Custom software development in Utrecht.

Utrecht is no copy of Amsterdam or Rotterdam. The city revolves around knowledge, regulation and public accountability: the Rabobank HQ on the Croeselaan, the ASR tower on the Archimedeslaan, UMC Utrecht and the Utrecht Science Park, the campuses of Utrecht University (UU) and Utrecht University of Applied Sciences (HU), the Stadskantoor of Utrecht municipality next to Hoog Catharijne, and a growing scale-up and startup scene at Dutch Game Garden, ITSU Utrecht Startup Hub and Beeyond. That calls for a software partner who knows how banking supervision, NEN 7510, Common Ground and SURFconext work in practice, not one who has only read about them in a whitepaper.

At Appfront we build software that has to run in production under the eye of DNB, the AFM, the IGJ, a municipal CISO or the internal audit function of Rabobank or ASR. For Utrecht clients, that translates into concrete choices: EU data residency, clearly designed audit trails, strong authentication, integration with existing core systems, and procurement-friendly contracts without lock-in to a single supplier. For our broader approach, regardless of location, see custom software development.

Are you also dealing with a mobile app or a web app challenge? Our sister pages app developer Utrecht and web app developer Utrecht cover that side of the work. For many Utrecht clients, we build a desktop web app, a mobile companion and a back-office platform in parallel.

Software in production is about more than a polished UI. We build for clients with strict proxy settings on a Rabobank workstation, a Citrix environment on a UMC workstation, or a municipal laptop running an older OS. Front end: React, Vue or Svelte, with server-side rendering where SEO or first paint demands it. Back end: Node, Python or .NET, depending on your existing stack.

For integrations, we build APIs on top of your existing systems: core banking, policy administration, EHR/HIS, ERP, and identity providers such as Azure AD, ADFS, SURFconext or your own OIDC stack. We choose open standards (OAuth 2 with PKCE, OpenID Connect, SAML, eIDAS where relevant) rather than proprietary solutions. In a healthcare context, that now often means an integration based on Nictiz standards or HL7 FHIR; in a public-sector context, often an integration with the Common Ground ecosystem via Open Zaak or a comparable service layer.

Everything that goes into production comes with observability: error reporting, performance monitoring, audit logging and back-end alerting. In a banking or healthcare context, that is the difference between trust and frustration. GDPR and EU residency are standard, with EU data centres from AWS, Azure or GCP, plus external pentest rounds before go-live for banking clients.

A project starts with an introductory meeting: a no-obligation conversation in which we go through the problem you want to tackle, which systems are in place, and what management, IT, users and, depending on the sector, compliance, security or audit expect from it. Often the outcome is: this can also be done as a feature in an existing package, a SaaS product is cheaper here, or this is exactly the use case where custom software adds value for your Rabobank, ASR, UMC or municipality environment.

Next comes a discovery phase: a short stage in which we work out the solution at architecture and interaction level: which front end, which back end, which integrations with core systems, which identity provider (Azure AD, SURFconext, your own OIDC), which audit requirements. The result is a concrete plan with scope and budget, often also suitable for use in a tender or procurement process at Utrecht municipality and UU.

Then comes the build in sprints. At the end of every sprint, something working runs in a staging environment that we have agreed in advance with your security team. After go-live comes maintenance: security patches, performance tuning and audit reports. We offer ongoing support or hand it over cleanly to your own team, whichever fits.