SaaS Development Company in Edinburgh

Tenant tiering and access control depth are the levers on an Edinburgh SaaS build. A scoped Edinburgh SaaS MVP is a ten to sixteen week engagement covering multi-tenant architecture, authentication, billing, an admin console, and a UK GDPR ROPA. A mid-stage production SaaS adds Stripe Billing, role-based access, audit logs, accessibility compliance, and FCA-aligned controls if relevant. Full enterprise SaaS platforms add multiple tenant tiers, SSO via Azure AD and Okta, SCIM provisioning, PSD2 SCA, and Scottish public sector framework readiness. Edinburgh sits close to London for senior engineers and slightly below for delivery teams. We give fixed-fee proposals rather than open time-and-materials estimates, and we handle VAT on UK invoices in GBP.

Yes. We ship platforms for NatWest Group adjacent firms, Lloyds Banking Group partners, Phoenix Group (abrdn and Standard Life) suppliers, Scottish Widows, Aegon UK, and Edinburgh fintechs including Modulr-style payment SaaS and Aveni-style regulated AI. Builds run under FCA Consumer Duty outcomes, SM&CR accountability mapping, PRA operational resilience (SS1/21) impact tolerance documentation, and the Bank of England DORA-equivalent third-party risk framework. We stay inside AWS eu-west-2 or Azure UK South, run PSD2 Strong Customer Authentication where payments are in scope, tokenise PII, and produce SAR and STR-ready audit logs. Every release ships with a Consumer Duty fair value assessment template the firm’s compliance team can sign off without external review.

The Scottish Government Digital Standard sets fourteen criteria for any public service in Scotland: understanding user needs, multidisciplinary teams, agile delivery, accessibility, open standards, security, and continuous improvement among them. It mirrors the GOV.UK Service Standard but is enforced for Scottish ministries, agencies, NHS Scotland boards, and Scottish local authorities. Our public sector engagements produce evidence against each of the fourteen criteria, deliver WCAG 2.2 AA conformance for PSBAR 2018, secure Cyber Essentials Plus before go-live, and prepare a self-assessment pack against the Scottish Public Sector Cyber Action Plan. We integrate myaccount (Scotland Account) for citizen authentication when Single Sign-On to Scottish Government services is required, and align with mygovscot.scot patterns.

Yes, this is one of Edinburgh’s defining specialisms. Skyscanner set the global pattern for high-volume metasearch SaaS out of Quartermile, and TVSquared extended it into attribution. We build travel inventory aggregators, dynamic pricing engines, fare polling pipelines, and metasearch APIs with sub-200ms p95 latency targets, Edge caching on CloudFront or Cloudflare, partitioned Postgres for booking history, ClickHouse for analytics, and Kafka for inventory updates from GDS feeds (Amadeus, Sabre, Travelport). For ATOL-protected packages we wire the CAA reporting flow. Payments support Strong Customer Authentication under PSD2 and 3D Secure 2. Privacy and consent layers handle UK GDPR plus EU GDPR for cross-border bookings and ICAO marketing rules.

UK GDPR and the Data Protection Act 2018 govern every Edinburgh SaaS we ship. Discovery produces a Record of Processing Activities, a lawful basis register, and a Data Protection Impact Assessment when processing is high-risk (financial, health, large-scale profiling, biometric, children). Architecture defaults to data minimisation, pseudonymisation, and tokenisation, with subject access request (SAR) tooling baked into the admin console so the controller can answer within the statutory thirty days. International transfers use the ICO International Data Transfer Agreement (IDTA) or the UK Addendum to EU SCCs, with Transfer Risk Assessments on file. We document retention schedules, breach notification playbooks aligned with the ICO seventy-two-hour rule, and ROPA updates on every schema change.

Yes. myaccount is Scotland’s national digital identity layer, operated by the Improvement Service on behalf of Scottish Government and Scottish local authorities. It is the Scottish equivalent of GOV.UK One Login for citizen-facing services, and integration is mandatory for many Scottish public sector procurements. We have built OpenID Connect integrations to myaccount for council and NHS Scotland-adjacent services, mapped attributes to the Scottish Public Service Reform identity matching standards, and handled assurance levels appropriate to the service. Where myaccount is not yet available for a use case, we fall back to GOV.UK One Login or an Azure AD B2C tenant configured against the Scottish Government Digital Standard.

Most custom SaaS work qualifies under the merged UK R&D Expenditure Credit (RDEC) scheme, which replaced the separate SME and large-company schemes for accounting periods starting on or after 1 April 2024. The merged scheme offers a 20 percent above-the-line credit, with an enhanced rate for R&D-intensive SMEs (loss-making companies spending at least 30 percent of total expenditure on qualifying R&D). Eligible activities typically include architectural experimentation, novel data pipelines, performance optimisation under genuine uncertainty, and integration work that resolves non-trivial technical unknowns. Routine configuration does not qualify. We deliver time-tracked logs, technical narratives, and failed-hypothesis documentation that align with HMRC CIRD guidance and the post-2024 Additional Information Form. Final eligibility sits with your R&D adviser and HMRC.

A typical Edinburgh fintech SaaS (adviser portal, policy administration, payments orchestration on Modulr or ClearBank, regulatory reporting dashboard) takes sixteen to twenty-six weeks from kickoff to production, assuming the FCA perimeter analysis and SM&CR documentation sit inside scope. Weeks 1 to 4 cover discovery, regulatory classification, and architecture. Weeks 5 to 14 cover multi-tenant build, billing, identity, and core domain features. Weeks 15 to 20 cover PSD2 SCA, operational resilience evidence under PRA SS1/21, WCAG 2.2 AA accessibility for PSBAR if any public-sector route applies, and penetration testing by a CREST-accredited tester. Weeks 21 onward handle phased rollout, Consumer Duty fair-value reviews, and ICO accountability sign-off. We have shipped to this cadence inside Scottish financial services stacks.