Home/Our Engineering Process
OUR ENGINEERING PROCESS

Our Engineering Process

Eleven stages from discovery to monitoring. Each one has defined deliverables and an exit gate we do not pass until it is met — this is how we build software that runs in production for years, not apps that get handed over and forgotten.

11
stages
11
exit gates — one per stage
37
documented deliverables you receive
01

Discovery

GoalUnderstand the problem before proposing a solution.

What we do
  • Interviews with decision-makers and real users
  • Audit of existing systems and data
  • User and data flow mapping
  • Constraints: budget, timeline, existing systems, regulatory requirements
  • Initial risk register
What you receive
  • Discovery brief
  • Scope statement (in and out)
  • Risk register
  • Cost and time estimate range
Exit gate We do not move on until this is true

Scope signed off by the client, and each of the top three risks has an owner and a plan.

Tools Workshops FigJam Docs
02

Architecture

GoalDecide the shape of the system before writing a line of code.

What we do
  • Platform choice: Flutter or native, Laravel or NestJS
  • Data model and service boundaries
  • Integration map: payments, maps, messaging, external systems
  • Cloud topology and scaling plan
  • Monthly running-cost estimate
What you receive
  • Architecture Decision Records (ADRs)
  • System diagram (C4)
  • Data model
  • Infrastructure plan with monthly cost
Exit gate We do not move on until this is true

Every ADR reviewed by a second senior engineer, and the monthly running cost accepted by the client.

Tools C4 Model ADRs AWS Pricing Calculator
03

Technical Specification

GoalWrite down exactly what will be built, so nothing is left to guesswork.

What we do
  • User stories with acceptance criteria for each
  • API contract (OpenAPI) before implementation
  • Database schema and permission matrix
  • Non-functional requirements: performance, availability, backups, Arabic and RTL
  • List of third-party accounts to be created in the client's name
What you receive
  • Technical specification document
  • OpenAPI draft
  • Database schema
  • Estimated backlog split into milestones
Exit gate We do not move on until this is true

The client signs the spec, every story has acceptance criteria, and the final estimate is within ±15% of the architecture estimate.

Tools OpenAPI Linear / Jira dbdiagram
04

UI/UX

GoalDesign the screens against the spec, not the other way round.

What we do
  • User flows and wireframes
  • Arabic-first design system with full RTL support
  • High-fidelity screens for iOS, Android and web
  • Clickable prototype
  • Usability and accessibility review
What you receive
  • Figma file with reusable components
  • Interactive prototype
  • Screen inventory mapped to user stories
Exit gate We do not move on until this is true

Every user story has a screen, the prototype is approved by the client, and the RTL and accessibility check is complete.

Tools Figma Design tokens
05

Development

GoalBuild in short increments that can be reviewed and tried.

What we do
  • Two-week sprints with a clear goal each
  • Small feature branches merged daily
  • Every database change is a code-versioned migration
  • Feature flags for sensitive functionality
  • A build on TestFlight and the Play internal track at the end of every sprint
What you receive
  • Working software at the end of every sprint
  • Demo build on TestFlight / Play
  • Changelog
Exit gate We do not move on until this is true

Sprint goal met, no P1 bugs open, and the build is on TestFlight or the Play internal track.

Tools GitHub Docker Flutter Laravel / NestJS
06

Code Review

GoalNo code reaches the main branch without a second pair of eyes.

What we do
  • Every pull request reviewed by another engineer
  • Checklist: security, performance, N+1 queries, error handling, RTL, tests
  • Small pull requests (under 400 lines) so reviews are real, not rubber stamps
  • Automated static analysis before human review
What you receive
  • Reviewed and approved pull requests
  • Review comments resolved and documented
Exit gate We do not move on until this is true

At least one approval, CI green, static analysis clean, and no review comment left open.

Tools GitHub Pull Requests Larastan ESLint Dart analyzer
07

Automated Testing

GoalCatch regressions before humans do.

What we do
  • Unit tests for business logic
  • Feature tests for every API endpoint
  • Integration tests for the critical paths: sign-in, payment, order
  • Contract tests against the OpenAPI spec
  • All of it running in GitHub Actions on every push
What you receive
  • Test suite inside the repository
  • CI pipeline running on every change
  • Coverage report
Exit gate We do not move on until this is true

CI green on every pull request, critical paths covered, and no test skipped without a ticket.

Tools PHPUnit / Pest Jest Flutter test GitHub Actions
08

Staging

GoalRehearse the launch before the launch.

What we do
  • An environment identical to production, from the same infrastructure code (Terraform / Docker)
  • Realistic data and sandbox accounts for the payment gateways
  • Client acceptance testing against the acceptance criteria
  • Baseline performance test and a migration dry run
  • Rollback plan written
What you receive
  • UAT sign-off sheet
  • Performance baseline
  • Release notes
  • Rollback plan
Exit gate We do not move on until this is true

All acceptance criteria pass in client testing, the migration dry run succeeds, and the rollback plan is written.

Tools Terraform Docker KNET / MyFatoorah sandbox k6
09

Security Review

GoalFind the weaknesses before someone else does.

What we do
  • OWASP Top 10 checklist
  • Dependency vulnerability scan
  • Secrets audit: no keys in code
  • Authorization tests per role
  • Rate limiting and input validation
  • Encryption at rest and in transit, and personal-data handling
  • Store requirements: Privacy Labels and Data Safety
What you receive
  • Security review report
  • Findings fixed, or accepted with a named owner
  • Secrets inventory and where each lives
Exit gate We do not move on until this is true

No high or critical finding open, every secret in a managed vault, and MFA enabled on every cloud account.

Tools OWASP ZAP Dependabot composer / npm audit IAM
10

Production

GoalA boring launch — which is the point.

What we do
  • Release checklist: DNS, SSL, CDN and domains
  • Backups verified with a real restore before go-live
  • Staged rollout on Play and phased release on the App Store
  • Feature flags for sensitive functionality
  • A launch window with the whole team online
  • Accounts and credentials handed over into the client's vault
What you receive
  • Production environment handed over in the client's name
  • Runbook
  • Release tag in the repository
Exit gate We do not move on until this is true

Backups tested with a restore, alerts reaching the team, rollback rehearsed, and the client owns every account.

Tools GitHub Actions App Store Connect Google Play Console Cloudflare AWS
11

Monitoring

GoalKnow about a problem before the user does.

What we do
  • Uptime checks and server and app error tracking
  • CloudWatch metrics and alarms
  • Store review and crash monitoring
  • Monthly health report
  • Periodic security patches and backup verification
  • Feedback into Discovery for the next release
What you receive
  • Monitoring dashboard
  • Alert routing to the team
  • Monthly health report
  • Maintenance plan
Exit gate We do not move on until this is true

This stage never closes: alerts are acknowledged within the SLA and the monthly report is delivered.

Tools CloudWatch Sentry Crashlytics Uptime checks
Monitoring feeds back into Discovery

What production tells us — errors, performance, user behaviour, store reviews — becomes the discovery input for the next release. The cycle does not end at launch.

The same path from the client's side

The simple version →

The four steps on the Process page are this same pipeline, condensed for non-technical readers:

We design
We launch & support
Want the proof rather than the description?

The Engineering at Sigma page shows what this pipeline produces: the deployed apps, the cloud infrastructure and the technologies with their scores.

Engineering at Sigma →

Your next project deserves this pipeline

Book a discovery session — we review your idea, map the architecture and risks, and give you a clear estimate before any commitment.

📲 Start discovery