Web Development Company in San Francisco

Scope sets the figure, and scope here spans: a focused marketing site or product landing built at SF quality, a B2B SaaS application with dashboard, admin, billing through Stripe, SSO through Clerk or WorkOS, and SOC 2-aligned logging, or a full multi-surface platform with marketing, app, docs, customer portal, and partner portal, scoped and contracted annually. SF rates sit above most US markets because of the Stripe, Vercel, and Linear engineering premium, but we deliver from Edmonton and Chandigarh on PST hours, so you get Bay Area quality without Bay Area headcount cost. Fixed-fee proposals only, no open T and M.

Next.js on Vercel is our default for product surfaces and most marketing sites, because the App Router, React Server Components, Server Actions, and Vercel's edge network match what most SF teams have already standardized on. We use Astro 4 for content-heavy marketing and documentation sites where SSG and partial hydration beat full SSR, especially when the content team ships often through a headless CMS. We use Remix when the team is already committed to it or when the customer's enterprise stack rules out Vercel. We use Cloudflare Pages with Workers when the customer is already on Cloudflare for DNS, CDN, and edge. We will not push a framework just because it is on our bench. We will tell you during discovery which stack actually fits your product and team, and we will say so plainly if your current stack is already the right call and we just need to ship features on it.

California is one of the most active jurisdictions in the US for ADA Title III web accessibility lawsuits, and SF is squarely inside that exposure. We treat WCAG 2.2 AA conformance as a real requirement, not a checkbox. During discovery we run an accessibility review on existing comps, set keyboard navigation, screen reader, and color contrast targets against WCAG 2.2 AA, and budget remediation explicitly. Build sprints include axe-core in CI, manual NVDA and VoiceOver testing on critical flows, and focus management audits on every interactive surface. We deliver an accessibility statement, a VPAT 2.4 when enterprise customers ask for it, and a documented remediation plan for any known gaps. We will not ship an SF web app without this. The litigation history makes it a real risk and California courts have not been generous on demand letter responses.

The California Consumer Privacy Act and its successor the California Privacy Rights Act apply to most web apps with California users, which in SF is effectively all of them. We map data collection during discovery, build the access, deletion, opt-out, and limit use of sensitive personal information flows the law requires, publish the privacy notice and Do Not Sell or Share signal handling (Global Privacy Control included), and document cookie consent for the categories the CPRA cares about. California AB 2013, signed September 2024 and effective January 2026, requires generative AI developers to publish training data summaries, which matters for any web app that trains or fine-tunes models on user data. We build the disclosure documentation alongside the model card. The California Consumer Privacy Agency rulemaking on automated decision-making technology is also in motion and we track it during builds that touch profiling.

Google's published Core Web Vitals thresholds are LCP under 2.5s, INP under 200ms, and CLS under 0.1, but the SF bar set by Linear, Stripe, Vercel, and Figma is significantly more aggressive. We target LCP under 1.5s, INP under 100ms, and CLS under 0.05 on a throttled mobile Lighthouse run, with sub-100ms TTFB at the edge for any route that does not require origin compute. We hit this by deploying on Vercel or Cloudflare edge, using React Server Components and Suspense streaming to ship HTML before client JS hydrates, aggressively lazy-loading non-critical components, preloading critical images and fonts with priority hints, and routing static assets through Cloudflare R2 or Vercel's edge cache. Real User Monitoring through Vercel Analytics, Cloudflare Web Analytics, or Sentry Performance keeps us honest on actual field data, not just lab scores.

Every SF B2B SaaS web app will get asked for SOC 2 Type II within the first enterprise customer cycle, and most procurement teams will not sign past a Series A logo without it. We do not write the SOC 2 report (that is the auditor's job, usually Prescient Assurance, A-LIGN, Schellman, or Insight Assurance for SF startups), but we build the controls. Audit logging on every privileged action, encryption at rest and in transit by default, access control through SSO with Clerk or WorkOS, secrets management through Doppler or AWS Secrets Manager, vulnerability scanning in CI through Snyk or GitHub Advanced Security, dependency pinning, change management through GitHub PR reviews, and incident response runbooks. We coordinate with compliance platforms like Vanta, Drata, or Secureframe so the auditor sees the evidence trail without your engineering team rebuilding it twice.

Yes. SF developer tools companies (GitHub, GitLab, Cloudflare, Vercel, Netlify, Stripe, Twilio, MongoDB, Snowflake) have set the bar on what good API documentation looks like, and we ship to that bar. We build MDX-powered docs on Next.js or Astro with versioned routes, full-text search through Algolia DocSearch or Inkeep, AI chat layered in through Mendable or a custom RAG pipeline on the docs corpus, API reference generated from OpenAPI specs through Mintlify or Redocly, code blocks with syntax highlighting through Shiki and copy buttons that actually work, and tabs for switching between language SDKs the way Stripe's docs do. We have shipped docs sites that became the primary developer acquisition channel for SF API companies. Docs is not a marketing afterthought in SF. It is the product.

Most custom web application development qualifies for the US federal Research and Development tax credit under IRC Section 41, and California offers a parallel state R&D credit through FTB Form 3523. Qualified activities generally include novel architecture work, real-time and streaming systems engineering, custom algorithm work, performance engineering at the edge, novel data pipeline work, and systematic experimentation, but not routine marketing site work or off-the-shelf SaaS integration. We deliver contemporaneous documentation, time-tracked engineering logs, technical narratives, and failed-hypothesis records aligned with the Section 174 capitalization rules that took effect in 2022 and remain in force. Your CPA or specialty R&D firm files Form 6765 federally and California FTB 3523, and our records support the claim. Final eligibility sits with your tax advisor and the IRS, not with us.