Property
Fox Valuations
Every valuation, from inspection to invoice, runs through The Den.
Reports, sketch PDFs and fees come from the same job record in The Den.
Software engineering
Custom and compliance software development in Australia.
Black Shard designs and builds web applications, mobile apps, internal operating systems and compliance platforms.
Overview
Regulated software needs engineers who have shipped under the obligation before. Our work spans clinical software, legal and compliance platforms, financial-services systems and the automation between them, built for organisations across Australia and run after launch where the engagement calls for it.
Build shapes and delivery
Projects can run as a defined build or as an ongoing engineering engagement where the product continues to evolve after launch. Delivery is Australia-wide.
What a full build includes
A full build can run from brand and site to the platform and the apps around it, with ongoing engineering after launch where the engagement calls for it. Bold Property Group's deal-sourcing engine and staff app are one example.
A clinical app, built the same way
Aurii, the clinical app we built for private hospital specialists, is a second, live on the App Store, Google Play and the web, and among the many systems in production with us today.
The industries we build for
Regulated and operational businesses, from law, health and capital markets to property, government and motorsport.
The law, health and investment systems we run in these sectors are a few of many in production with us, and each was built with its sector's obligations in the data model.
- Legal: intake, conflicts and trust oversight beside the practice system
- Health: clinical notes, letters, orders and billing on the phone, the tablet and the web
- Capital markets: operating portals built around an AFSL perimeter
- Property: deal sourcing and AML/CTF obligations in the app the team already works in
What the sectors share
Each sector brings its own obligations into the data model: who may see a record, who changed it, what it said before and how long it is kept. The system carries them, so the evidence an assessor or regulator asks for comes from the system itself.
How security is handled during a build
The engineers who design the system threat-model it before a line is written, keep the architecture least-privilege, keep secrets out of code, and hold security review gates through delivery.
Testing the finished system
The firm's cybersecurity practice then tests the finished system against the OWASP and ASD methodologies. Findings are manually verified before they are reported, and each comes back with reproduction steps and a fix.
Compliance software development for regulated firms
Compliance software carries the obligation in its data model: who may see a record, who changed it, what it said before, and how long it is kept.
- AML/CTF readiness, conflicts checks and matter workflows for law firms
- Operating portals built around an AFSL perimeter, with policy modules and critical-event tracking
- Retention and access modelled on the obligations the data carries
- Trust and fund reconciliation against bank data in Xero
How the rules are built in
Black Shard designs those rules into the database and the application from the start, so the evidence an assessor or regulator asks for comes from the system itself.
In one law firm's portal, the end-of-month close raises a named exception for every orphan, unbound or duplicate trust transaction before sign-off, beside intake, conflicts checks, the matter register and an AML gate on each matter. In one fund licensee's staff portal, critical-event tracking and policy modules sit inside a data model built around the AFSL perimeter.
Where the data lives, and how it is kept apart
In Australia. The clinical app we run and the client platforms we host sit in Australian Azure regions, with secrets held outside the code and every release through a reviewed pipeline.
Regulated software has to answer two questions: whose data is this, and who did what to it. Each client's data is kept apart in the database itself, and every change is written to an audit trail the client can read back.
Audit trails in production
The separation sits in the database itself, where one practice or one firm cannot read another's records whatever the application above it is asked, and the data never leaves Australia.
Audit trails are built the same way. A law firm's portal writes to an append-only audit ledger, machine-enforced on every state change. An AFSL holder's compliance log holds who changed what, and what it said before, structured around the firm's retention obligations. Aurii keeps a tamper-evident audit trail on every clinical record.
Platform assessments and privacy
Azure's infrastructure is independently IRAP-assessed to PROTECTED and holds ISO 27001 and SOC 2 at the platform level. Those are the platform's assessments, separate from what Black Shard holds.
We build to the Australian Privacy Principles under the Privacy Act 1988, and Aurii's clinical and privacy frame was designed for Australian obligations from the start.
How an engagement runs
An engagement runs as one of two shapes: a defined build with a brief, a delivery date, and a deliverable set agreed before work starts, or an ongoing engineering engagement, where a standing team designs, ships, and operates as the product continues to evolve after launch.
Compliance and security seats alongside a build
Where the brief also carries a compliance target or needs a standing security seat, those run as services in their own right alongside the build: readiness programs toward Essential Eight, SMB1001, ISO 27001, or Privacy Act uplift, and standing advisory or vCISO.
The client portals we run for law and investment firms are among the systems that take shipped changes under ongoing engagements. A defined build names the target, timeframe, and deliverable up front.
Financial services
Stone Leaf Capital
Staff, investors and the board work from one portal inside the licence perimeter.
The board signs resolutions and minutes in the portal under e-signature.
Health
Aurii
Specialists run notes, letters, orders and billing from one app.
Every clinical record, recording and generated document stays in Australia.
Product screens shown with sample data.
From the newsroom
Software engineering, in the newsroom.
Questions, answered.
How much does custom software development cost in Australia?
Every engagement is priced on the brief. The drivers are which platforms are in scope, how much integration surface the system carries, whether tenancy is single or multi, and which obligations the data brings with it. Name those in your brief and the reply comes back with the questions needed to scope it.
Where does the work happen?
Australia-wide. Delivery, access and reporting run the same way wherever the client is based.
Do you keep operating the software after launch?
Yes, where the engagement calls for it. Our own clinical app ships a release every week after launch, and the client portals we run take shipped changes under ongoing engagements. A defined build with a delivery date is scoped that way from the start.
What technology stack do you build on?
Microsoft Azure in Australian regions, with each client's data kept apart in the database itself and credentials held outside the code. iOS and Android apps from the same codebase where the product needs them. Our own clinical app runs this way in production, in Australia.
How is security handled during the build?
Threat modelling in the first design session, least-privilege architecture, disciplined secrets handling, and security review gates through delivery. The finished system is then tested against the OWASP and ASD methodologies by the firm's cybersecurity practice, and findings are manually verified before they are reported.
Do you build compliance software for Australian firms?
Yes. A Queensland law firm runs intake, conflicts checks, its matter register and an AML gate on each matter on a portal we built, over an append-only audit ledger, and an AFSL holder runs its staff portal with a compliance audit log structured around the licence perimeter. The obligations are designed into the data model.
Can the build include compliance readiness?
Yes. We run milestone-driven programs toward Essential Eight, SMB1001, ISO 27001, and Privacy Act readiness, and build the evidence trail an assessor expects as controls land.
How do I start?
Email info@blackshard.com.au or open a brief through the contact page. A rough brief is enough to open the scoping conversation.
