Our products

Products we build and run

Our own software, in production and built to the same standard as client work. The case studies set out the engineering decisions behind it.

Clacks

Live

Email Bridge for Legacy Accounts

"It's not about the message. It's about sending it."
— GNU Terry Pratchett

A Symfony-based application that bridges POP3 and IMAP email accounts to Gmail. Poll legacy email servers and securely forward messages straight through to your Gmail inbox—no storage, no delays, just seamless delivery with full filter and rule compatibility.

Key Features

POP3 & IMAP Support: Pure PHP socket-based polling with no ext-imap dependency
Gmail API Integration: Uses Gmail messages.import for native filter compatibility
Secure Pass-Through: Message content passes straight through to Gmail and is never stored
Multi-Account Management: Connect multiple legacy accounts to one or more Gmail destinations
AdminLTE Dashboard: Modern web UI for account management and monitoring

Tech Stack

Symfony 7 PHP 8.2+ Gmail API libsodium AdminLTE 3 Webpack Encore MariaDB

Case study

Problem: Bring mail from older POP3 and IMAP accounts into Gmail so that Gmail’s own filters, labels and spam classification apply to it — as if it had arrived there directly.
Our role: We designed, built and operate it: the mail clients, the Gmail integration, the credential encryption, the scheduling and the paid plans.
Constraints: Every Gmail scope this needs is one Google classes as restricted, which brings a security review and a duty to justify each scope requested. And a service that touches people’s mail should keep as little of it as possible.
Decisions: Import rather than forward: messages go in through Gmail’s messages.import, so filters and spam classification run as normal. Request five narrow scopes, and deliberately not gmail.readonly — the application never reads an existing Gmail message. Keep no message content: mail is fetched and imported in one pass, and only metadata — sender, subject, date and the identifiers that prevent duplicate imports — is retained, then purged on a retention schedule. Write the POP3 and IMAP clients over plain sockets rather than depend on PHP’s IMAP extension. Encrypt the secrets that must be stored, such as mailbox passwords and Gmail refresh tokens, under a key-encryption key.
Trade-off: Importing needs restricted scopes, and restricted scopes bring Google’s review. Forwarding would have avoided both — and broken the filters and labels that were the point.
Result: A live service with free and paid plans, bridging POP3 and IMAP accounts into one or more Gmail inboxes.
Evidence: Each restricted scope is documented against the exact API calls that use it, and the codebase has been checked against Google’s CASA Tier 2 criteria ahead of formal assessment.

Markest

Live

Multi-Document Markdown Pastebin

"The best documentation is the one people actually read."
— Markest

A full-featured markdown pastebin for creating pastes with multiple linked documents, sidebar navigation, and a beautiful reading experience. Supports subscription plans, collaborators, client-side encryption, embeddable viewers, and a RESTful API—all with 10-language internationalisation.

Key Features

Multi-Document Pastes: Up to 50 markdown files per paste with internal linking, sidebar navigation, and ZIP export
Subscription Plans: Free and paid tiers via Stripe with configurable limits on pastes, storage, and features
Security & Privacy: Client-side encryption, password protection, burn-after-reading, and TOTP 2FA
RESTful API: Bearer token authentication with API keys, permissions, and full CRUD operations
Collaboration & Sharing: Invite collaborators, embed pastes, explore public directory, and custom themes

Tech Stack

Symfony 7.4 PHP 8.3+ CommonMark 2.8 Stripe XChaCha20-Poly1305 MariaDB

Case study

Problem: A pastebin for multi-document Markdown and HTML. Supporting HTML means storing and serving markup written by anyone, on the same site as people’s accounts.
Our role: We designed, built and operate it, including publishing, access control, collaboration and the paid plans.
Constraints: HTML pastes are meant to run as written, scripts included, so stripping them down would break the feature. And visibility rules — public, unlisted, password-protected, signed links, collaborators — have to hold on every route that serves a paste.
Decisions: Isolate rather than sanitise: stored HTML never renders on the application’s origin. It is served only from a dedicated route under a Content-Security-Policy sandbox without allow-same-origin, so it runs on an opaque origin with no access to the site’s cookies or sessions. And resolve access for every paste-serving surface through one guard, so no controller carries its own copy of the visibility rules.
Trade-off: Sandboxed HTML cannot reach the viewer’s page or the site’s storage, so embeds that expect a normal origin will not work inside a paste. That limit is the point: it is what keeps an arbitrary script away from people’s accounts.
Result: A live multi-document pastebin with free and paid plans, a REST API, collaborators and ten interface languages.
Evidence: Both rules are recorded as standing architectural decisions. The single access guard was adopted after a security audit found visibility checks had drifted between routes.

Boot

Live

ADHD-Friendly Productivity Operating System

"Test the skeleton, build the body, layer the mind."
— Boot

An ADHD-friendly productivity system built around the BOS (BIEEII Operating System) state machine. Boot models your day as structured phases—activation, execution, maintenance, and shutdown—using 90-minute focus blocks, energy-aware task scoring, and calming rituals to keep you on track without overwhelm.

Key Features

BOS State Machine: Six deterministic states guide your day from boot-up through deep work to night shutdown, with layered authority control
90-Minute Focus Blocks: Structured time containers with ramp-up, core focus, and cool-down phases—plus switch urge logging and pause/resume
Smart Forecast & RAB Scoring: Deterministic task ranking across priority, due-date urgency, energy match, mood bias, project relevance, and freshness
NSIL Night Shutdown: Ritual-based shutdown sequence: ship log, constraint capture, tomorrow seed, and input lock to close your day cleanly
Sandboxed Reflection Window: Time-boxed reflection periods between blocks for reviewing progress, journaling, and planning without breaking flow

Tech Stack

Symfony 7 PHP 8.3+ Stripe XChaCha20-Poly1305 Google OAuth Webpack Encore MariaDB

Need something like this built?

If it’s something we could build, automate or fix, tell us about it.

Start a project

Or: What we do How we work