Software as a Service strategies and development
Once you own your processor account, many storefronts, brands and a mobile app can share one vault and one customer list, or split by choice. The patterns, where separate accounts are right, and the real weight of a marketplace.
Run recurring billing in a processor account you own, and your plans, schedules, mandates and tokens survive a change of storefront untouched.
PCI DSS is the card industry's standard for anyone handling card data, enforced by the card brands and your acquirer. How a hosted, tokenised checkout keeps you on the lightest self assessment (SAQ A), and what it all costs.
A handful of decisions in the first month of a SaaS decide what the next ten years cost. How to keep one customer's data apart from another's in Rails, where the tenant lives in the code, Postgres row level security, users in several companies, tenant versus billing account, and why the isolation model is also your GDPR strategy.
SOC 2 Type II is an attestation report, not a certificate, issued only by a licensed CPA firm. What the five trust services criteria are, who needs it, who does not, and what it really costs.
What headless actually means, when it is worth it and when it is not, the one application hybrid I build on Solidus, what the Solidus 4.8 API gives you today, what you still design yourself, and what the app stores charge a shop.
On 21 October 2026 the NCSC warned that two critical PHP flaws let attackers run code on web servers without a login, and advised taking unpatchable systems offline. What really happened, why the plugin model keeps exposing businesses, and what I build instead.
What companies really risk with AI built software: invisible security flaws, agents with production keys, critical paths that change by accident, architecture debt, compliance, insurance exclusions and lock in. And how an experienced developer uses AI to deliver faster and for less.
Quality is not one thing. It is four tiers: being a regulated institution, the certifications a vendor earns, the laws that apply to you, and the engineering discipline that actually makes software reliable.
Most businesses pay for ads that promise one thing and then send everyone to a page that says another. A smart website closes that gap: one canonical page for search engines and cold visitors, shaped versions that continue the ad a visitor clicked, remembered only with consent, tested against real enquiries, and edited through the client portal instead of a CMS.
ISO 27001 is the international certificate for an information security management system, issued by an accredited body you commission, not by a developer. What it is, who needs it, how it compares with SOC 2, and what it really costs.
The OWASP Application Security Verification Standard is a free, open checklist for building and verifying secure web applications. It is not a certificate anyone holds, so I build to it and an independent pen test verifies against it.
WCAG 2.1 at Level AA is the standard almost every accessibility law points at. What its four principles ask, why AA is the target, how you really test it, and the failures I fix most, with a Leeds shop worked through.
DORA (Regulation (EU) 2022/2554) has applied since 17 January 2025. It governs ICT resilience for EU financial entities, and it reaches the developers who serve them through the contract. Who is in scope, the five pillars, and what lands in a supplier's build.
What a tagging server on your own domain fixes and what it does not: Google Tag Manager server side, the Meta Conversions API, GA4 Measurement Protocol, enhanced conversions and deduplication, built so consent still decides every forward.
More and more people meet your work in a feed or an AI answer and never visit your site. What to publish when the click does not come, on LinkedIn, in a newsletter and on answer first pages, and how to measure it through brand search and by asking people.
How to grow a business by being genuinely useful in Reddit, Discord, Slack and trade communities: why communities push marketers out, the one rule for every post, when to mention what you sell, the UK law on undisclosed posting, and how to measure what analytics cannot see.
How to build a nightly loop in a Solidus shop that reads competitors' public prices, stock, costs and elasticity, sets each product's price inside limits, moves ad budget towards profit, and stays inside UK consumer and competition law. Formulas, worked examples and Rails code.
Most links are passed on privately in WhatsApp, Slack, Teams and email, and your analytics files those visits under direct. Where the famous 80% figure really comes from, why a shared link loses its source, how to measure private sharing without tracking anyone who said no, and how to make recommendations more likely.
Chrome kept its third party cookies, and it barely matters. What Safari, Firefox and the consent banner really remove, what first party data is and is not, and how to measure without following people.
Four acronyms for four outcomes: found, lifted, cited and recommended. What SEO, AEO, GEO and AIO each mean, what actually moves each one, how they stack, what the lost clicks cost in numbers, and how to measure all four without buying a dashboard.
Fifteen concrete jobs that data engineers, analysts and data scientists do for a SaaS business and an online shop, in the order they should be done, each rated for importance and worked through with invented numbers you can check.
Three job titles that sound alike and are three different jobs. One coffee subscription business followed through all three roles, what each costs to hire in the UK, the order to hire them in, and what goes wrong when you skip one.
A checked list of 44 small fixes across the website, SEO, AI search, email and paid advertising, each one something you can start in an afternoon. Invented impact figures removed, every outside number sourced, and the consent rules built in.
Why some complex, high pressure projects go better with one experienced developer than with a team: the communication paths every new person adds, the meeting tax, experience as pattern recognition, and the psychology of carrying a project alone.
Fixing vibe coded software has become a business of its own. Why AI built projects with no tests and no documentation break, what a rescue involves hour by hour, and why the bargain quote so often costs the most.
Why companies bring me in rather than employ someone, and why the easy answer misses the point. It is about time, what the UK working time rules allow an employer to ask, and the freedom I trade for the intensity.
How to ship sooner without shipping worse: what lateness really costs, how to find and protect the critical path, the over engineering trap, why speed and stability go together, and why customers, not meeting rooms, should set the requirements.
A/B tests, A/B/n tests, bandits, multivariate tests, holdouts, geographic tests, audience splits and time based tests: what each one answers, what it needs and where it breaks.
Active subscriptions are the hardest thing to move in an ecommerce migration, because each one bundles a plan, a schedule, a mandate and a payment token that must all stay in sync. Here is what can move, what cannot, and the go or no go you must settle before you commit.
What the dot com crash really looked like, what the biggest AI spenders report in their own filings, where AI genuinely earns its keep, and the hidden costs a business should price in before it spends.
How to find the early action that predicts retention, clear the path to it, and build habits that last: cohort analysis, the Hook model, what the 66 days really mean, habit stacking, checklists, head starts, the goal gradient and the UK rules on onboarding emails.
Hick, Fitts, Miller, the peak end rule, the serial position effect, cognitive load, friction and framing: what each piece of research actually found, what it does not prove, and how to use it to review a page, with worked examples.
The two systems of thinking, the biases behind a purchase, defaults, friction, hyperbolic discounting, mental accounting, choice overload and status quo bias: what the original studies found, how well they have held up, where UK law draws the line, and how to measure each one.
The maths and psychology of referral programmes: the viral coefficient, what a value below one is still worth, why cycle time is about timing until you pass one, and the UK rules every refer a friend scheme has to follow.
Where AI built prototypes break when real customers arrive: the database first, then the framework, then the language. What each popular framework is really for, the warning signs to check, and how to recover.
Ten pieces of maths that turn growth data into decisions: lifetime value against acquisition cost, payback, cohorts, survival curves, Bayesian tests, bandits, attribution and mix models, power laws, price elasticity and retention, each with a worked example.
Goal gradients, fresh starts, implementation intentions, defaults, status tiers, social comparison and risk reversal: the original studies, how well each has held up, worked examples, and the tactics UK law now bans.
Why testing between two applications is different from testing inside one, request specs in Rails and Django, OpenAPI documentation from tests, and consumer driven contract testing with Pact.
What background jobs are, how Sidekiq and the Rails 8 default Solid Queue run them, and the rules (independence, idempotency, isolated queues, monitoring) that stop one bad job from stopping everything.
Two vendor integrations, one month, more than ÂŁ35,000 in costs to my clients: what unreviewed AI generated code looked like in production, what it cost, and how to protect your side of an integration.
How survival analysis tells you when customers leave, not just whether, and how to turn Kaplan Meier curves and a Cox model into a lifetime value you can defend.
My opinion, argued with the facts checked: conventions, safe defaults and a testing culture in the box make Rails and Django projects easier to change in year three. Where Laravel has closed the gap, I say so.
What Behaviour Driven Development is, how Cucumber and Gherkin turn plain English into tests, the advanced features worth knowing, setting it up in Rails, and the mistakes I see most.
How dynamic pricing actually works for a shop: estimating elasticity from your own orders, the markup rule, a demand model, the guardrails, and the UK price transparency and competition rules, with Solidus and Rails code.
SARIMA, Prophet and gradient boosted trees compared for a shop's weekly sales: when each earns its place, how to test them honestly, and how a forecast becomes a reorder point in Rails and Solidus.
Germany and Austria share the EU AI Act and the GDPR but not the enforcers. Switzerland has neither, and a data protection act that already covers AI. What a British business needs to know, and how to build one Rails codebase for all three.
A developer's walkthrough of the processing contract, data protection by design and the impact assessment for AI features, under the UK GDPR and, for EU customers, the EU GDPR. The law first, then the Rails code.
Deleting a customer's rows is easy. Their influence on a trained model is not. What Article 17 says in the UK and the EU, what regulators have actually said about models, what machine unlearning research can do, and the Rails architecture that keeps you out of the problem.
The Digital Omnibus moved the high risk rules to December 2027 and August 2028, but the transparency duties already apply. Here is where a SaaS product sits, what it owes and how to build for it on Rails.
Most marketing automation is still a timer with a mailing list. What changes when models decide instead: guarded dynamic pricing, recommendations that read context, churn prediction that acts in time, and campaign agents, built on Rails and Solidus within UK data protection rules.
Most AI projects stall on messy data, old systems and no clear first step. The right order of work, three patterns for adding AI to a Rails and Solidus stack without replacing it, what MCP changes for legacy systems, the data protection basics and five realistic places to start.
A chatbot answers your questions, an agent does your work. What really changed between 2024 and 2026, from computer use and MCP to agent payment protocols, what agents do today, and what it means for a shop on Rails and Solidus.
What an AI agent actually is, how it differs from a chatbot and an automation rule, and how to build agents for stock, support, routing and pricing on Ruby on Rails and Solidus with the guardrails that keep them safe.
How to add product recommendations to a Solidus shop: co occurrence, collaborative filtering with ALS, content based filtering with TF IDF and a hybrid of the two, with working Python and Rails code, an A/B test and the UK consent rules, using an invented Bristol tea merchant.
What Test Driven and Behaviour Driven Development are, which Rails tools do which job, what to test before every release, and how to use AI for tests without handing it the judgement.
Three American companies hold 70% of Europe's cloud market, and US law follows the data wherever it sits. What the CLOUD Act says, what governments are already doing, what I use instead and how to cost a move.
NIS2 covers cloud services, managed service providers and online marketplaces that serve the EU, with a 24 hour reporting clock and fines from €7 million. Who is in scope, what it asks, and where a UK business stands.
The Cyber Resilience Act sets security rules for almost every product with software in it that is sold in the EU. Reporting has been live since 11 September 2026, and the rest applies from 11 December 2027.
What happens when rival shops run the same clever algorithm against each other? Bidding wars, the Nash equilibrium, why learning agents chase a moving target, and where optimisation turns into algorithmic collusion.
My view as a developer on whether AI tools replace developers, set next to the controlled studies: where AI makes coding faster, where it makes experts slower, and why the responsibility stays with a person.
The Partner badge rewards an optimisation score that rises when you accept Google's recommendations, and a recommendation can raise the score while it lowers your profit. Here is why I let mine expire, worked through for an invented Brighton tea shop.
Advice without the work rarely creates growth. Where a consultant is worth paying for, why so much advice never turns into results, and how to compare advice with a build in pounds.
Hourly rates, retainers, a share of ad spend and commission each reward something different. Here is what, what goes wrong with commission, and the safeguards that keep it honest.
What a growth hacker actually does, the experiment loop and the access it needs, and five questions that separate real growth work from a marketing retainer with a new label.
What Next.js, Ruby on Rails, Laravel, Django, Express, NestJS and WordPress each actually are, how long each version is supported, what the licences allow, and how an invented Manchester business chooses a stack with every pound shown.
What a unified marketing stack really is for a small shop: one customer and event record, consent carried on every row, and the costs of building or buying each piece.
A British voice that leads with jokes can read as evasive to German and Austrian buyers. I show what to change, from du or Sie and claims law to the Impressum, with before and after copy for an invented Bristol tea shop.
How to let your email list shape your adverts and your adverts shape your emails: customer lists on Google and Meta, suppressing recent buyers, match rates, refresh timing and the UK law behind it.
Every shop gains from one more email or ad while the cost of a tired audience falls on everyone. Hardin's pasture, Ostrom's answer, the inbox rules since 2024 and the arithmetic in pounds.
What to ask an agency or freelancer before you sign, what each way of paying them rewards, which red flags Google itself warns about, and a weighted scoring method worked through for an invented Leeds coffee roaster.
Performance Max and Meta's Advantage+ took the old levers away, but not the control. What still steers them, what the reports now show, and how a holdout tells you what the campaign really adds, shown on an invented Bristol coffee roaster.
What Jared Spool's famous button story really shows, and what it does not. Then the small words that decide a checkout: button labels, guest checkout, error messages, help text, reassurance at payment and accessible labels, worked through on an invented Leeds candle shop.
What a p value really tells you, how wide the margin of error on a conversion rate is, and why a significant lift can still lose you money, worked through for an invented Leeds candle shop.
Your rival is doing the maths too. Bertrand, Cournot, Stackelberg, the prisoner's dilemma in brand bidding, repeated games, focal points and signalling, each worked through with invented British businesses and every step shown.
Donald Miller's seven part StoryBrand framework, explained part by part and worked through on an invented Leeds software company and a Bristol tea shop, before and after. With the honest limits.
How to split an ad budget and set a price when you cannot know how the month will go: scenarios, diminishing returns, the shadow price of budget, the flaw of averages and the markup rule, worked step by step for an invented candle shop in Bristol.
Why the average order value hides the shape of your data, and how the median, spread, quartiles, honest outlier handling and a look at segments give you numbers you can actually decide on.
How to let your shop tell your adverts and emails when something changes: signed webhooks, a queue, actions that are safe to repeat, and a schedule for what no webhook will ever tell you.
A Google results page is boxes, maps, products, videos and stars as well as links. How to read the intent behind a query from the page Google builds, which features a business can earn, the rules Google publishes for each, and how to measure what you hold.
Google's SGE experiment became AI Overviews and AI Mode, and both now sit in front of your organic results. What the click studies actually measured, how to estimate and measure the effect on your own site, and the controls you have since 2026.
Building many pages from one template is fine. Building the same page 400 times with a different town in the headline is spam. How to tell the two apart, and how to build the first kind.
Which features turn customers into new customers, why activation decides whether the loop ever starts, and how what users do and say should decide what gets built next.
DuckDuckGo, Ecosia and Brave Search carry about 1% of UK search referrals, and most borrow Bing's or Google's index. The bigger privacy shift is in the browser and the law, and that touches every visitor you have.
Every way of paying a marketing agency rewards something, and it is rarely exactly what you want. Agency costs, fees on spend, ROAS targets, commissions, noisy measures, many tasks and who owns the account, worked through for an invented Manchester candle shop.
PayPal, buying on invoice and direct debit carry most German online turnover, and German price law shapes every product page. What a UK shop offers at the checkout, and how it shows the price, worked through for a Brighton shop.
How to spot the people still deciding, turn what they do on your site into an honest purchase probability, and send the message only where it changes the outcome, within UK profiling law.
Eight missteps I see British shops make in Germany, Austria and Switzerland, from treating DACH as one market to a card only checkout and English terms, each with the fix and a worked example from an invented Leeds yarn shop.
Dave McClure's five pirate metrics turn the vague question of growth into five counts. How to define each one, read the rates between them, and fix the stage worth the most.
A copied British Performance Max campaign usually fails in Germany on structure, not culture. How consent thins the signal, how many asset groups that signal can carry, and what to split them on, shown on an invented Manchester shop.
Google never started indexing passages. It ranks whole pages, and since 2021 it can notice the one good section inside a long one. What that means, what it does not, and how I structure long pages so the right section is found, quoted and linked.
Fewer Germans use social media, the pixel waits for consent, and the Digital Markets Act lets people opt out of profiling. What that does to a British shop's Meta campaigns, worked through in pounds.
Before I scale any paid campaign I check three things in order: is the message understood, is the market big enough and reachable, and does each customer pay back once churn is counted. Worked through with an invented Bristol coffee subscription.
Chrome kept its third party cookies, but most of your visitors are already out of reach. How to turn organic search into first party data you can use lawfully, and measure content by what each click is worth.
Every UTM parameter GA4 recognises, the channel rules that sort your words into buckets, one naming vocabulary, what breaks, and how the labels feed attribution. With an invented Leeds candle shop and three campaigns, in pounds.
What Jobs To Be Done is, where it comes from and what it is not, and how I use switch interviews, the four forces and opportunity scores to turn a customer's job into positioning, copy and ads. Worked through on an invented Manchester software company.
ChatGPT has no ranking list, just two routes into an answer and one documented gate. What OpenAI, Microsoft and the research actually say, what is unknown, and how to measure your place.
Trigger, action, variable reward, investment: what each step of the Hook Model does, what the habit research behind it actually measured, and where a useful habit turns into a hook nobody asked for, worked through on an invented Leeds coffee roaster.
How to measure retention honestly, put a pound value on every point of it, raise it in the first weeks, and build a referral scheme that pays and stays inside UK law.
What a growth loop really is, the one number that says whether yours is doing anything, and why a loop that never runs on its own still makes every pound of marketing go further.
How I use location in ads, landing pages and email: which location sources to trust, how the ad platforms decide who is in an area, and how to prove the lift with a holdout.
Every tool in your stack that touches customer data is a legal relationship. What Article 28 asks before you sign, how the 2026 transfer rules work, and how I rank vendors so the review time goes where the risk is.
Does data protection really build trust and cut churn? I separate what UK adults say, what experiments show and what real companies saw, and show how to measure it yourself.
Two UK laws decide whether you may email someone you collected. How I build sign up forms, checkouts, gated guides and onboarding so every address on the list is one you can actually use.
Pre ticked boxes, banners without a reject button, shaming pop ups and countdown clocks that reset. Which UK law each one breaks, what the ICO and CMA expect, and what I build instead, worked through on an invented Leeds tea shop.
Your price is only half of the decision, because your rival is choosing too. Payoff matrices, dominant strategies, Nash equilibrium, repeated games, credible threats and reaction functions, worked through for two invented Bristol coffee roasters.
How to count all five stages of a funnel, from awareness to advocacy, put a pound value on every leak, and fix the one that is worth the most first.
How to choose between options when you cannot know how they will turn out: the payoff table, expected value, utility for when the bad year could sink you, regret, decision trees, and what a pilot is worth before you pay for it.
How a data warehouse such as BigQuery or Snowflake joins your shop, analytics, ads and email data on the customer, turns segments into queries that run every morning, and sends them back to the tools that act.
Data science delivers better decisions, measured, not dashboards. The five step loop, a way to price a better decision, and three small models at an invented Brighton garden centre chain.
The same campaigns in two languages across four countries, and three systems that each count the orders differently. How I keep country and language apart, map everything to a market, correct for consent per market and reconcile the platforms against the orders.
No German company needed, but a short list of registrations, three people in the EU who answer for you and German shop terms. The steps in order, with the law behind each and a Bristol shop's first quarter in pounds.
How I set up Google Ads and Meta for several countries from one UK account, what localisation means beyond translation, and how to split the budget by the return on the next pound, shown on an invented Leeds software company.
What LCP, INP and CLS measure, why Google grades them at the 75th percentile of real visits, how much they weigh in Search, and how to diagnose a slow page from the top, worked through on an invented Manchester furniture shop.
The UK cookie rule changed in February 2026. Germany and Austria did not follow. What a British shop must do in each market, what fires when a visitor says no, and what that does to the numbers in your ad account.
My four layer review for pages that get interest but not action: copy, flow, visual, and speed. With an invented Brighton software company's demo request flow, measured with consented events, step rates and a proper test.
ChatGPT search and Google's AI features fetch and cite pages by different routes, opened by different switches. Here are both routes, what the UK usage figures really say, and a plain monthly way to measure whether either tool cites you.
Why the customers who got your campaign always look better, and how potential outcomes, propensity score matching and instrumental variables find the effect the campaign actually caused.
How I use the Bullseye framework from the book Traction to pick one marketing channel: list all 19, test three small, score the results on expected value, then focus.
Why I test a UK brand's German proposition, prices and delivery promise in Austria or Switzerland first, with the sample size, the z test and the cost of learning per market, shown on an invented Leeds outdoor clothing brand.
The six step sequence I use to open a new city or region on a small budget: choose by evidence, plug the leaks, local search, measured partnerships, and the marginal cost that says when the next city opens.
What a full time hire really costs in the UK once National Insurance, pension, holiday, recruitment and redundancy are counted, what a senior contractor costs for the same year, and the number of days at which the answer flips.
How a UK SaaS sells into a German organisation: the six stages from discovery to go live, the data processing agreement, the works council, German contracts and payment on invoice, shown on an invented Leeds company and its Hamburg buyer.
How to feed margin, lead quality, stock and consent state into Google Smart Bidding and Meta's Conversions API, with the formulas, the weekly loop and a worked example from an invented Brighton supplier.
What Google's ad auction really does to your price, why the textbook second price rule breaks across several positions, and how to set a maximum bid and a Target ROAS guardrail from your own margin and conversion rate.
What Attention, Interest, Desire, Action still does for an online shop today, how to count the funnel at every stage, and why one better stage is worth more than more attention.
The European Accessibility Act has applied since June 2025 and names online shops. The UK Equality Act has asked for reasonable adjustments since 2010. Both come down to WCAG 2.1 AA. What that means in practice, with a Leeds checkout audit worked through.
1%of every invoice goes to a UK charity you pick.
A donation, never sponsorship. You choose the cause at onboarding.
The story behind the pledge →Questions about pricing, contracts or how we work together?
Read the FAQ
