Kismet Blocks

Start where we finished.

The foundation under our six products is not a template — it is code that has been carried into a new application six times and fixed by every one of them. We assemble your application out of it. One hour on a call, then two to five days.

Start a conversation

How it goes

Three steps, one week at most

  1. The call

    One hour. What the application is, who its users are, what it stores, and which of the blocks it actually needs. You leave the call with the list; we leave it with enough to build.

    1 hour

  2. The build

    We assemble it: the blocks you picked, wired together, with your domain model on top and tests around the parts that carry risk. No placeholder code and no "TODO: implement security".

    2–5 days

  3. The handover

    The repository, running locally and deployable, plus a written walkthrough of what each block does and where to change it. It is your code from that point — no license, no runtime dependency on us, nothing to renew.

    Yours
$12,000–$24,000 Fixed before we begin · scoped on the call

The comparison

Against building the same thing yourself

Same destination: a production application with tenancy, encryption, MFA, and an audit trail already in it. The difference is how long you spend getting there, and what it costs on the way.

Time and cost: building in-house versus Kismet Blocks Building the same foundation in-house takes 15 to 30 working days and costs 15,000 to 30,000 dollars. Kismet Blocks takes 2 to 5 days and costs 12,000 to 24,000 dollars. Time to production Building it in-house 15–30 working days Kismet Blocks 2–5 days 0 10 20 30 days What it costs Building it in-house $15,000–$30,000 Kismet Blocks $12,000–$24,000 $0 $10k $20k $30k at least up to

The in-house figures are what a team of your own would spend on the same scope — three to six weeks of a senior developer — and they assume the security and tenancy work actually gets done rather than deferred. Deferring it is the cheaper number that is not on this chart, and it is the one that gets expensive later.

The blocks

What there is to pick from

Every one of these is running in production in at least one of the six right now. Nothing on this list is a plan, and nothing on it gets written for the first time on your job.

Accounts and access

Form login, email verification, email-code MFA, password reset, and an account-status check that runs on every request — so disabling someone ends their access now rather than whenever their session expires.

Tenancy

Multi-tenant organizations with membership rows and a live re-check per request. The tenant is explicit in the path, never inferred from the session, and a non-member gets a 404 rather than a 403 — a 403 tells them the thing exists.

Encryption at the field

Per-tenant envelope encryption, AES-256-GCM, with a KMS seam so local development needs no cloud account. Deleting the keys is an erasure that covers your backups too.

Your data, where you keep it

MongoDB and MySQL both run in production here today — one of our products runs both at once, against the same domain model. The relational mapping is standard JPA, so PostgreSQL is a dialect change rather than a rewrite. You are not made to move your database to work with us.

An API

RS256 JWT mint and resource server, with Swagger. The web UI stays session-based; the API is for the clients that are not a browser.

Money

Stripe, in whichever shape fits: hosted Checkout subscriptions, prepaid credit packs, or metered overage. Webhooks are the only path that grants anything — the browser is never believed about what was paid for.

Tracing that survives async

A trace id and request id minted per request, echoed back as response headers and pushed into the logging context, so every line a request produces carries the same id and one customer complaint becomes one grep. Timing covers the whole chain including template render — timing the controller alone misses the part that is usually slowest.

And it crosses the thread boundary: named pools sized in configuration rather than buried in code, with a task decorator that carries the context over, mints a fresh trace for the async unit so it ties back to its parent, and clears it afterwards so nothing leaks into the next task on that thread. Work that leaves the request thread stays traceable — which is almost never true by default.

Tests, unit and integration

Unit tests around the parts that carry risk, plus an integration tier that runs against the real security filter chain rather than one switched off for convenience — which is the only way a test can tell you whether a route is actually reachable. Separated so the fast suite stays fast: unit tests on every build, the integration tier on verify.

The unglamorous half

Rate limiting, strict CSP with nonces, an append-only audit trail, transactional mail, and the static-asset caching that stops a deploy from being invisible.

Already running something?

The blocks fit existing applications too.

You do not have to start from nothing, and you do not have to take all of it. The blocks are à la carte — tenancy added to an application built single-tenant, encryption where the data got sensitive after the fact, MFA on a login that only ever had a password. Fitted to your codebase rather than a new one.

It starts with a review, because picking blocks off a menu without reading the code is how you get sold things you do not need. Reviews start at $3,500 and blocks at $2,500 →

The blocks are Spring Boot on Java 25, with MongoDB, MySQL or PostgreSQL — so that is where they drop in most directly. On a different stack, start with a conversation and we will tell you honestly whether we are the right people for it.