Engineering at Sigma

Every case study on this site is an app that is actually live on the App Store and Google Play under the client's own account, with its store rating and delivery time listed.

The same case studies are published as JSON through a public API, so any tool can read the list — not just a browser.

We only count a project as deployed once it is on the stores or in production with real customers using it. Everything shown here has passed store review or runs on real servers.

Infrastructure is created inside the client's own AWS and Cloudflare accounts. You hold the root credentials and the bill; we work through a delegated role you can revoke at any time.

The AWS services we actually run production on — each carries a technical score on the Technology page that reflects how many projects we have delivered with it.

Every service runs in a Docker container, so a developer's environment matches production. The infrastructure is described in Terraform, so it can be rebuilt in a new region in hours, not weeks.

Every case study published here ships on both iOS and Android, and its store ratings are shown as they are — the numbers below come straight from the case studies themselves.

Apps are published under the client's own App Store Connect and Google Play Console accounts, never ours. The listing, the reviews and the revenue are yours from day one.

Dozens of releases have been through App Store and Google Play review. Before every public release: TestFlight and a closed testing track on Play, with Crashlytics on every build.

sigmatech.com.kw is itself a Laravel application with a Filament admin panel. It exposes a versioned public API with an OpenAPI 3 spec, an MCP server for AI agents, and OAuth 2.1 — open them yourself.

The full OpenAPI specification and the MCP server card are available to any client or AI agent.

Every API ships with OpenAPI documentation, versioning, JWT/OAuth authentication and rate limiting. Heavy work goes through queues (SQS, Redis, BullMQ) so one slow job never blocks a request.

PostgreSQL for complex relational systems (JSONB, full-text search, spatial data); MySQL/MariaDB under most Laravel platforms; MongoDB for documents whose structure keeps changing; DynamoDB for write-heavy serverless data such as sessions and events.

Every schema change is a code-versioned migration reviewed like any other code. Indexes are designed together with the queries, not after the slowdown.

Automated daily backups with point-in-time recovery on RDS and Aurora, and read replicas to spread load. Restores are rehearsed, not assumed.

The integrations below are not a wish list — each one is tied to the case studies we actually used it in, taken from the project data itself.

KNET, MyFatoorah and Tap for Kuwait and Gulf payments, Google Maps Platform for tracking, WhatsApp Business API and local SMS providers for messaging.

Payment callbacks are verified server-side and reconciled against the gateway. Every webhook is idempotent and retried with a trace, so a dropped callback never becomes a lost order.

AWS Backup schedules for databases, servers and storage, with retention policies and point-in-time recovery — and restores are tested on a schedule.

CloudWatch, Sentry and uptime checks with alerts routed to the team — we know about a problem before the user does.

GitHub Actions runs the test suite and deploys on every code change — for backends and mobile apps alike (build and upload to TestFlight and Play tracks).

WAF and DDoS protection at the edge, least-privilege IAM, secrets in a managed vault with rotation, encryption at rest and in transit, OWASP checks and periodic vulnerability testing.

An automated test suite covers every page, endpoint and structured-data block on this site, and the public forms are rate-limited and bot-protected.