SaaS Development Company in Leeds

Three stages describe most Leeds SaaS work, and the evidence pack is what stretches the last one: a scoped Leeds SaaS MVP covering multi-tenant architecture, authentication, billing, an admin console, and a UK GDPR ROPA, a mid-stage production SaaS (Stripe Billing, role-based access, audit logs, accessibility compliance, and the relevant regulator pack such as NHS DTAC or UKGC RTS), or a full enterprise SaaS platform with multiple tenant tiers, SSO via Azure AD and Okta, SCIM provisioning, NHS Login or UKGC integration, and procurement-ready evidence packs. Leeds rates sit below London for delivery teams while keeping pace on senior engineers because of the NHS Digital and Sky Betting talent gravity. We give fixed-fee proposals in GBP, handle UK VAT, and net any R&D Expenditure Credit forecast against the scope where eligibility is clear.

The Digital Technology Assessment Criteria (DTAC) is the baseline national assessment for any digital health technology entering an NHS Trust, ICB, or central NHS England commissioning. It covers five core areas: clinical safety, data protection, technical security, interoperability, and usability and accessibility. Our health SaaS engagements produce the full DTAC pack: a DCB 0129 manufacturer clinical safety case authored by a named Clinical Safety Officer, a DPIA aligned with the ICO and NHS England templates, a Cyber Essentials Plus certificate, conformance evidence against NHS Digital interoperability standards (HL7 FHIR R4, SNOMED CT, dm+d), and an accessibility statement against WCAG 2.2 AA for PSBAR. The Trust-side DCB 0160 deployer safety case is co-authored with the Trust’s own Clinical Safety Officer at deployment.

Yes. Sky Betting and Gaming, William Hill, and the wider Leeds-Sheffield gambling cluster operate under UK Gambling Commission technical standards and licence conditions. Our gambling-tech SaaS builds against the UKGC Remote Technical Standards (RTS), Remote Gambling and Software Technical Standards testing through a UKGC-listed test house (eCOGRA, GLI, BMM), GAMSTOP self-exclusion integration (mandatory for all remote operators), single customer view (SCV) under the SCV consortium, AML risk frameworks under the Money Laundering Regulations 2017, the new financial risk and affordability rules, and ICO Children’s Code where any user might be under 18. We do not work with unlicensed operators, and we run a separate diligence pass before any UKGC-touching engagement begins to confirm licensing status.

NHS Login is the national citizen authentication layer operated by NHS England from Leeds, with around 60 million accounts as of 2024. It uses OpenID Connect with NHS-specific scopes and care-identity assurance levels (P5, P9, P9 with photo ID). We register the SaaS as an NHS Login relying party, integrate the OIDC client with the correct assurance level for the use case (a symptom checker can run at P5; a service that releases medical records typically requires P9), and handle the federated identity matching to NHS number via the Personal Demographics Service. The integration is documented in the DTAC submission, and we keep audit logs against NHS England’s identity assurance audit requirements. For staff-side authentication we integrate NHS Care Identity Service 2 (CIS2) under the same submission.

UK GDPR and the Data Protection Act 2018 govern every Leeds SaaS we ship, and both healthcare and gambling-tech carry additional sectoral overlays. For healthcare, the Common Law Duty of Confidentiality, Section 251 of the NHS Act 2006 (where applicable), Caldicott Principles, and the National Data Opt-Out interact with UK GDPR; our DPIAs explicitly map these. For gambling-tech, the UKGC requires identity verification under AML rules, which conflicts with data-minimisation principles unless documented carefully; our DPIAs reconcile the two with retention schedules aligned to UKGC record-keeping requirements (typically five to seven years). International transfers use the ICO International Data Transfer Agreement (IDTA), with Transfer Risk Assessments on file. Breach response follows the ICO seventy-two-hour rule plus the additional notifications to NHS England DSP Toolkit or UKGC where applicable.

Most custom SaaS work qualifies under the merged UK R&D Expenditure Credit (RDEC) scheme, which replaced the separate SME and large-company schemes for accounting periods starting on or after 1 April 2024. The merged scheme is a 20 percent above-the-line credit, with an enhanced rate for R&D-intensive loss-making SMEs (currently those spending at least 30 percent of total expenditure on qualifying R&D). Eligible activities typically include architectural experimentation, novel data pipelines, performance work under genuine uncertainty, and integration work that resolves non-trivial technical unknowns (NHS FHIR API edge cases, UKGC RTS performance constraints, large-scale billing reconciliations). Routine configuration does not qualify. We log billable hours dual-tagged so your R&D adviser can extract the qualifying portion against the post-2024 Additional Information Form. Final eligibility sits with your adviser and HMRC.

A typical NHS-procurement-ready SaaS (DTAC-conformant, DCB 0129 manufacturer safety case, NHS Login or CIS2, basic FHIR integration, Cyber Essentials Plus, WCAG 2.2 AA accessibility statement) takes eighteen to twenty-eight weeks from kickoff to a Trust-ready release. Weeks 1 to 4 cover discovery, DTAC scoping, and clinical safety case opening with a named Clinical Safety Officer. Weeks 5 to 14 cover multi-tenant build, NHS Login or CIS2 integration, FHIR endpoints, and core domain features. Weeks 15 to 20 cover clinical safety case completion, Cyber Essentials Plus certification, a CREST-accredited penetration test, and PSBAR accessibility audit. Weeks 21 onward handle Trust-side DCB 0160 co-authoring, NHS England DSP Toolkit completion (where the Trust requires it of the supplier), and phased rollout. We have shipped to this cadence inside the NHS England framework ecosystem from Leeds.

Yes. ASDA, headquartered at Asda House in Leeds Valley Park, operates inside the Walmart partner ecosystem and inherits Walmart’s supplier and technology standards. Retail SaaS for ASDA-adjacent buyers typically requires PCI DSS Level 1 for any payment data, GS1 standards for product identifiers and barcodes, EDI integration (EDIFACT or X12 depending on the supplier path), and increasingly an ESG and modern slavery reporting layer aligned with the Modern Slavery Act 2015. We build to those standards, integrate with Walmart Connect retail media APIs where applicable, and ship a partner-onboarding pack that ASDA category and supplier teams can review without a follow-on engagement. UK GDPR sits over the top, with retention schedules tuned to Sale of Goods and Consumer Rights Act obligations.