What does a custom build cost?

There is no published price list; every engagement is scoped to the brief. The drivers are concrete: which platforms are in scope, how much integration surface the system carries, whether tenancy is single or multi, and which obligations the data brings with it. Name those in your brief and the reply comes back with the questions that let us scope it.

Where does the work actually happen?

Australia-wide, from our head office in Brisbane. The systems we build and run serve national markets: a Brisbane law firm, private-hospital specialists across Australia, a capital-markets firm. Delivery, access, and reporting run the same way in every state.

Do you keep operating the software after launch?

Yes. We run what we ship: our own ventures run on systems we operate day to day, and the client platforms we built for GRM LAW and Stone Leaf Capital keep taking shipped changes under ongoing engagements. If you want a fixed-scope build with a defined delivery date instead, we scope it that way from the start.

What technology stack do you build on?

The one we run in production ourselves: Microsoft Azure in Australian regions, Container Apps, PostgreSQL with row-level security for multi-tenant data, Key Vault for secrets, and delivery pipelines with workload identity so credentials stay out of code. Native iOS and Android where the product needs it.

How is security handled during the build?

It starts before the code: threat modelling in the first design session, least-privilege architecture, disciplined secrets handling, and security review gates through delivery. Then the finished system is attacked against the OWASP and ASD playbooks by the same firm that built it, with every finding validated by hand.

Can the build include compliance readiness?

Yes. We run milestone-driven programs toward Essential Eight, SMB1001, ISO 27001, and Privacy Act readiness, and we build the evidence trail an assessor expects. We hold SMB1001:2026 Gold ourselves, verifiable on the public CyberCert registry.

Email info@blackshard.com.au or open a brief through the contact page. A rough brief is enough to open the scoping conversation.

We build the systems regulated Australian businesses run on.

Custom software from a national engineering and cybersecurity firm, designed, built, secured, and operated by the one team, delivered Australia-wide.

Black Shard is an Australian software engineering and cybersecurity firm. We design, build, and run production software for regulated industries: the compliance portal a Brisbane law firm operates on, clinical voice software for Australian private-hospital specialists, the operations platform of a capital-markets firm. Every build ships from a single standing team, delivered Australia-wide.

Most firms either build software or test it. We do both, and we answer for both. Threat modelling starts in the first design session, a secure development lifecycle runs through delivery, and our offensive practice attacks the finished system the way an adversary would. One team, accountable for the code and for what happens when someone tries to break it.

What a full build includes

A full build starts before the code. For Bold Property Group we designed the brand identity, shipped the editorial marketing site, built the agent network that sources off-market property, and stood up the client portal that tracks each active acquisition. For Restart Recruitment we built the brand, the site, the candidate intake and scorecard screening flows, and the outreach engine the recruitment team runs on. Both were built from the brand up and operate today.

Aurii shows the depth of the range. It is clinical voice software for Australian private-hospital specialists, and we built the entire stack: the native iOS and Android apps, the web app, the marketing site, the speech and OCR pipelines, the multi-tenant data layer, the migrations, and the observability underneath. When we say brand to production, that is what we mean.

Brand identity and design system where the build needs one
Web apps, native iOS and Android, client portals, and internal operations platforms
Speech, document, and workflow automation wired into real operations
Delivery pipelines with secrets kept out of code
A weekly ship cadence that keeps going after launch

The industries we build for

Only the ones we can prove. Legal: GRM LAW, a Brisbane law firm, clears matters through a Black Shard-built intake and conflicts workflow, with role-based access enforced server-side and a hardened content-security policy in the browser. Health: Aurii, our clinical-software venture, drafts the clinical note, the letters, and the billing from a spoken consult, inside the framework the practice already uses.

Capital markets: Stone Leaf Capital engaged us to build its brand, its public site, and the staff portal that runs the firm's operations, compliance, and policy framework, with a data model designed around its AFSL perimeter. Property: Bold Property Group operates on the deal-flow systems we built. Recruitment: Restart Recruitment runs on our intake, screening, and outreach stack. No sector appears on this page without a named build behind it.

Why use one team to build and secure software?

Split the work between a development shop and a security consultancy and each can blame the other. We removed the seam. The engineers who design the system also threat-model it before a line is written, keep the architecture least-privilege, keep secrets out of code, and hold security review gates through delivery.

Then our offensive practice attacks the finished system against the OWASP and ASD playbooks, with an adversary's priorities rather than a checklist's. Every finding is validated by hand and comes back with reproduction steps and a concrete fix; we do not forward raw scanner output. We hold ourselves to the same discipline we sell: Black Shard is certified SMB1001:2026 Gold, verifiable on the public CyberCert registry, and we self-assess against the ASD Essential Eight. Our approach page sets out the method in full.

How we engineer multi-tenancy and audit trails

Regulated software lives or dies on two questions: whose data is this, and who did what to it. We build multi-tenant data layers with row-level security, so tenancy is enforced in the database, not just the application layer. Aurii isolates tenant health data with PostgreSQL row-level security, on Azure in Australia.

Audit is engineered with the same seriousness. GRM LAW's portal writes to an append-only audit ledger, machine-enforced on every state change. Stone Leaf Capital's portal keeps a compliance log that records who changed what, and what it said before, structured around the firm's retention obligations. Aurii carries tamper-evident audit trails and rate limiting throughout. Restart Recruitment's security model is held in place by invariant tests, so authentication behaviour cannot quietly change.

Where does the data live?

On Microsoft Azure, in Australian regions. Aurii runs in Australia East: the app server on Container Apps, tenant data in PostgreSQL, speech recognition through Azure AI Speech, secrets in Key Vault, and deploys from GitHub Actions under Workload Identity Federation. Azure's infrastructure is independently IRAP-assessed to PROTECTED and holds ISO 27001 and SOC 2 at the platform level. Those are the platform's assessments, not ours, and we keep that line clear.

The privacy frame is Australian by design. We build to the Australian Privacy Principles under the Privacy Act 1988, and Aurii's clinical and privacy frame was built for Australian obligations from the start, not retrofitted from a US codebase. Our trust page lists exactly what we hold, what we self-assess, and what we deliberately do not claim.

How an engagement runs

Two shapes. A fixed-scope build with a defined brief and delivery date, or embedded engineering, where a standing team designs, ships, and operates under an ongoing engagement on a weekly ship cadence. Where the brief also carries a compliance target or needs a standing security seat, those run as services in their own right, alongside the build.

We operate what we ship. GRM LAW runs on a portal we ship to weekly, Stone Leaf Capital's portal evolves under the same ongoing model, and our own businesses run on systems we operate ourselves. Scope is handled plainly: a fixed-scope engagement names the target, timeframe, and deliverable up front.

Fixed-scope engagement: a build with a clear target, timeframe, and deliverable
Embedded engineering: a standing team that designs, ships, and operates
Alongside a build: compliance programs toward Essential Eight, SMB1001, ISO 27001, or Privacy Act readiness, and standing advisory or vCISO

Every engagement includes

A director on the work
A director reads the brief, scopes the engagement, and stays accountable for the result.
Quoted before work starts
Scope and price for a fixed build; cadence and rate for a standing team. Agreed before any work starts.
Security gates through delivery
Threat modelling at design, review gates before ship.
Operated after launch
Embedded engagements keep a weekly ship cadence; fixed-scope builds hand over a shipped, operating product.
Least-privilege access
We take only the access the work requires, and client data sits in Australian regions.
A report that is yours
Written for your engineers and your board, and kept confidential.

Questions, answered

What does a custom build cost?: There is no published price list; every engagement is scoped to the brief. The drivers are concrete: which platforms are in scope, how much integration surface the system carries, whether tenancy is single or multi, and which obligations the data brings with it. Name those in your brief and the reply comes back with the questions that let us scope it.
Where does the work actually happen?: Australia-wide, from our head office in Brisbane. The systems we build and run serve national markets: a Brisbane law firm, private-hospital specialists across Australia, a capital-markets firm. Delivery, access, and reporting run the same way in every state.
Do you keep operating the software after launch?: Yes. We run what we ship: our own ventures run on systems we operate day to day, and the client platforms we built for GRM LAW and Stone Leaf Capital keep taking shipped changes under ongoing engagements. If you want a fixed-scope build with a defined delivery date instead, we scope it that way from the start.
What technology stack do you build on?: The one we run in production ourselves: Microsoft Azure in Australian regions, Container Apps, PostgreSQL with row-level security for multi-tenant data, Key Vault for secrets, and delivery pipelines with workload identity so credentials stay out of code. Native iOS and Android where the product needs it.
How is security handled during the build?: It starts before the code: threat modelling in the first design session, least-privilege architecture, disciplined secrets handling, and security review gates through delivery. Then the finished system is attacked against the OWASP and ASD playbooks by the same firm that built it, with every finding validated by hand.
Can the build include compliance readiness?: Yes. We run milestone-driven programs toward Essential Eight, SMB1001, ISO 27001, and Privacy Act readiness, and we build the evidence trail an assessor expects. We hold SMB1001:2026 Gold ourselves, verifiable on the public CyberCert registry.
How do I start?: Email info@blackshard.com.au or open a brief through the contact page. A rough brief is enough to open the scoping conversation.

Built, secured, and operated by one accountable team.

Australia-wide, from our Brisbane head office. Someone will contact you as soon as possible.

Open a brief info@blackshard.com.au