Enterprise Software Development Company in Victoria

We quote fixed fee against a signed statement of work. A discovery and alpha phase, producing a service blueprint, a data inventory, the privacy impact assessment and security assessment scopes, and a working prototype tested with real users, typically runs CAD 60,000 to 150,000 over eight to fourteen weeks. A production system such as a licensing, case management or grants administration service, including identity integration, accessibility conformance, reporting and a supported handover, generally runs CAD 300,000 to 900,000. A multi-year modernization replacing a legacy platform across several programs, with data migration, integration to systems that cannot be changed, and phased cutover, runs CAD 900,000 to 3,000,000 and up and should be structured in funded phases rather than as one contract. Two things move an enterprise number here more than day rates do. The first is how much of the budget goes to work that is not development at all: privacy and security assessment cycles, accessibility conformance, procurement documentation and the handover package a public body needs in order to change vendors later. On a government service that is routinely a quarter of the effort, and a proposal that does not show it is understating the project rather than being competitive. The second is what happens after launch, because a service that stays in production for fifteen years costs more to keep than to build, and support, patching and successor-team documentation belong in the plan from the start rather than in a renewal negotiation.

Not by statute, and this trips up a lot of people. Section 30.1 of the Freedom of Information and Protection of Privacy Act, RSBC 1996 c. 165, formerly required that personal information in the custody or control of a BC public body be stored and accessed only in Canada. That section has been repealed and no longer appears in the current Act. What replaced it is a duty-based approach: section 36.2 covers privacy management programs, section 30.5 covers notification of unauthorized disclosure, and section 69 covers privacy impact assessments and information-sharing agreements. In practice, residency has moved from statute into procurement and contract, and for most Victoria public-sector buyers the answer is still Canada, because their contract templates, their privacy impact assessment findings and their own risk appetite say so. The practical guidance we give is straightforward. Do not assume the repeal means you can host anywhere, and do not assume it means nothing changed. Read your own contract terms, get the region commitment in writing from any SaaS vendor rather than trusting a marketing page, and let the privacy impact assessment record the decision so it is defensible later.

A privacy impact assessment is required under FIPPA section 69 and is the written analysis of what personal information a system collects, why it is authorized, how it flows, who can see it, how long it is kept and what the risks are. A security threat and risk assessment is the parallel security analysis: threat model, control assessment, residual risk and the sign-off of whoever accepts that risk. Both are living documents that should shape design, and both have real institutional lead times. In a BC ministry the review queue and the approvals chain can take weeks, and neither can be compressed by asking nicely near the end of a project. We scope both during discovery, write the first drafts alongside the architecture rather than after it, and re-open them whenever a design decision changes a data flow. The failure mode we see repeatedly is a team that builds for four months, submits a PIA a fortnight before the planned launch, and then discovers that a third-party analytics tool or an offshore support arrangement in the design is not acceptable. Fixing that at the end costs multiples of what designing around it costs at the start.

Through the province's shared single sign-on service rather than by building a bespoke identity stack, which is both cheaper and easier to get approved. The pattern is a standard OpenID Connect integration where your service is a client and the shared service brokers to the appropriate identity provider. BC Services Card authentication gives the highest assurance and is appropriate where the transaction genuinely warrants verified identity, such as accessing personal records or making a legally significant declaration. BCeID covers business and basic accounts for organizations and individuals who do not need that level of verification. IDIR covers public servants and internal staff access. The design work that actually matters is choosing the right assurance level per transaction rather than applying the highest one everywhere, because over-assurance is a real accessibility and adoption barrier for people who cannot easily complete card verification. We map each user journey to a required assurance level during discovery, design a fallback path for people who cannot use the highest tier, and keep authorization decisions in your service rather than assuming the identity provider will carry role information it was never meant to carry.

AIDA is not law. The Artificial Intelligence and Data Act was part of Bill C-27, the Digital Charter Implementation Act, 2022, which was introduced on June 16, 2022, passed second reading on April 24, 2023, and was still at committee in the House of Commons when the first session of the 44th Parliament ended on January 6, 2025. Bills die when a session ends, so C-27, and AIDA with it, never became law. Anyone telling you that Canada has a binding AI statute is wrong. What actually governs an AI feature in a BC public sector system is the law that already exists plus institutional policy. FIPPA governs the personal information the model touches, including collection authority, use limitation, disclosure and the privacy impact assessment obligation, and automated decision-making that affects individuals raises fairness and administrative law duties independent of any AI-specific statute. The federal Treasury Board's Directive on Automated Decision-Making binds federal institutions but not provincial ones. There is also a federal voluntary code of conduct for advanced generative AI systems, published in September 2023, which is exactly what its name says. We build to the existing statutes, document the model's role, and keep a human decision-maker accountable for any decision affecting a person's rights or benefits.

By strangling it rather than replacing it. Victoria has a large stock of systems built in Oracle Forms, PowerBuilder, classic ASP and older Java frameworks that still run correctly and encode two decades of policy in code nobody documented. A total rewrite of one of these is the highest-risk project a public body can undertake, and the failure rate reflects that. The approach we use puts a routing layer in front of the legacy system, then moves one bounded capability at a time behind that layer onto the new stack, with the legacy system remaining authoritative until each capability is proven in production. Data is synchronized in one direction only at any given moment, with a written and tested decision about which system owns each entity during each phase. Business rules are extracted by reading the code and then validated against production behaviour with real historical cases, because the documentation and the code will disagree and the code is what has been happening. Every phase ends with a system that works and could be left in place indefinitely if funding paused, which is the property that makes multi-year modernization survivable across budget cycles and changes in government.