TypeScript
Strict mode in 160+ package manifests: React apps, Astro sites, NestJS and Express APIs, Cloudflare Workers and shared contract packages all compile from one type system.
Tech stack
The technologies we build with
Verteco is an engineering-led team. This page lists every language, framework, database, cloud service and integration standard we run in production today, from a certified Peppol Access Point on Java Spring Boot to Next.js SaaS platforms, Astro marketing sites on Cloudflare and Python data pipelines. Nothing here is aspirational: each item is backed by a live repository.
- 120+
- code repositories in the portfolio
- 73
- CI pipelines (GitHub Actions)
- 50
- Cloudflare Workers in production
- 26
- languages our products ship in
Languages & frontend
TypeScript is our first language. Every web product, edge worker and most tooling is typed end to end.
React 18 / 19
The UI layer of 70+ codebases, from a browser-based geodetic CAD editor (GeoSoft) to multi-tenant SaaS dashboards. Vite 7/8 for SPAs, TanStack Query, Zustand and react-hook-form with Zod validation.
Next.js 14–16
App Router, Server Components and Server Actions for 25 products including our Peppol e-invoicing portal, Google CSS comparison platform and white-label ordering SaaS. Deployed on Node, Docker or Cloudflare via OpenNext.
Astro 5–7
Static, content-driven sites in 48 repositories: this 26-language site (743 pages in about 6 seconds), 20 WordPress migrations with zero-diff parity checks, multi-domain marketing sites served from one build.
Tailwind CSS 3 / 4
Design tokens in CSS, utilities in markup, shadcn/ui and Radix primitives where accessible components matter. Material UI on data-heavy back-office systems.
Svelte 5, Phaser 3, Three.js
Used where they fit: a Svelte pivot-table SPA over 55k election rows, a WebGL action-RPG with deterministic 30 Hz simulation and co-op multiplayer, Three.js historical city reconstructions.
Backend & APIs
Three backend families, chosen per domain: Node/TypeScript for product APIs, Java Spring Boot for regulated transaction systems, Python for data and integration work.
Node.js 20–22 with NestJS 11 & Express 5
Layered controller → service → repository APIs with dependency injection, CASL authorization, BullMQ job queues and socket.io real-time gateways. Hono for lightweight multi-tenant APIs.
Java 21 & Spring Boot 4
Our certified Peppol Access Point: Spring Data JPA, Spring Security with JWT, Flyway (80+ migrations), Apache PDFBox and 170 Testcontainers-backed tests. Live with legally binding tax documents since 2026.
Python 3.12: Django 5, FastAPI, Flask
Django REST Framework with schema-per-tenant multi-tenancy (django-tenants) for clinic and geodesy SaaS, async FastAPI services with SQLAlchemy 2 for dispatch and fiscal APIs, Celery workers for scheduled jobs.
Cloudflare Workers (TypeScript)
50 Workers in production: edge routing and redirects, contact and waitlist APIs, a serverless mail server on D1 + KV with AI draft replies, per-market host routing for 8 country domains from one build.
REST, OpenAPI & webhooks
OpenAPI 3 specs with drift checks in CI, HMAC-SHA256 signed webhooks with idempotency tables, public sandboxes for partner developers, NDJSON streaming for long-running AI jobs.
Databases & data
PostgreSQL is the default. Everything else is a deliberate exception with a reason written in the repository.
PostgreSQL 16–18 & PostGIS
Managed clusters on DigitalOcean; PostGIS 3.6 for cadastral geometry and ride zones, pg_trgm and unaccent for search, pgvector for embeddings, Row-Level Security and schema-per-tenant isolation for multi-tenant SaaS.
Redis / Valkey
Queues (BullMQ, Celery), caches, GEO indexes for live driver positions with atomic Lua moves, rate limiting and JWT denylists.
MariaDB, MongoDB, SQLite
MariaDB 10.11 with Flyway for a 150-table financial-advisory back office, MongoDB 6/7 for a multi-brand invoicing SaaS load-tested with k6, SQLite on Cloudflare D1 at the edge.
ORMs & migrations
Prisma, Drizzle, Sequelize and Typegoose on Node; SQLAlchemy 2 async and the Django ORM on Python; Spring Data JPA on Java. Migrations run as pre-deploy jobs (Flyway, Alembic, umzug) and are tested for idempotency.
Data pipelines & scraping
pandas, Playwright and Selenium pipelines that processed 3.6 million Slovak company records, stream a 666 MB Shoptet feed in under 100 MB of RAM, and publish daily Peppol network statistics for 121 countries.
Object storage
S3-compatible storage everywhere: DigitalOcean Spaces, MinIO, Cloudflare R2 and KV, with presigned uploads and WORM archives for tax documents.
Cloud, DevOps & security
Two hosting patterns cover 90 % of what we ship: static-plus-edge on Cloudflare, containers on DigitalOcean in Frankfurt.
Cloudflare
Workers, Static Assets and Pages, KV, D1, R2, Email Routing and Sending, Turnstile, DNS and WAF. Immutable caching, HSTS and hashed-inline-script CSP are part of the shared Worker template.
DigitalOcean
App Platform in FRA1 with 20 app specs (multi-container topologies, pre-deploy migration jobs, private networking), Droplets with Docker Compose, Managed PostgreSQL 17, Spaces and Container Registry.
Docker & delivery
Multi-stage images (node, python, eclipse-temurin), docker-compose environments for dev/staging/prod, nginx and Caddy reverse proxies, Ansible and PM2 zero-downtime rollouts with drain, health checks and scripted rollback.
CI/CD: GitHub Actions & Woodpecker
73 workflows: typecheck, lint, tests, build, OpenAPI drift and i18n completeness checks, gitleaks and pip-audit, image builds to GHCR, SSH deploys with smoke tests, weekly data-refresh crons.
Testing
Vitest, Jest, pytest, JUnit 5 with Testcontainers, Playwright end-to-end (with axe-core accessibility checks), k6 load tests. Recent suites: 1,200 backend tests on a clinic platform, 720 on a fiscal cash register, 400 spec files on an ordering SaaS.
Observability & security
Sentry in every product (Java, Python, Node, React, mobile), OpenReplay session replay, health endpoints and public status pages. JWT and 2FA (TOTP, SMS), argon2 or scrypt hashing, encrypted PII, audit logs, written security audits for regulated systems.
Mobile & real-time
One TypeScript codebase from browser to app store, and real-time systems that survive bad networks.
Expo / React Native
Native iOS and Android rider and driver apps with MapLibre maps and background GPS batching, an invoicing app in 8 locales with Keychain-backed tokens, shared data layers with the web apps.
Capacitor & PWA
App-store shells around existing React apps (patient and clinic apps, bar ordering), installable PWAs with service workers, push notifications via Firebase Cloud Messaging.
WebSockets, SSE & queues
socket.io dispatch with server-authoritative state machines and full re-sync on reconnect, Server-Sent Events for print state and notifications, BullMQ timers and Celery beat for scheduled work.
Event sourcing & money
An event-sourced point-of-sale with frozen event schemas and idempotent client operations; double-entry ledgers per driver and currency; integer minor units everywhere money is touched.
E-invoicing, fintech & compliance
Regulated document flows are a specialty: we operate our own Peppol Access Point and build to Slovak and EU fiscal standards.
Peppol AS4 / eDelivery
Own certified Access Point (PA SK EFSK000031, seat PSK001128) on phoss-ap with a multi-issue MLS patch; 19 of 19 OpenPeppol conformance suites passed; SMP registration, PKI G3, TDD reporting to the Slovak Financial Administration.
EN 16931, Peppol BIS 3.0, UBL 2.1, ISDOC
Validation with the same Schematron rules the network applies, UBL generation in three products, ISDOC and XRechnung / ZUGFeRD for Czech and German markets, Swiss QR-bill and PAY by square payment QR codes.
eKasa (SORP) & eZdravie
Software cash register built to the Financial Administration SOAP v2 and CHDÚ specification with XML signatures (certification filed 2026), and NCZI eZdravie modules (eRecept, eVyšetrenie) in a clinic information system.
Stripe & banking APIs
Stripe Checkout, Billing Portal, subscriptions and Connect (separate charges and transfers, manual capture) in 12+ repositories with signed webhooks and idempotency tables; Fio bank API for automated SEPA payouts; ECB exchange rates.
E-commerce & marketing platforms
We connect shops, feeds and ad platforms because we run them ourselves: 1,100+ merchants use our Google CSS.
Shop platforms
Shoptet (XML feeds, add-ons, order exports), WooCommerce, PrestaShop, Magento 2, OpenCart and Shopify (webhooks and a Remix + Polaris app), plus headless Next.js storefronts.
Google Shopping & Ads
Google CSS API, Content API v2.1 and Merchant Center account hierarchies syncing 1,100+ merchants, Google Ads API automation, Heureka and Zboží feeds.
Marketing automation
Brevo transactional email, drip flows and inbound webhooks, Firebase push, Twilio Voice, DeepL translation pipelines, GA4 and Meta Pixel gated behind consent, IndexNow and Ahrefs APIs for SEO operations.
WordPress migration tooling
Extractors for .wpress and WPML databases, Elementor block parity checks, redirect map generation and 410 mapping of spam URLs. 20 sites moved to static Astro with 100 % text parity.
AI in production
Grounded, budgeted and logged. AI features ship with retrieval over our own data, spend caps and human approval where money moves.
Anthropic Claude
Structured outputs and prompt caching for marketing-campaign generation, grounded support assistants with BM25 retrieval over site content, AI draft replies in a serverless helpdesk, i18n pipelines translating products into 23 to 24 locales with CI completeness checks.
OpenAI, ElevenLabs & Twilio
GPT-4o dialog for a voice phone assistant taking pharmacy orders in Slovak and Czech, Whisper transcription, gpt-image-1 for product imagery, ElevenLabs streaming text-to-speech.
Computer vision & biometrics
ONNX face detection and matching (YuNet, SFace) with passive liveness for B2B identity verification, consent-first design where embeddings are not persisted by default.
AI guardrails
Validation-retry loops with exception taxonomies, per-IP and monthly budget caps, every conversation logged and reviewable, features disabled automatically when no API key is present.
How we choose technology
Boring where it counts
Money, tax documents and medical records run on PostgreSQL, Spring Boot, Django and TypeScript with strict types, migrations and tests. We adopt new tools only when they earn a measurable productivity win.
Typed contracts end to end
Zod schemas shared between API, web and mobile, OpenAPI specs checked for drift in CI, integer cents instead of floats. The compiler catches what code review would miss.
Edge first for content, cloud for state
Marketing sites are static Astro builds served by Cloudflare Workers in 300+ cities. Applications with state run on DigitalOcean App Platform in Frankfurt with managed PostgreSQL, so EU data stays in the EU.
Tests and gates before deploys
Every push runs typecheck, lint, unit and integration tests; releases apply Flyway or Alembic migrations in a pre-deploy job and roll back automatically on failed health checks.
Where you can see it running
Our own products and public client work use exactly this stack. Pick any of them apart.
- Verteco Peppol ↗ Java 21 · Spring Boot 4 · Next.js 15 · PostgreSQL 17 Certified Peppol Access Point and e-invoicing portal in 6 languages, live with tax documents.
- Vertify ↗ NestJS 11 · Next.js 16 · ONNX · MinIO B2B face verification with passive liveness, contracts-first monorepo in 24 locales.
- Medisora ↗ Django 5.2 · django-tenants · React 19 · Valkey Cloud clinic information system with append-only medical records and eZdravie integration.
- geosoft.sk React 19 · GeoDjango · PostGIS 3.6 Browser-based CAD workstation for land surveyors, schema-per-tenant SaaS with 250+ tests.
- ePoštári.sk Astro 6 · Cloudflare Workers · KV Comparison portal of certified e-invoice providers with a 2-minute Peppol latency monitor.
- aksamec.sk Astro 5 · Node 22 · Stripe · Claude Law-firm site with 290+ articles, embedded checkout and a grounded AI assistant, migrated 1:1 from WordPress.
Services built on this stack
Questions engineers and CTOs ask us
- Which technologies does Verteco use for custom software development?
- TypeScript across the board (React, Next.js, Astro, NestJS, Cloudflare Workers), Java 21 with Spring Boot for regulated transaction systems such as our Peppol Access Point, and Python 3.12 (Django, FastAPI, Celery) for data-heavy products and pipelines. PostgreSQL is the default database, Redis or Valkey for queues and caches, Docker for packaging, Cloudflare and DigitalOcean for hosting.
- Do you build with React or Vue?
- React. We have 70+ React codebases (React 18 and 19 with Next.js 14 to 16 or Vite), plus Astro for content sites and Svelte where a small interactive tool needs it. We can take over Vue or Angular code, but our new builds are React or Astro.
- Can you take over and modernise an existing codebase?
- Yes. Recent examples include migrating a Next.js 14 / Express 4 / MUI 5 system to Next.js 16 / Express 5 / MUI 7 with a 232-case regression suite, moving 20 WordPress sites to static Astro with zero text-diff parity checks, and replacing a legacy PHP analytics app with a Svelte SPA. We start with an audit, tests around the money paths, then incremental upgrades.
- Where do you host, and does data stay in the EU?
- Applications run on DigitalOcean App Platform and Droplets in Frankfurt with managed PostgreSQL 17, Valkey and Spaces object storage. Static sites and edge logic run on Cloudflare Workers with EU-resident data stores (KV, D1) where needed. We also deploy to client-owned VPS or Kubernetes when required.
- Do you build mobile apps?
- Yes, from a shared TypeScript codebase: Expo / React Native for native iOS and Android apps (ride-hailing rider and driver apps, an invoicing app in 8 locales), Capacitor for app-store shells around existing React web apps, and installable PWAs where a store presence is not needed.
- How do you handle security, GDPR and compliance?
- JWT or session auth with 2FA, HMAC-signed webhooks, per-IP rate limits, CSP and HSTS headers, encrypted PII columns, audit logs with append-only medical or tax records, gitleaks and dependency audits in CI, and written security audits for regulated systems. Our Peppol Access Point passed all 19 OpenPeppol conformance suites and handles legally binding tax documents in production.
Need this stack on your project?
Tell us what you are building. You get a free architecture review and a fixed quote within days, not weeks.
