Core service
Website Development
Business websites, redesigns and online stores, built with security in mind.
- NIST CSF
- ASD Essentials
Development
Secure Development
Launch a website, app or automation with security designed in from the first sketch, not bolted on after go-live.
- DesignSecurity requirements, access and data flowsPassed
- BuildOWASP practices, no secrets in codePassed
- ReviewCode review, dependencies updatedRunning
- LaunchSecure hosting, MFA, least privilegeQueued
- MaintainPatching, backups, monitoringQueued
01Development services
Start with the problem you are solving.
Many projects combine two, such as a new website with ongoing care.
Custom Software & Web Apps
Portals, internal tools and dashboards, designed around who can see what.
- NIST CSF
- ASD Essentials
Integrations & Automation
Connect your systems and automate repetitive work, securely set up and monitored.
- ASD Essentials
- NIST CSF
Website Care & Hosting
Managed hosting, updates, backups and monitoring, looked after by a security team.
- ASD Essentials
- NIST CSF
02Secure by design
Security planned in, not patched on.
Plenty of agencies build good websites. The difference is where security sits in the process, and how much of it is decided before any code is written.
Typical build
- Security reviewed at the end, if time allows
- Plugins and scripts added as needed
- Server settings left as installed
- Admin access shared or set up quickly
- Hosting and updates left to the client
Security-first build · Catharsis
- Security requirements agreed at discovery
- Third-party code kept to what the system needs
- Hosting set up with HTTPS, security headers and secure defaults
- MFA and least-privilege access from day one
- Care plans with patching, tested backups and security monitoring
03Recent work
Websites we have built
Websites and apps we've designed and built for Australian and international organisations.
Manufacturing
Electrical equipment manufacturer website
Anil Traders
Website for a manufacturer of HT and LT transmission and distribution equipment in Aligarh, India, established in 1967. It presents the product range, from air break switches to substation isolators, and the works.
Visit the Anil Traders website (external site, opens in a new tab)
Health and disability support
NDIS high-intensity care website
PowerCare
Website for a registered NDIS provider in Sydney. It explains the nurse-led, high-intensity supports on offer, such as tracheostomy and PEG feeding care, and lets participants and support coordinators get in touch or refer.
Visit the PowerCare website (external site, opens in a new tab)
Transport
EFTPOS for taxi drivers website
Taxi Transact
Website for an in-cab EFTPOS terminal service for taxi drivers. It shows how the terminal works with an interactive demo, walks drivers through onboarding and the referral offer, and lists support contacts.
Visit the Taxi Transact website (external site, opens in a new tab)
Accommodation
Serviced apartments website
Avasa Urban
Website for furnished serviced apartments in Sydney for short, mid and long stays. It showcases the properties and what each stay includes, with local area guides, FAQs and ways to enquire or book.
Visit the Avasa Urban website (external site, opens in a new tab)
Development
Security decisions start at the design stage
Choices made in early designs, such as which forms collect personal data and who can reach an admin screen, decide how much there is to protect later. We raise those questions while designs are still cheap to change.
04Read the detail
Development, explained
In short
Secure development means websites, software and automation planned to design out common security problems, instead of finding them after launch. Catharsis, a cyber security company, follows OWASP secure development practices, keeps access to the minimum each system needs and launches what we build on secure hosting defaults.
Which standards do we build to?
We follow guidance from the Open Worldwide Application Security Project (OWASP). The OWASP Top 10 sets the risks we design out, and the OWASP Application Security Verification Standard (ASVS) gives us a checklist of security requirements to design and build against.
We follow the secure development controls in ISO/IEC 27001 Annex A (A.8.25 to A.8.31), and run our own business under a certified ISMS.
Websites, portals and integrations face the internet, handle customer data and hold credentials to other systems. Building them securely from the start is cheaper than fixing them after an incident.
Which development service do you need?
Start with the problem you are trying to solve:
- Your website is dated, slow, hard to update or has been hacked. Start with website design and development: business sites, redesigns and online stores.
- A process runs on spreadsheets, or customers need a secure place to log in. Look at custom software and web apps, with access control designed in first.
- Staff re-key the same data between systems. Integrations and automation connects your customer relationship management (CRM) platform, accounting software and Microsoft 365, using platforms such as n8n, Power Automate or Make.com, self-hosted or in the cloud. When a workflow needs AI, our AI automation service applies the same controls.
- Your site works, but nobody is patching, backing up or watching it. That is what website care and hosting is for.
You can see examples on our work page.
05FAQ
Secure development, answered.
Can't see your question? Ask a specialist and get a straight answer.
Ask a specialistWhat does secure development mean?
Secure development means security is designed into a website or application from the first plan, rather than checked at the end. In practice that means defining who can access what, validating every input, protecting credentials, keeping third-party code to a minimum and keeping software up to date after launch.
Why would a cyber security company build websites and software?
Because many breaches start with a website, web app or integration that was built without security in mind. Outdated plugins, weak admin access and over-permissioned connections are common entry points. Building the systems ourselves lets us design out those weaknesses before your customers use the system.
Do you only build for businesses in Sydney?
No. We work with organisations across Australia from our Sydney base. Discovery workshops, design reviews and handover sessions work well over video calls, and we can meet in person where that helps. Government buyers can engage us through BuyICT and buy.nsw, where Catharsis is a registered supplier.
Can you look after a website or app after launch?
Yes. Our website care and hosting service covers managed hosting, software updates, backups, uptime monitoring and security monitoring, handled by our security team. We can also maintain custom apps and automations we have built. If you prefer to host and run the system yourself, we hand over every account, credential and document at launch.
Where can we see examples of your work?
Our work page lists websites and projects as they are published, with the type of client, what we built and the technology used. We add new projects as they launch. If you would like to discuss a project similar to yours in more detail, get in touch and we can walk you through the relevant work.
Development
Planning a website, app or automation?
No obligation. You talk to the people who do the work. Enquiries usually get a reply within 3 business days.