The standards of the trade, on every screen.
Accessibility, security, automated tests: your software follows the rules professional teams follow, before every delivery.
What each feature must pass
Tested
Each feature arrives with its automated tests. Each change runs all the project’s tests again before it is accepted.
Accessible
Built to level AA of WCAG 2.2, the W3C accessibility standard. Every rule a tool can verify is checked on each new screen, and a serious barrier blocks the feature.
Secure and up to date
Built against the OWASP Top 10, on current versions of its technologies. Each change is checked for leaked secrets and vulnerable dependencies, and each image for known flaws before it goes online.
Ready to take over
The code is laid out by business area, its architecture decisions are written down, and it is delivered with its tests and its documentation.
Ready for the Cyber Resilience Act
From 11 December 2027, mobile and desktop applications distributed in the European Union must carry the CE marking of the Cyber Resilience Act. All our applications are built to its requirements, and for those that must carry it, we supply the whole file.
Secure by design
Security is part of every feature from the first line, not added at the end.
Known components
The inventory of the components your software uses, with their licences.
Five years of security updates
Maintenance delivers them through the five years of support the regulation sets, whether the software is hosted by us or by you.
The standards we follow, by family
Accessibility
WCAG 2.2 AA (W3C) on every screen, checked with axe-core; EN 301 549, the European accessibility standard; the RGAA; the Android and Apple accessibility guidelines on mobile.
Security
The OWASP Top 10:2025 and the OWASP ASVS 5.0; the OWASP API Security Top 10 for every API and the OWASP MASVS for mobile apps; the CWE Top 25; NIST SP 800-63B for passwords and sign-in; HTTP security headers; Electron’s security checklist on the desktop; PCI DSS v4.0.1 when your customers pay by card.
Every change, every release
A secret scan, a dependency audit and static analysis on every change; every image scanned for known flaws before it goes online; the CIS Docker Benchmark; TLS 1.2 at least.
Supply chain and compliance
A software bill of materials in CycloneDX or SPDX; build provenance to SLSA; dependency licences; the GDPR, the CNIL’s cookie rules, the Cyber Resilience Act and the European Accessibility Act.
Code and handover
Web applications as a modular monolith cut into vertical slices; quality by ISO/IEC 25010; Semantic Versioning, Conventional Commits and recorded architecture decisions; OpenAPI 3.1; the Twelve-Factor App; OpenTelemetry.
Web, mobile and desktop quality
Valid HTML (W3C); the Core Web Vitals targets: LCP under 2.5 s, CLS under 0.1, INP under 200 ms; the Google Play and App Store review guidelines, and Apple’s Human Interface Guidelines.
This site, measured
Cadenforge is built with the same method and the same standards.
- 100Performance
- 100Accessibility
- 100Best practices
- 100SEO
Measured with Lighthouse 13.5.0 on 14 pages of this site, on mobile and on desktop, median of three runs, on October 26, 2026.
If you have a technical team
Your team or your IT provider receives a project built with widespread technologies (Next.js, NestJS, React Native, Electron, PostgreSQL), laid out by business area, with its tests and its documentation.
- Next.js
- NestJS
- React Native
- Electron
- PostgreSQL