1. Discovery & analysis

Two intensive 4-hour workshops answering three questions: who is the user, what outcome do we measure, what are the real technical and commercial constraints? Output: a signed PRD and a risk register.

2. Design & architecture

A reusable Figma design system, a formal C4 architecture diagram, and an ADR document for every load-bearing decision (database, auth, caching). Clickable prototypes — never paper sketches.

3. Iterative build

Weekly sprints with a live Thursday client demo. Small pull requests gated by human review and full CI. A production-parity staging URL on HTTPS is live from day one.

4. Hardening & security

An OWASP ASVS Level 2 review, an internal pen-test, dependency-check, and hardened headers + rate-limits. You get a security report you can share with your own auditor.

5. Launch & run

CI/CD auto-deploy, uptime + error + RUM monitoring, a written response-time SLA, and a monthly call to review KPIs and plan the next release.