Do you only work with Brisbane businesses?

No. We are a national firm and the work is delivered Australia-wide from our Brisbane head office. GRM LAW is a Brisbane firm; Stone Leaf Capital and Aurii serve national markets. The engagement model is the same either way.

Do you build native mobile apps or just web?

Both. Aurii ships as native iOS and Android apps alongside its web app, all built by this team. Where a build genuinely only needs the web, we say so rather than inflate the scope.

What happens after launch?

We keep shipping. Under an ongoing engagement the work continues as the business evolves, on the same weekly cadence our own ventures run on. Software that stops changing at launch starts decaying at launch.

Do you quote fixed-price or time-and-materials?

A fixed-scope build is quoted against the brief before any work starts. An embedded engagement runs as a standing team on an agreed cadence, reviewed as the work evolves rather than re-quoted line by line.

Can you get the system ready for Essential Eight, ISO 27001, or SMB1001?

Yes, as a distinct compliance readiness service. We build against the ASD Essential Eight and OWASP as working methodologies, and we hold SMB1001:2026 Gold ourselves, so the evidence trail an assessor expects is familiar ground. Certification readiness runs as a milestone program alongside or after the build.

Who operates the software once it is built?

Under an embedded engagement, we do: we operate what we ship, the same way we run Aurii, Bold Property Group, and Restart Recruitment. Fixed-scope builds are delivered as shipped, operating products with delivery pipelines that keep secrets out of code.

Email info@blackshard.com.au or open a brief through the contact page. The first conversation establishes the shape: fixed scope or embedded, the platforms involved, and the obligations the system will carry.

We build software from Brisbane. Then we run it.

Custom software engineering with proof in production: GRM LAW's compliance portal, Stone Leaf Capital's operations platform, and three ventures we own and operate.

Black Shard is an Australian software engineering and cybersecurity firm with its head office in Brisbane. We design, build, and run production software: the compliance portal GRM LAW operates on, the operations platform behind Stone Leaf Capital, and the three ventures we run ourselves: Aurii in clinical software, Bold Property Group in buyer's advocacy, and Restart Recruitment. Every system named on this page is in production today.

That last part matters. An agency that ships and leaves never feels the weight of its own architecture decisions. We do, every week, because we operate what we build. Client work runs the same way: a standing team shipping weekly under an ongoing engagement, or a fixed-scope build with a defined brief and delivery date. Delivered Australia-wide from our Brisbane head office.

What we build

Web applications, native iOS and Android apps, client portals, and the internal operations platforms a business actually runs on. Where the build needs one, we design the brand and design system too. The platform layer underneath is part of the work, not an assumption: data model, delivery pipeline, observability, and the audit trail your obligations demand.

For GRM LAW, a Brisbane law firm, we built the secure operations and compliance portal the firm runs on day to day: a system that sits over Smokeball and holds intake, conflicts checks, a matter register, AML/CTF readiness, and an append-only audit ledger enforced on every state change. For Stone Leaf Capital, an Australian capital-markets firm, we built the staff portal behind the business: critical-event tracking, policy modules, and a compliance audit log capturing actor, action, and before-and-after state on every change, structured around the firm's AFSL perimeter.

Our own ventures prove the harder end of the range. Aurii is clinical voice software for Australian private-hospital specialists: native iOS and Android apps, a web app, speech and OCR pipelines, and a multi-tenant data layer, all built and operated by this team.

Web applications and client portals
Native iOS and Android apps
Internal operations and compliance platforms
Multi-tenant data layers with row-level security
Speech, document, and workflow automation
Brand identity and design systems where the build needs one

How an engagement runs

Two shapes. An embedded engagement gives you a standing build team that designs, ships, and operates the software as your workflow evolves: GRM LAW's portal takes shipped changes weekly, and Stone Leaf Capital's platform evolves under the same ongoing model. A fixed-scope build has a defined brief, a delivery date, and a clear deliverable set before work starts.

Either way, delivery runs from discovery and design through to a shipped, operating product, not a handover document. We take least-privilege access during engagements, keep secrets out of code, and run security review gates through delivery. The same discipline described on our approach page governs build work: read the real risk first, then engineer against it.

Why we build on Azure

Because we run it in production ourselves. Aurii operates on Microsoft Azure in the Australia East region: Container Apps for the app server, PostgreSQL with row-level security isolating tenant data, Key Vault for secrets, and GitHub Actions with Workload Identity Federation for deploys, in delivery pipelines that keep secrets out of code. Client builds get the same architecture because it is the one we trust with our own clinical software.

Australian regions are the default for anything holding client data. Azure's infrastructure is independently IRAP-assessed and holds its own certifications at the platform level; we inherit that baseline and keep the distinction honest, as our trust page spells out. What we add on top is the engineering: the tenancy model, the audit trail, and architecture designed around the obligations the system carries, whether that is the Privacy Act, an AFSL perimeter, or clinical data handling.

Why does secure-by-design engineering matter?

Because retrofitting security is the expensive way to get it. Most software is built first and assessed later, and the assessment lands after the architecture has hardened around its weaknesses. We run threat modelling from the first design session, before a line is written, so trust boundaries, attack surface, and data obligations shape the design rather than audit it afterwards.

It shows in the shipped work. GRM LAW's portal enforces role-based access and ships a hardened content-security policy. Aurii isolates tenant health data with PostgreSQL row-level security and carries tamper-evident audit trails and rate limiting throughout. Restart Recruitment ships with eleven invariant tests pinning its security model, covering TOTP replay, OAuth timing, and signing caps, so a later change cannot quietly regress what already works.

The other half of the firm is a cybersecurity practice: penetration testing, red teaming, and secure code review against the OWASP and ASD playbooks. We build software, then break it the way an adversary would, before it reaches production. Black Shard holds SMB1001:2026 Gold, verifiable on the public CyberCert registry.

What does a custom build cost?

We do not publish indicative ranges because they mislead in both directions. Cost follows scope, and scope has nameable drivers: how many platforms the build spans (web, iOS, Android), the integration surface, whether the data layer is single-tenant or multi-tenant, the compliance obligations the system carries, and whether the build needs a brand and design system or slots into an existing one.

A fixed-scope build is scoped against a defined brief and delivery date. An embedded engagement runs as a standing team on an ongoing cadence. Send the brief either way: a director reads it and replies with a straight answer on shape and scope.

Every engagement includes

A director on the work
A director reads the brief, scopes the engagement, and stays accountable for the result.
Quoted before work starts
Scope and price for a fixed build; cadence and rate for a standing team. Agreed before any work starts.
Security gates through delivery
Threat modelling at design, review gates before ship.
Operated after launch
Embedded engagements keep a weekly ship cadence; fixed-scope builds hand over a shipped, operating product.
Least-privilege access
We take only the access the work requires, and client data sits in Australian regions.
A report that is yours
Written for your engineers and your board, and kept confidential.

Questions, answered

Do you only work with Brisbane businesses?: No. We are a national firm and the work is delivered Australia-wide from our Brisbane head office. GRM LAW is a Brisbane firm; Stone Leaf Capital and Aurii serve national markets. The engagement model is the same either way.
Do you build native mobile apps or just web?: Both. Aurii ships as native iOS and Android apps alongside its web app, all built by this team. Where a build genuinely only needs the web, we say so rather than inflate the scope.
What happens after launch?: We keep shipping. Under an ongoing engagement the work continues as the business evolves, on the same weekly cadence our own ventures run on. Software that stops changing at launch starts decaying at launch.
Do you quote fixed-price or time-and-materials?: A fixed-scope build is quoted against the brief before any work starts. An embedded engagement runs as a standing team on an agreed cadence, reviewed as the work evolves rather than re-quoted line by line.
Can you get the system ready for Essential Eight, ISO 27001, or SMB1001?: Yes, as a distinct compliance readiness service. We build against the ASD Essential Eight and OWASP as working methodologies, and we hold SMB1001:2026 Gold ourselves, so the evidence trail an assessor expects is familiar ground. Certification readiness runs as a milestone program alongside or after the build.
Who operates the software once it is built?: Under an embedded engagement, we do: we operate what we ship, the same way we run Aurii, Bold Property Group, and Restart Recruitment. Fixed-scope builds are delivered as shipped, operating products with delivery pipelines that keep secrets out of code.
How do we start?: Email info@blackshard.com.au or open a brief through the contact page. The first conversation establishes the shape: fixed scope or embedded, the platforms involved, and the obligations the system will carry.

Software that ships, runs, and stands up to attack.

Australia-wide, from our Brisbane head office. Someone will contact you as soon as possible.

Open a brief info@blackshard.com.au