Seven services a US client can buy from us, from a free scoping call to a support retainer, each with what it includes, how it is accepted and when it runs in your time zone. Then the company that signs, the state law that governs, and the privacy laws each service touches.
Our custom software development services in the USA run in seven parts: a free scoping call, a priced two week discovery, design, build sprints, testing, launch, then a support retainer or a handover. The New York office replies 9 AM to 6 PM Eastern on weekdays, which is 6 AM to 3 PM Pacific. US engagements usually default to New York law, and your MSA names the company you contract with.
Two terms are missing from this page on purpose: a warranty period after acceptance, and our insurance cover. We have not published either, so we will not print a figure here. Ask us for both in writing, as you would ask any vendor, and have the answers written into the statement of work before anyone signs.
This page covers terms only. To check who we are, where the engineers sit and which registrations back us, read our custom software development company profile; for the kinds of systems we build, read our services overview; and for whether a US team, an offshore one or a mix suits you, read custom software development in the USA.
Each row is a piece of work you can buy, in the order a build runs. The third column is what that service hands you; when ownership of the code passes to you is a contract term, covered in section 05.
| Service | What it includes | What you keep | How it is accepted | When it runs |
|---|---|---|---|---|
| 1. Scoping call | Thirty minutes, free, on the problem rather than a pitch deck | When the work fits, a written scope with its quote, sent inside 48 hours | Nothing to accept: no promise made on the call binds either side | Booked at least five days ahead; a same week slot on request |
| 2. Discovery sprint | Requirements workshops, a map of each system the build connects to, a risk register, a threat model, a data flow diagram and architecture decision records | All of those documents, plus a fixed bid for the build or advice to buy a product instead | Priced on its own, so you can stop here without committing the build budget | Two weeks |
| 3. Design | A screen set per user role plus the data model, and our CTO approves the architecture | The agreed screens and data model | You approve them before any code is written | Before the first build sprint |
| 4. Build sprints | Sprints of one to two weeks, from about day 15, in repositories held in your name | The code to date, plus a recorded demo every week noting what shipped and what slipped | No recorded demo that week means no invoice for that week; anything outside the scope needs a written change request stating its cost and how it moves the date | 8 to 12 weeks is normal for an MVP, 16 to 28 for a production platform |
| 5. Testing | Our in-house QA team checks every build before a preview reaches you, inside a pipeline with automated tests | The CI/CD pipeline and its automated tests | Against the acceptance criteria written into your SOW | Every sprint |
| 6. Launch | A rollback path, tested before the first production release; bigger systems are released module by module | Release notes and the live system, in cloud accounts on your billing | Against the same SOW criteria, module by module where the system is phased | After the last build sprint |
| 7. Support or handover | A monthly retainer for roadmap work, integrations and incidents, or a handover to your own team | On handover: architecture documents, operating runbooks and a knowledge transfer session | Billed monthly. We publish no response time by severity, so write one into its SOW, as section 03 suggests. A team starts at one senior engineer and one designer | Weekdays 9 AM to 6 PM Eastern, with emergency cover at any hour |
Two other shapes of contract sit beside these seven. A dedicated team is a lead, engineers and QA who own part of your roadmap, billed monthly, normally for a quarter or longer; see dedicated development teams. Staff augmentation places engineers who pass your interview and security checks inside your own team, typically within two weeks; see hiring software developers.
Whichever shape you pick, the repositories and cloud accounts belong to your company from day one and run on your billing. Our engineers are collaborators on them, and you can remove any of them.
Under our terms, a commitment binds us only once an executed SOW carries it with an acceptance criterion. That makes the criteria the most important lines you will negotiate. Vague ones such as "works as expected" protect nobody, so here is how to phrase a testable one for each service.
Decide two more things before the build starts: who on your side signs each acceptance off, and how many days they have to do it. A sign off that waits a month holds up the next phase.
Our free SOW generator puts acceptance criteria beside the scope, deliverables and milestones, and exports a PDF you can send to any vendor.
We publish one window: the New York office answers on the same working day, Monday to Friday, from 9 AM to 6 PM Eastern. Because that window is set in New York time, it moves with New York when the clocks change, so the table below holds all year everywhere except Arizona and Hawaii.
| Time zone | Reply window, weekdays | Note |
|---|---|---|
| Eastern | 9 AM to 6 PM | The published window itself |
| Central | 8 AM to 5 PM | A full working day |
| Mountain | 7 AM to 4 PM | The last hour of a 9 to 5 day falls outside it |
| Pacific | 6 AM to 3 PM | Questions after 3 PM fall outside it |
| Arizona | 6 AM to 3 PM, March to November; 7 AM to 4 PM in winter | Most of the state keeps standard time all year |
| Alaska | 5 AM to 2 PM | Questions after 2 PM fall outside it |
| Hawaii | 3 AM to noon, March to November; 4 AM to 1 PM in winter | Hawaii does not change its clocks, so the afternoon falls outside it |
Outside that window, our Delhi and Sydney offices between them cover a production emergency at any hour, and someone picks up an after hours message inside one to two hours. The engineers in Delhi and Lucknow set their working hours to face New York. Those are the published commitments; a response time for each severity level belongs in your support SOW, as section 03 says.
If your team is on the West Coast, plan the weekly demo and any sign off meetings for the morning. To check a meeting time across your offices and ours, use our free time zone planner, which highlights where the 9 to 6 working hours of every city you add overlap.
Clients in New York can also meet us face to face: we hold the kickoff, design reviews and the meetings of launch week at our NoMad office at 1140 Broadway or at your own office, and the quote carries no travel charge. For directions and hours, see the New York office page.
We are registered twice: in the US as Digital Heroesco LLC, and in India as Digital Heroes Technologies Pvt Ltd, a private limited company whose registered office is at Connaught Place, New Delhi 110001. Which of the two you contract with is named in your MSA. Ask which it will be before the first draft reaches you, then check that name against our Dun & Bradstreet record, DUNS No. 650878346, using the D&B DUNS lookup.
For an engagement anchored in the US, the MSA's usual default is New York law, with any dispute heard in New York. If that does not suit your company, the alternatives we negotiate include Delaware, England and Wales, Singapore, and arbitration under the JAMS or LCIA rules. Raise it at the scoping stage; a venue clause is cheap to change before signature and slow to change after.
On full payment, the MSA assigns you everything made specifically for your project: code, designs, copy and custom assets. We hold on to libraries and tools that predate your project or that we built to reuse across clients, and we may show the finished system in our portfolio unless you tell us in writing not to. A contract with no portfolio use and strict work for hire terms can be written into the SOW, priced in the open.
We have not published a warranty period or our insurance cover, so neither is stated here. Put both questions to us in writing, and to every other firm you are comparing. On the warranty, ask how many days after acceptance a defect is fixed at no charge, and how a defect is told apart from a change: the cleanest test is whether the work fails a criterion the SOW already contains.
On insurance, ask which policies the firm holds, usually professional liability (also called errors and omissions) and cyber cover, the limit of each, and whether it will send a certificate of insurance. A vendor that cannot answer either question in writing has told you something useful.
Which laws reach your system depends on whose data it holds and what your business does, not on where the code is written. Most of them share one feature that matters for a software contract: they require a written agreement with the vendor who handles the data for you. This table is a map with a link to each law, not legal advice; your counsel decides which apply.
| Law | Who it covers | What it asks of your software vendor | Services it reaches |
|---|---|---|---|
| CCPA, as amended by the CPRA (California) | For-profit businesses doing business in California with revenue above $25 million a year (a figure the state adjusts), or that buy, sell or share the personal information of 100,000 or more California residents or households, or earn half or more of their revenue from selling or sharing it | A written contract that names the specific business purpose, bars selling or sharing the data or using it for anything else, and requires the same level of privacy protection the CCPA asks of the business, under section 7051 of the CCPA regulations | Discovery, build and support, wherever California residents' data is held |
| State consumer privacy acts (Virginia, Colorado, Connecticut, Texas and others) | Residents of each state, with thresholds that differ: Connecticut's reaches firms that control or process data on 35,000 or more of its consumers, or any of their sensitive data, while Texas generally exempts small businesses as the SBA defines them | A binding processor contract with instructions for the data, a duty of confidentiality on every person who handles it, deletion or return at the end, and written terms for any subcontractor (Virginia Code section 59.1-579) | Every service that handles personal data, and the handover, where data is deleted or returned |
| HIPAA (federal) | Health plans, health care clearinghouses and providers that send covered transactions such as claims electronically, plus any business associate that creates, receives, maintains or transmits protected health information for them (45 CFR 160.103) | A business associate agreement before any protected health information is shared: safeguards, reports of improper use including breaches, and the same terms passed to subcontractors (45 CFR 164.504(e)) | All seven, from discovery onward, once health records are in scope |
| COPPA (federal, FTC) | Operators of sites or apps directed to children under 13, or that know they collect a child's personal information | A notice of what is collected from children, verifiable parental consent before collection, and a way for parents to review the data (16 CFR 312.3) | Design, where age screens and consent flows are drawn, then build and testing |
| GLBA Safeguards Rule (federal, FTC) | Financial institutions that no other federal regulator oversees, such as mortgage lenders and brokers, payday lenders, finance companies and check cashers (16 CFR 314.1) | The institution must pick service providers able to keep safeguards, require them by contract, and assess them periodically (16 CFR 314.4(f)) | Discovery, where the risk assessment starts, then build and support |
| SHIELD Act (New York) | Businesses that keep New York residents' private information, including usernames or email addresses with passwords | Administrative, technical and physical safeguards, among them assessing risk in software design, choosing service providers that can keep safeguards and requiring them by contract, and prompt notice to consumers after a breach | Design, build and support |
We sign a business associate agreement on any build that handles protected health information. Those systems are hosted on AWS, Azure or Google Cloud with the cloud company's BAA in place, and an independent firm has reviewed our HIPAA practices. Our healthcare software page covers what we build there and what we refer elsewhere.
For the other laws, bring your own processor or service provider addendum to the scoping call, so its clauses are priced into the SOW rather than discovered after it. The threat model and data flow diagram from discovery then show where personal data enters, where it is stored and who can reach it.
This page names no SOC 2 report or ISO 27001 certificate, so do not assume we hold one. If any vendor on your list claims either, ask who audited it and when the report was issued.
Accessibility is not privacy, but it reaches design and testing just as directly. The Department of Justice's web guidance under the ADA says businesses open to the public must make the goods and services they offer online accessible to people with disabilities. It sets no detailed standard for businesses and points to WCAG and the Section 508 standards; state and local governments have separate rules published in April 2024. Name the WCAG level in your testing criteria.
Our published bands cover a whole build, not an hour of work. A focused first version lands between $40,000 and $150,000; a complex enterprise platform runs from $250,000 to $500,000 or more. Where yours falls depends on its scope, its integrations, its security needs and how much data has to move. A SaaS MVP usually sits between $30,000 and $80,000.
| Service | How it is priced | Published figure |
|---|---|---|
| Scoping call | Free | None needed |
| Discovery sprint | A separate price, quoted in the written scope | Not published |
| Design, build, testing and launch | One fixed bid against the discovery documents; changes priced separately | $40,000 to $150,000 for a focused first version; $250,000 to $500,000 or more for complex enterprise platforms |
| Support retainer | Billed monthly | No price published; the smallest team is a senior engineer and a designer |
| Handover | The handover pack comes with every engagement model | No separate price published |
We quote builds as one fixed bid after discovery rather than by the hour, so the price is tied to the written scope and not to time spent. If you are weighing what a US hire, a US agency and an offshore team cost by the hour, our page on custom software development in the USA compares each staffing model, starting from Bureau of Labor Statistics wage data.
Upkeep after launch is a separate line in any budget. Our free software maintenance cost calculator estimates it as a yearly share of the build, and the custom software cost drivers page explains what moves a quote up or down.
Every client below agreed to be shown. No results figure has been published for any of the three, so we give none; each card says only what we built.
We built the athlete and trainer mobile apps: athletes find trainers, book sessions and answer offers, while trainers run their schedules and follow their earnings. React Native with Expo, on Supabase.
The whole workforce planning platform and its website: monthly shift rosters, leave approved at three levels, with a warning when two people of the same speciality would be away together, training attendance, certification expiry reminders, six roles and an audit history.
An online print store with design editing in the browser, print runs driven by CSV variable data, proofs and production files, PayFast checkout with webhooks, and an admin panel with three roles. Next.js 15, React, TypeScript and Supabase.
Our Clutch profile shows 5.0 from 66 verified reviews (checked 13 October 2026); read the reviews there, since the rating may have moved.
Send the same ten to every firm on your shortlist, ourselves included, and ask for the answers in writing.
For us, this page answers questions 1, 2, 5 and 9, answers question 6 for health data, and answers question 8 in part: our criteria are whatever your SOW says. It does not answer 3, 4, 7 or 10, so ask us those in writing exactly as you would ask anyone else. For named firms scored side by side, our ranking of nine USA custom software firms puts us first and says so above the list.
Which firm suits you depends on the job: large consultancies fit programmes that run for years, smaller studios fit a single product. Most lists that rank for this search were written by vendors (we are one) or by review sites, so check who wrote a list before trusting its order. Our ranked list of nine gives every firm a line on who it does not fit; we wrote it, put ourselves first and say so above the list.
Seven separate pieces of work: a scoping call, discovery, design, build sprints, testing, launch, and then support or a handover. You can stop after discovery with its documents, or buy design through launch as one fixed bid. Section 02 sets out what each of ours includes and how it is accepted; the kinds of system we build are on our services overview.
We do not sell builds by the hour. After discovery you get one fixed bid: $40,000 to $150,000 for a focused first version, and $250,000 to $500,000 or more for a complex enterprise platform. The scoping call is free and discovery is quoted on its own. Hourly bands for US, nearshore and offshore teams are compared side by side on our custom software development in the USA page.
That turns on whose data the system holds. California residents' data can bring in the CCPA, health records held for a provider or plan bring in HIPAA, data from children under 13 brings in COPPA, and residents of Virginia, Colorado, Connecticut, Texas and other states have their own acts. Section 06 maps each to the services it reaches; your counsel makes the final call.
We have both: a US company, Digital Heroesco LLC, and an Indian one, Digital Heroes Technologies Pvt Ltd. The MSA names the one you contract with, so ask which it will be before the draft arrives, and say so if your procurement rules require a US counterparty. Check the name against our DUNS record before signing.
We have not published a warranty period, so this page cannot give you one. Ask for it in writing and have it written into the SOW: how many days after acceptance defects are fixed free, and how a defect differs from a change. A defect fails a criterion the SOW already holds; a change asks for something it does not.
Yes, whenever a build handles protected health information. Hosting then goes on AWS, Azure or Google Cloud, covered by that cloud company's BAA, and an independent firm has reviewed our HIPAA practices. Sign the BAA before any patient data reaches us, including test data copied from a live system. For video visit products, see our telehealth app developers page.
Our Delhi and Sydney offices do. Between them they cover a production emergency at any hour, and someone picks up an after hours message inside one to two hours. The New York reply window, 9 AM to 6 PM Eastern, closes at 3 PM Pacific, so a production failure later in a California working day goes to that emergency cover.
In New York, yes. The kickoff, design reviews and launch week meetings can be held at our office at 1140 Broadway, Suite 704, or at yours, and we add no travel charge to the quote. The engineers themselves work from Delhi and Lucknow, with some mobile engineers in Sydney, so the weekly demo is recorded and shared rather than held in a room.
Last reviewed .
Send the problem, plus any processor addendum, BAA or procurement terms your company uses. The call takes 30 minutes; when the work fits, a written scope with its quote reaches you within two days. Book a call with a tech lead.
115 people across five studios in New York, Delhi, London, Sydney and Lucknow, shipping ecommerce, web, software and mobile work for founder-led brands. Senior engineers only, no account-manager relay, and the same team from kickoff to launch.
Chief Technology Officer · Lucknow · 50 posts on the site
Published .
Pinch, scroll or double-tap to zoom · drag to pan
Where should we send the proposal?
Please enter your name and a valid email.
Any faster way to reach you? Optional.
Please fill in the one you picked.
