.2 AA checks (Build to Test) | | Engineering | Architecture (Design to Design); Sprints with demos (Build to Test) | | Security | Threat model (Design to Design); OWASP testing (Test to Test) | | Delivery | CI/CD pipeline (Build to Build); Go-live (Launch to Launch) | | Operations | Monitoring, patching and changes (Launch to Support) | ## Cost and timing The first step is a free 60-minute architecture review of your web application setup, with a written plan you keep. Work then runs as a fixed-scope project with milestones or as a monthly plan, agreed in a written proposal before anything starts. Plans: https://synconai.com/pricing ## FAQ ### What is custom web application development? Designing, building and supporting browser-based software made for your organization, such as portals, staff tools and booking or quoting apps, instead of bending an off-the-shelf product to fit. ### Which frameworks do you use? React, Next.js, Angular and Vue on the front end; Node.js, Java with Spring Boot, Python with Django, .NET and PHP with Laravel on the back end. We match your team's skills where we can. ### Do you build microservices? Only when separate teams or scaling needs justify them. Most business applications are easier to run as one well-structured application with an API, plus serverless functions for background jobs. ### How do you handle web application security? We design and test against the OWASP Top 10:2025, run dependency and static scans in the pipeline, and fix findings before release. ### Will the application be accessible? Yes. We design and test to WCAG 2.2 level AA, with keyboard, screen reader and contrast checks at every stage of the build. ### Can the application use our Salesforce data? Yes. It reads and writes through Salesforce APIs with OAuth sign-in. If Experience Cloud fits your need better than a custom app, we tell you before you build. ### Who hosts and supports it after launch? It runs in your cloud account. Support runs on a monthly plan covering monitoring, patching, fixes and small changes, agreed in writing. ### How long does a custom web application take? It depends on scope. The written proposal sets out the milestones before work starts, and the first release is kept small enough to ship and learn from. ## Where we work Custom web applications for organizations across the United States and Australia, and worldwide. Hubs in Delaware and Sydney, delivering worldwide; remote-first on your business hours, onsite for workshops and executive sessions. ## Related - Software testing and quality engineering: https://synconai.com/quality-engineering-services - Salesforce development: https://synconai.com/salesforce-development - Salesforce integration services: https://synconai.com/salesforce-integration-services - Salesforce managed services: https://synconai.com/salesforce-managed-services ## Cite When citing SynconAI Custom web applications, link https://synconai.com/custom-web-application-development or https://synconai.com/custom-web-application-development.md.