Custom software development in Utrecht.

Utrecht is not a copy of Amsterdam or Rotterdam. The city revolves around knowledge, regulation and public accountability: the Rabobank headquarters on Croeselaan, the ASR tower on Archimedeslaan, UMC Utrecht and the Utrecht Science Park, the campuses of Utrecht University (UU) and Utrecht University of Applied Sciences (HU), the Utrecht municipality's city hall next to Hoog Catharijne, and a growing scale-up and startup scene at Dutch Game Garden, ITSU Utrecht Startup Hub and Beeyond. That calls for a software partner who knows how banking supervision, NEN 7510, Common Ground and SURFconext work in practice, not one who has only read about them in a whitepaper.

At Appfront, we build software that has to run in production under the eyes of DNB, AFM, the IGJ, a municipal CISO or an internal audit function at Rabobank or ASR. For clients in Utrecht, that translates into concrete choices: EU data residency, clearly structured audit trails, strong authentication, integration with existing core systems, and procurement-friendly contracts without lock-in to a single supplier. For our broader practice, regardless of location, see custom software development.

Are you also looking for a mobile app or a web app? Our sister pages app developer Utrecht and web app developer Utrecht cover that side of the work. For many Utrecht clients, we build a desktop web app, a mobile companion and a back-office platform in parallel.

Software in production is more than a tidy UI. We build for clients with strict proxy settings on a Rabobank workstation, a Citrix environment on a UMC desktop or a municipal laptop running an older OS. Front end: React, Vue or Svelte, with server-side rendering where SEO or first paint demands it. Back end: Node, Python or .NET, depending on your existing stack.

For integrations, we build APIs on top of your existing systems: core banking, policy administration, EHR/HIS, ERP, and identity providers such as Azure AD, ADFS, SURFconext or your own OIDC stack. We favour open standards (OAuth 2 with PKCE, OpenID Connect, SAML, eIDAS where relevant) over bespoke solutions. In healthcare, that increasingly means integrating with Nictiz standards or HL7 FHIR; in the public sector, often integrating with the Common Ground ecosystem via Open Zaak or a comparable service layer.

Everything that goes into production comes with observability built in: error reporting, performance monitoring, audit logging and alerting on the backend. In a banking or healthcare context, that is the difference between trust and frustration. GDPR and EU data residency are standard, with EU data centres from AWS, Azure or GCP, and, for banking clients, external penetration testing rounds before go-live.

A project starts with an introductory call: a no-obligation conversation where we go through the problem you want to solve, which systems are in place, and what management, IT, users and, depending on the sector, compliance, security or audit will expect. It often turns out that this can be a feature in an existing package, that a SaaS product would be cheaper, or that this is exactly the use case where bespoke software adds value in your Rabobank, ASR, UMC or municipal environment.

Next comes discovery: a short phase in which we work out the solution at architecture and interaction level, covering the front end, the back end, integrations with core systems, the identity provider (Azure AD, SURFconext or your own OIDC), and audit requirements. The outcome is a concrete plan with scope and budget, which for Utrecht municipality and Utrecht University is often also suitable to bring into a tender or procurement framework.

Then comes the build in sprints. At the end of each sprint, something working runs in a staging environment that we have agreed in advance with your security team. After go-live, maintenance follows: security patches, performance tuning and audit reporting. We offer ongoing support or hand over neatly to your own team, depending on what suits you best.