How we work
The same process runs on every project, whatever we are building. It is designed so you always know what is happening, see working software early, and are never surprised by cost or scope.
The six stages of a project
Discovery and scoping
We work with you to understand the business goal, the people involved, the current process and its constraints. The result is a written scope, a proposed architecture and a delivery plan.Architecture and planning
We choose the technology, design the data model and integrations, and break the work into fortnightly releases. Key decisions are written down and agreed before production code is written.Build in two-week cycles
Each cycle ends with working, tested software you can try and comment on. Changes to scope are discussed openly and their effect on time and cost is stated before anything changes.Testing and quality assurance
Automated tests run on every change, alongside manual checks across devices and browsers. Integration, performance and security checks run before code reaches production.Deployment and launch
Automated pipelines deploy the same way every time, with health checks and the ability to roll back. We migrate data, train the team and monitor closely after launch.Support and iteration
Once live, we fix issues, keep dependencies up to date and add features based on how the system is actually used.
How we estimate
Break the work down
Features are split into small tasks that can be estimated individually, which reduces the risk of large errors.
Estimate as a range
Each task gets an optimistic, likely and pessimistic estimate, so the plan shows real uncertainty rather than a single guess.
Price the risk
Complex integrations and unknowns are called out and given explicit contingency, not hidden in the total.
State the assumptions
Every estimate lists its assumptions. If one changes, we re-estimate and tell you the impact before continuing.
Code review
- Correctness: does the code do what it should, including error states and edge cases?
- Security: no injection risks, exposed data or missing access checks
- Performance: no unnecessary database queries or slow paths
- Readability: clear and maintainable by another engineer
- Tests: new behaviour is covered by tests
Testing
Unit tests
Fast tests of individual functions and components, run on every change.
Integration tests
How components work together with APIs, databases and third-party services.
End-to-end tests
Key user journeys tested through the whole application before each deployment.
Accessibility checks
Interfaces checked against WCAG 2.2 AA so they work for everyone, including people using assistive technology.
Security checks
Automated dependency and vulnerability scanning, with further testing where the risk justifies it.
Security and data protection
- Protection against the OWASP Top 10 categories of web vulnerability
- Data encrypted in transit and at rest; secrets kept out of code and in a managed secrets store
- Role-based access and least privilege across systems and environments
- Automated scanning of third-party packages, with urgent fixes prioritised
- Privacy by design under UK GDPR and the Data Protection Act 2018
- Infrastructure defined as code, so environments are reproducible and changes are reviewed
Tell us what you want to fix or build
Send a short brief and we will come back with questions, a rough approach and whether we are the right fit. No sales sequence.
Prefer email? info@elslabs.co.uk
Or message us on WhatsApp.