Custom software
Web applications in PHP 8 and Node.js that follow your process — not that of a standard product.
About us
We give companies back control over their data.
NordTrust is a software company with offices in Hamburg and Hanover. We build applications that follow a company's actual process — not the process of an off-the-shelf product everyone involved has to bend around.
Behind that is a small, permanent development team, extended by a network of experienced specialists for infrastructure, data protection law and interfaces to legacy systems. Lean structures instead of corporate overhead: you talk to the people writing the code, not to a ticket number.
What we do not sell is data. Yours sits on servers in Germany and is not passed on — not to ad networks, and not to services whose business is your data.
- Trust
- We tell you up front what something costs and how long it takes — and we speak up when that changes.
- Security
- Threat model before the first line of code, not hardening after the first incident.
- Transparency
- You get the code, the data model and the logs. Even if you continue elsewhere.
- Craft
- Proven technology over passing trends: clean code, tests, documentation — and systems someone will still understand in ten years.
Services
Eight fields, one team
We take a project on completely or not at all — analysis, build, security and operations from one source. Pricing on request, always fixed per stage.
CRM systems
Customer history, leads and appointments in one place, with rights per role.
Customer portals
Your customers see their own status — no phone call, no spreadsheet attachment.
Employee portals
Rosters, time accounts, leave and payroll documents — on the phone as well.
Maintenance & development
We take over existing PHP and Node.js applications, secure them, update them and carry them forward — no rebuild from scratch.
Automation
Recurring manual work becomes a traceable nightly run.
Hosting & operations
Linux servers with nginx and MariaDB in German data centres — set up, monitored and backed up by us.
Interfaces
REST APIs, webhooks and data imports: your existing systems stay — we connect them instead of replacing them.
What we build with
- PHP 8
- Node.js
- TypeScript
- MySQL / MariaDB
- Linux
- nginx
- REST APIs
- Git
Security
Data protection is not a feature. It is the foundation.
Eight points that come at the beginning of a project here, not at the end as a retrofit. Every one of them is named in the quote and verifiable in operation.
Servers in GermanyOperated exclusively in German data centres in the north. No provider based outside the EU in the data path.
GDPR complianceProcessing agreement under Art. 28, records of processing, deletion concept and data subject rights are part of the delivery.
Privacy by designWe collect what the function needs — not what is technically possible. Personal data is kept separate.
Security by designThreat model before the first line of code. Dependencies are pinned, reviewed and documented.
Encrypted communicationTLS 1.3 outbound, encrypted connections and backups inbound. Access by key only.
Access controlsEvery access is bound to one person and one device. Shared accounts do not exist.
Auditable processesWho changed what and when is on record — in the system, not in a developer's memory.
Roles and permissionsVisibility follows the task. What a role does not need, it does not see — not in reports either.
Insured € 250,000
You are not left alone with the damage.
With this way of building, a data breach is close to impossible: separated security zones, encrypted channels, every access bound to one person and one device.
But “close to” is no foundation for a company to park its risk on. That is why our work is backed by cover from a well-known German insurer — € 250,000 of cover, explicitly including damage that occurs at your customers. Not just claims against us.
What applies in an individual case is set out in the contract and the policy, both of which you see beforehand. That we stand behind our work applies in every case.
- Cover
- € 250,000
- Insurer
- Well-known German insurance company. Confirmation on request.
- Included
- Third-party damage — damage occurring not at your company but at your customers.
- Also
- Costs of notifying the supervisory authority, informing data subjects and restoring systems.
- Not covered
- Systems not developed or operated by us, and credentials shared on your side.
- Evidence
- Confirmation of cover is attached to every quote — before you sign, not after.
This overview is a summary, not an insurance certificate. The project contract and the policy are binding; you receive both in full before entering into a contract.
From practice
One retail network, one platform.
portal · roster · calendar week 37Sample data
| Employee | Location | Mon | Tue | Wed | Thu | Fri | Sat | Target | Actual |
|---|---|---|---|---|---|---|---|---|---|
| A. Meinke | Location 04 | 09–18 | 09–18 | off | 11–20 | 11–20 | 10–16 | 38,5 | 39,0 |
| B. Kroll | Location 04 | 11–20 | off | 09–18 | 09–18 | 09–16 | off | 32,0 | 31,5 |
| C. Sander | Location 11 | Leave | Leave | Leave | Leave | Leave | off | 38,5 | 38,5 |
| D. Wiechmann | Location 11 | 09–18 | 09–18 | 11–20 | off | 11–20 | 10–16 | 38,5 | 40,25 |
| E. Tholen | Field sales | 08–17 | 08–17 | 08–17 | 08–17 | 08–15 | off | 40,0 | 39,75 |
Anonymised illustration with sample data · no real people, locations or amounts
From practice
For a telecommunications retailer we run a company portal that brings together rostering, time tracking, commission accounting and field sales management across 16 locations — grown in daily operation, without a single day of downtime.
Personal data never leaves the system: personnel file documents, photos and settlement lists are locked down at role level and technically prevented from appearing in reports or exports.
We build software we would have to use ourselves every day. That is the hardest quality benchmark I know.CTO · NordTrust
- 16
- locations in production, one shared data set
- 25
- mobile applications from one shared toolkit
- 82k
- lines of production code, statically checked at every step
- 0
- data transfers to third parties, since day one
How a project runs
Five stages, no surprises.
Every stage ends with something you can hold: a document, a running version, a test report.
Analysis
We look at how your process actually runs — not how it is documented.
Design
Data model, roles, permissions and threat model are agreed in writing.
Development
A running version to click through every two weeks, not a screenshot.
Test & security
Static analysis, load test, permission review and a report your data protection officer can read.
Operations
Maintenance, backups and further development — with a named contact instead of a ticket number.
Team
You know who works on your software.
A small, permanent team: offices in Hamburg and Hanover, technical lead in Hanover, development in Argentina — extended by experienced specialists when a project calls for it. Familiar faces, not rotating subcontractors.
Andreas Asangarani
Managing Director
Responsible for quotes, contracts and commitments. First point of contact for everything that is not technical.
Technical lead
CTO · Hanover
Responsible for architecture, security and operations. Writes code — and reads every line that ships.
Development team
Development · Argentina
A permanent team for PHP, Node.js and TypeScript. Shared working hours with Hamburg for coordination — and the time difference works in your favour: what is discussed here in the afternoon is built and reviewed by the next morning.
Built to hold.
Let's build software you can trust.
Write two sentences about what you have in mind. You will get an honest assessment of whether and how we can help — even when the answer is that you do not need us for it.