Custom software development in Brisbane.
Black Shard designs and builds web applications, mobile applications and internal operating systems from its Brisbane office.
Black Shard designs and builds web applications, mobile applications and internal operating systems from its Brisbane office. Our existing work includes clinical software, legal and compliance platforms, financial-services systems and workflow automation.
Projects can run as a defined build or as an ongoing engineering engagement where the product continues to evolve after launch. Delivery is Australia-wide from the Brisbane head office.
What we build
Web applications, native iOS and Android apps, client portals, and the internal operations platforms a business runs on. Where the build needs one, we design the brand and design system as well. The platform layer is part of the work: data model, delivery pipeline, observability, and the audit trail the system's obligations call for.
For GRM LAW, a Brisbane law firm, we built the operations and compliance portal the firm runs on day to day. It sits over Smokeball and holds intake, conflicts checks, a matter register, AML/CTF readiness, and an append-only audit ledger enforced on every state change. Both that portal and Stone Leaf Capital's take their bank truth from the Xero integration services we build on the Accounting API. For Stone Leaf Capital, an Australian capital-markets firm, we built the staff portal behind the business: critical-event tracking, policy modules, and a compliance audit log capturing actor, action, and before-and-after state on every change, structured around the firm's AFSL perimeter.
Aurii, clinical voice software for Australian private-hospital specialists, was built and is operated by Black Shard: native iOS and Android apps, a web app, speech and OCR pipelines, and a multi-tenant data layer.
- Web applications and client portals
- Native iOS and Android apps
- Internal operations and compliance platforms
- Multi-tenant data layers with row-level security
- Speech, document and workflow automation
- Brand identity and design systems where the build needs one
How an engagement runs
Two shapes. A defined build has a brief, a delivery date, and a deliverable set agreed before work starts. An ongoing engineering engagement gives you a standing team that designs, ships, and operates the software as the workflow changes; GRM LAW's portal and Stone Leaf Capital's platform both take shipped changes under that model.
In either shape, delivery runs from discovery and design through to a shipped, operating product. Access during the engagement is least-privilege, secrets stay out of code, and security review gates run through delivery.
Why we build on Azure
Aurii runs on Microsoft Azure in the Australia East region: Container Apps for the app server, PostgreSQL with row-level security isolating tenant data, Key Vault for secrets, and GitHub Actions with Workload Identity Federation for deploys. Client builds use the same architecture.
Australian regions are the default for anything holding client data. Azure's infrastructure is independently IRAP-assessed and holds its own certifications at the platform level. Those are the platform's assessments, separate from what Black Shard holds. What we add is the engineering: the tenancy model, the audit trail, and an architecture designed around the obligations the system carries, whether that is the Privacy Act, an AFSL perimeter, or clinical data handling.
Why does secure-by-design engineering matter?
Security added after the architecture has settled costs more than security designed in. Threat modelling runs from the first design session, so trust boundaries, attack surface, and data obligations shape the design.
The shipped work shows the result. GRM LAW's portal enforces role-based access and ships a hardened content-security policy. Aurii isolates tenant health data with PostgreSQL row-level security and carries tamper-evident audit trails and rate limiting throughout. Restart Recruitment ships with invariant tests pinning its security model, covering TOTP replay, OAuth timing, and signing caps, so a later change cannot regress it unnoticed.
The other half of the firm is a cybersecurity practice: penetration testing, red teaming, and secure code review against the OWASP and ASD methodologies.
What does a custom build cost?
We do not publish indicative ranges. Cost follows scope, and scope has named drivers: how many platforms the build spans (web, iOS, Android), the integration surface, whether the data layer is single-tenant or multi-tenant, the compliance obligations the system carries, and whether the build needs a brand and design system or slots into an existing one.
A defined build is quoted against the brief and delivery date. An ongoing engagement runs as a standing team on an agreed cadence. Send the brief either way to info@blackshard.com.au; the reply covers shape and scope.
Questions, answered
- Do you only work with Brisbane businesses?
- No. Delivery is Australia-wide from the Brisbane head office. GRM LAW is a Brisbane firm; Stone Leaf Capital and Aurii serve national markets. The engagement model is the same in every state.
- Do you build native mobile apps or just web?
- Both. Aurii ships as native iOS and Android apps alongside its web app. Where a build only needs the web, the scope says so.
- What happens after launch?
- Under an ongoing engagement the product continues to evolve after launch on a regular ship cadence. Under a defined build, the system is delivered as a shipped, operating product with its delivery pipeline in place.
- Do you quote fixed-price or time-and-materials?
- A defined build is quoted against the brief before any work starts. An ongoing engagement runs as a standing team on an agreed cadence, reviewed as the work evolves.
- Can you get the system ready for Essential Eight, ISO 27001, or SMB1001?
- Yes, as a distinct compliance readiness service. Certification readiness runs as a milestone program alongside or after the build, and the evidence trail an assessor expects is assembled as controls land.
- Who operates the software once it is built?
- Under an ongoing engagement, Black Shard operates what it ships, as it does for Aurii and for the GRM LAW and Stone Leaf Capital portals. A defined build is delivered as a shipped, operating product with its delivery pipeline in place, and operation after delivery is agreed in the brief.
- How do we start?
- Email info@blackshard.com.au or open a brief through the contact page. The first conversation establishes the shape: defined build or ongoing engagement, the platforms involved, and the obligations the system will carry.
Tell us what you need built.
Brisbane head office. Work delivered across Australia.