Custom software development in Chicago

What custom apps, integrations and automation cover

Custom software is software built for one organization's way of working, not a shared product that every customer configures the same way. This page covers conventional engineering: web apps and internal tools, customer and partner portals, mobile apps, connections between the systems you already run, and automation of repeated steps. AI helps us draft, test and audit faster, and a person approves what goes live.

Work built around AI agents has its own pages: see AI automation agency for agent and workflow platforms and AI development company for custom agent builds. This page is about the software around and beside them, and about everything that needs no AI at all: the screens people log into, the APIs and webhooks that move data between systems, and rule-based automation.

• Web apps and internal tools

  Dashboards, quoting, scheduling, inventory and back-office screens built around your own process, not a vendor's idea of it.

• Customer and partner portals

  Logins, documents, orders and status pages, with roles that decide who sees what.

• Mobile apps

  iOS and Android apps, published under your own organization's developer accounts.

• System integration

  CRM, accounting, e-commerce, email and phone systems exchanging data through APIs and webhooks.

• Business process automation

  Repeated steps run by rules, on a no-code platform, in custom code or in a mix of both.

• Hosting, backups and upkeep

  Cloud, managed or private servers, tested restores, and a plan for updates and monitoring.

One idea ties these jobs together: the API, the agreed way one program asks another for data or action. The OpenAPI Specification, now at version 3.2.1, defines a standard, language-agnostic interface to HTTP APIs that lets both people and computers discover and understand what a service does without reading its source code.^[8]

Who builds it: Media Express LLC, based in Mount Prospect, Illinois, opened on April 1, 1995, so we built websites in the dial-up era. Since then we have delivered 2,500+ digital projects, and we keep 100+ web properties running, monitored by our own team of AI agents (Claude, ChatGPT, Gemini and open-source runtimes). We are a Polish-American agency and work in English and Polish, remotely across the United States and on site in the Chicago area.

Connecting systems: APIs, webhooks and the failures to plan for

Systems exchange data in two ways. Pull means one system asks another on a schedule. Push means the other system calls an address you provide when something happens, which is what a webhook is. Stripe's documentation, for example, presents webhooks as the way to react to asynchronous events such as a customer's bank confirming a payment, a dispute or a recurring payment succeeding. Push is quicker and lighter than polling, but your endpoint has to be built for the way senders really behave.^[9]

A vendor's own webhook documentation is a good specification of that behavior. Stripe's asks the following of your endpoint, and the same habits transfer to most other senders:^[9]

• Verify every request. Check the signature header against the raw request body and the endpoint's secret. A framework that alters the raw body breaks the check.
• Check the timestamp. The signed timestamp lets you reject replayed requests. Stripe's libraries default to a tolerance of 5 minutes, and a tolerance of 0 switches the recency check off.
• Answer fast, work later. Return a 2xx status before any complex logic, and process events from an asynchronous queue so a spike, such as monthly renewals, cannot overwhelm your servers.
• Expect duplicates and disorder. The same event can arrive more than once and delivery order is not fixed, so log the event IDs you have processed and never depend on sequence.
• Expect retries. In live mode Stripe retries for up to three days with exponential backoff, so a short outage on your side should not lose events.
• Rotate secrets. Roll signing secrets periodically, or at once if one may have been exposed.^[9]

The same discipline applies when your software calls other systems. RFC 9110 defines a request method as idempotent when several identical requests have the same intended effect as one, and lists PUT, DELETE and the safe methods as idempotent. It says a client should not automatically retry a non-idempotent method unless it has some means to know the request is idempotent anyway, or some means to detect that the original request was never applied. In practice an action such as creating an invoice needs its own protection against doubles, for example a lookup before the insert, because retries are normal.^[10]

Contracts help both sides. An OpenAPI description of your own API, kept next to the code, tells the next developer and each connected system what every endpoint takes and returns. OWASP's inventory guidance goes a step further: document each API host, its version and the sensitivity of the data it exchanges, and generate that documentation automatically in the build pipeline.^[8],[4]

Before any connector is built, the written scope should include a system map: which system is the source of truth for each kind of record, which fields move, in which direction, how often, and who is told when a transfer fails. Two systems that each believe they own the customer record are a common recipe for duplicates and overwritten data, so the map names one owner per record.

Business process automation: platform, custom code or both

Business process automation is technology running the repeated steps of a business process: a form submission creates a CRM record, an approved quote creates an invoice, a late payment starts a reminder. The design question is which layer does the work. A no-code platform, custom code and a mix of both all have a place, and the vendors' own documentation shows where the limits sit.

Sources: ^[11],[12]

A practical rule: begin on a platform when the steps are standard, volumes are modest and a business person must be able to read the flow. Move a step into code when the platform's code step cannot do the job within its limits, when run time or volume starts to hit those limits, or when data must stay on servers you control. A common middle path is a platform that orchestrates and a small custom service that does the one hard step, called through an API or webhook.

How the platforms count usage and bill, and how to handle monitoring, handover and account ownership for platform workflows, are compared on our AI automation agency page. Automation without code still needs engineering habits: exported or version-controlled workflows, a test run on sample data, alerts that reach a named person, and a documented way to switch each automation off.

Security: OWASP API Security Top 10, ASVS and NIST SSDF

A security promise is only useful if someone can check it. Three public references give a project something concrete to agree on. The OWASP API Security Top 10 (2023 edition) lists ten API risks, from API1:2023 Broken Object Level Authorization to API10:2023 Unsafe Consumption of APIs. Integration work is API work, so these entries are the working review list.^[1]

Sources: ^{[2],[3],[4],[5]}

OWASP's Application Security Verification Standard (ASVS) goes deeper on the application itself. Its repository describes it as a comprehensive set of security requirements for designing, developing and testing modern web applications and services, with 5.0.0 (May 2025) as the latest stable version. A written scope can name which ASVS requirements apply, which turns the word secure into something a tester can verify and a buyer can read.^[6]

NIST SP 800-218, the Secure Software Development Framework (SSDF) version 1.1 of February 2022, covers how software is made. It groups practices into four sets: Prepare the Organization, Protect the Software, Produce Well-Secured Software and Respond to Vulnerabilities. NIST says the aim is not a checklist but a basis for a risk-based approach, and that software acquirers can use it to define the characteristics they want in the software they buy. Four practices that a small project can adopt at once:^[7]

• PS.1: store all code, including configuration-as-code, in a repository with access based on least privilege, and track every change to an individual account.
• PS.3: securely archive each software release and its supporting data, so a problem found later can be analyzed and fixed.
• PW.4: reuse existing, well-secured components where feasible instead of duplicating functionality. NIST says this lowers cost, speeds development and reduces new vulnerabilities.
• RV.1: identify and confirm vulnerabilities on an ongoing basis, so they are found and fixed sooner and the window of opportunity for attackers shrinks.^[7]

The SSDF adds a note that matters when software runs on someone else's platform: responsibility for its practices can be spread across organizations when software is delivered as infrastructure, platform or software as a service, and the customer should agree with each provider which party is responsible for each practice.^[7]

Illinois and US rules that touch custom software

• Who is covered (Illinois Personal Information Protection Act, 815 ILCS 530). A "data collector" includes privately and publicly held corporations, retail operators and any other entity that handles, collects or otherwise deals with nonpublic personal information. "Personal information" covers a name together with a Social Security number, driver's license or state ID number, financial account or card number, medical or health insurance information, or unique biometric data. It also covers a user name or email address together with a password or security question and answer that would permit access to an online account. The account table of a customer portal can therefore hold personal information as the Act defines it. The definition applies when the data is not encrypted or redacted, or when the keys were also taken in the breach.^[17]
• Reasonable security and the contract clause (Section 45). A data collector that owns or licenses such records, or maintains or stores them without owning them, must implement and maintain reasonable security measures. A contract for disclosing the information must require the recipient to do the same. Entities already compliant with stricter state or federal law, or with the Gramm-Leach-Bliley safeguards standards, are deemed compliant with this Section. If your developer, host or an integrated service can reach customer records, check that your contract carries that clause.^[20]
• Breach notice (Section 10). A data collector that owns or licenses the information must notify affected Illinois residents at no charge, in the most expedient time possible and without unreasonable delay. One that maintains or stores data it does not own must notify the owner immediately after discovery if the information was, or is reasonably believed to have been, acquired by an unauthorized person. If a single breach requires notice to more than 500 Illinois residents, the Attorney General must be notified too, no later than the consumer notice. Agree in writing how fast your developer or host tells you.^[18]
• Disposal (Section 40). Materials containing personal information must be disposed of so the information is unreadable, unusable and undecipherable, and electronic media may be destroyed or erased so it cannot practicably be read or reconstructed. The civil penalty is up to $100 per individual affected, capped at $50,000 for each instance of improper disposal. Financial institutions covered by 15 U.S.C. 6801 and persons subject to 15 U.S.C. 1681w are exempt from this Section. Old servers, retired backup media and test copies built from real data are all places where it can matter.^[19]
• Email your software sends. Google's sender guidelines say that from February 1, 2024 all senders to Gmail accounts must set up SPF or DKIM authentication and use a TLS connection, among other rules. Senders of 5,000 or more messages a day must also set up DMARC, and marketing and subscribed messages must support one-click unsubscribe. An app that sends order, password-reset or notification mail should authenticate its sending domain from day one.^[25]

Who owns commissioned code is covered in the next section. Consent and disclosure rules for marketing email and text messages are covered on our marketing agency page, and rules specific to AI voice and chat tools on AI voice agents.

Who owns the code, the accounts and the data

Ownership is decided by paper, not by who typed the code. In US copyright law a work made for hire is either a work prepared by an employee within the scope of employment, or a specially ordered or commissioned work in one of nine listed categories that the parties expressly agree, in a signed written instrument, to treat as a work made for hire. The nine are a contribution to a collective work, part of an audiovisual work, a translation, a supplementary work, a compilation, an instructional text, a test, answer material for a test and an atlas. None of them names software, so do not assume a commissioned program belongs to you by default.^[21]

Section 204(a) adds that a transfer of copyright ownership is not valid unless an instrument of conveyance, or a note or memorandum of the transfer, is in writing and signed by the owner of the rights conveyed. In plain terms, when an outside team writes your software, ownership moves to you only if a signed agreement says so. Ask your attorney to check three things: that the rights are assigned to you, that you receive the full source code and build instructions, and that third-party and open-source components are listed with their licenses. Ownership of custom AI agents has its own notes on the AI development company page.^[22]

Accounts decide whether you can leave. For mobile apps, Apple says an organization's name is shown as the seller name of its apps, that the enrolling person must have legal authority to bind the organization, that the organization must be a legal entity (DBAs, fictitious business names, trade names and branches are not accepted) and that, except for government entities, it must have a D-U-N-S Number. Publish under your own organization, and put the domain, hosting, code repository, payment account and email-sending service in the company's name too, with your own administrator login.^[24]

Secrets belong outside the code. The Twelve-Factor methodology calls for strict separation of config from code, where config is everything likely to vary between deploys, including credentials for third-party services. Its test is whether the codebase could be made open source at any moment without compromising any credentials. A repository that passes that test can be handed over without handing over your keys.^[14]

Data should leave as easily as it arrived. Ask for documented export formats, a restore test on a clean server, and a written statement of what happens to your data and backups when the engagement ends. The disposal duty described in the previous section governs how personal data is erased afterward.

Hosting that scales, private servers, backups and upkeep

NIST's definition of cloud computing lists rapid elasticity among its five essential characteristics: capabilities can be elastically provisioned and released, in some cases automatically, to scale outward and inward with demand. Scaling with the business therefore has two halves you can ask about: how the software adds capacity, and how the hosting adds it.^[13]

At the software level, the Twelve-Factor methodology says the share-nothing, horizontally partitionable nature of its processes makes adding capacity straightforward, and it warns that an individual virtual machine can only grow so large, so an app must also be able to run across several processes on several machines. An application that keeps user sessions or uploaded files on one server's disk usually cannot do that, which is why the design question comes before the hosting question.^[15]

Private servers: NIST defines a private cloud as infrastructure provisioned for exclusive use by a single organization, which may be owned, managed and operated by the organization, a third party or some combination, and may exist on or off premises. Private therefore says who may use the machine, not who runs it or where it sits. Ask who has administrator access, who patches the operating system, where the data physically lives and whose name is on the account. A private server usually suits data that must stay under your control or software with steady, predictable load. The price is that someone must patch, monitor and back it up.^[13]

Backups: CISA's guidance for small and medium businesses sets out the 3-2-1 rule: 3 copies of important files, on 2 different types of storage media, with 1 copy stored off-site. It also says to perform scheduled recovery tests to verify backup integrity, to be able to restore data both fully and partially and roll back at least seven days, and to protect backups with physical security, encryption and offline copies. A backup that has never been restored is an assumption, so ask for the date of the last successful restore test and the location of the off-site copy.^[16]

Upkeep: software ages even when nobody touches it. The runtime underneath reaches the end of support. Node.js, for instance, says long-term-support releases typically cover critical bug fixes for a total of 30 months, and that production applications should use only Active or Maintenance LTS releases, so any Node-based app has an upgrade ahead of it. NIST's practice RV.1 asks for ongoing vulnerability identification, and OWASP's inventory item asks for a retirement plan for each API version.^[26],[7],[4]

• Connections: how many systems you integrate, and how often their vendors change their APIs.
• Users and data: the number of roles, the sensitivity of the data and the breach-notice duties above.
• Moving parts: how many runtimes, frameworks and libraries have to be upgraded on a schedule.
• Operations: the hosting model, who is on call, and how fast you need a fix.
• Quality: test coverage and the state of the documentation, which decide how cheaply a new developer can take over.

Those are the cost drivers for upkeep. We do not quote a price on this page, and a maintenance plan with its response expectations is written into the scope.

How an engagement works with us and what to prepare

1. Request

   You describe the system, the process or the problem: what is slow, manual or disconnected.

2. Short call

   We ask about your tools, users, data and limits, and tell you honestly whether to build, buy or configure.

3. Written scope

   Goal, tools, approvals and the success measure, plus the system map, the security requirements to be checked and who owns each account, written before anything is built.

4. Pilot

   A small first release goes to a few real users before rollout, so the process is tested on real work. A person approves what goes live.

5. Handover and upkeep

   Code, documentation, accounts and backups sit in your name. A maintenance plan is part of the scope, so nobody is surprised after launch.

Prices are not published here. The estimate is free, we work with every budget, and after a short call you get scope and cost in writing. You can reach us at 773-800-1520, Monday to Friday 9-5 or Saturday 10-2 Central, in English or Polish.

• A list of the systems involved, who administers each one, and whether each has an API or can send webhooks (the vendor's developer documentation says).
• One real example of each process with names and numbers redacted: the form, the spreadsheet, the email, the screen.
• Where the data lives today, how it is exported, and which of it is personal, financial or health data.
• The user roles: who must see what and who approves what.
• Any contract or regulation that limits where data may be stored or who may touch it.
• The person who can say yes, and the person who will own the software after launch.
• What done means, in one measurable sentence.

When this is NOT a good fit: buy, configure or keep it simple

The UK government's guidance on defining a purchasing strategy gives a clear test for build versus buy. The criteria below paraphrase it. The decision is yours, and we would rather tell you to buy than build something you do not need.^[23]

Sources: ^[23]

The same guidance warns that even small modifications to off-the-shelf software can remove most of the benefits of using it, and advises configuring settings instead so vendor support continues when new versions are released. NIST's SSDF reaches a similar place from the security side, listing reuse of existing well-secured components among its practices. Where a product fits most of your needs, buy or configure it, and spend custom effort on the connections and the few places that are truly yours.^[23],[7]

• A brochure or marketing website. A site that mostly publishes pages does not need an application. CMS MESH 5.1 (Media Express Static Hub) is our own new-generation manual CMS: ultra-fast static HTML pages edited by hand, with no database and no plugins to update. See CMS MESH and web design in Chicago.
• A product already does the job. If mainstream accounting, scheduling or email software meets most of the need, we would configure it and connect it, not rebuild it.
• The process is still being invented. Software fixes decisions in place. Run the process by hand or in a spreadsheet through a few real cycles first, then build what stays the same.
• Nobody will own it. Someone must approve changes, read alerts, renew the domain and hosting, and answer for the data. Unowned software collects forgotten endpoints, which is the risk OWASP's inventory item describes.^[4]
• The saving is smaller than the upkeep. Software has a running cost in hosting, updates and attention. If the manual task is occasional, a checklist may be the better tool.
• You need an AI agent, not an application. That is a different design problem: see AI development company.
• You need a legal opinion. Contract terms, copyright assignment and regulatory duties are for your attorney.

If your situation matches one of these, we will tell you on the first call.

Questions answered

Sources

1. OWASP Top 10 API Security Risks, 2023 (OWASP API Security Project), accessed 2026-10-13. The ten entries of the 2023 edition, API1:2023 to API10:2023.https://api-security.owasp.org/editions/2023/en/0x11-t10
2. API1:2023 Broken Object Level Authorization (OWASP API Security Project), accessed 2026-10-13. Object ID manipulation, per-object authorization checks, authorization tests that block deployments.https://api-security.owasp.org/editions/2023/en/0xa1-broken-object-level-authorization
3. API4:2023 Unrestricted Resource Consumption (OWASP API Security Project), accessed 2026-10-13. Missing limits, rate limiting, payload limits and spending limits or billing alerts for third-party services.https://api-security.owasp.org/editions/2023/en/0xa4-unrestricted-resource-consumption
4. API9:2023 Improper Inventory Management (OWASP API Security Project), accessed 2026-10-13. Forgotten endpoints and old versions, documentation, retirement plan, inventory of integrated services and data shared.https://api-security.owasp.org/editions/2023/en/0xa9-improper-inventory-management
5. API10:2023 Unsafe Consumption of APIs (OWASP API Security Project), accessed 2026-10-13. Risks of consuming third-party APIs: TLS, validation, redirects, timeouts, provider assessment.https://api-security.owasp.org/editions/2023/en/0xaa-unsafe-consumption-of-apis
6. OWASP Application Security Verification Standard (ASVS) repository (OWASP Foundation), accessed 2026-10-13. What ASVS is for and its latest stable version, 5.0.0 of May 2025.https://github.com/OWASP/ASVS
7. NIST SP 800-218: Secure Software Development Framework (SSDF) Version 1.1 (National Institute of Standards and Technology (NIST)), accessed 2026-10-13. Four practice groups, practices PS.1, PS.3, PW.4 and RV.1, not-a-checklist statement, acquirer use, shared responsibility note.https://nvlpubs.nist.gov/nistpubs/SpecialPublications/NIST.SP.800-218.pdf
8. OpenAPI Specification v3.2.1 (OpenAPI Initiative), accessed 2026-10-13. Definition of the specification and the current version number.https://spec.openapis.org/oas/latest.html
9. Receive Stripe events in your webhook endpoint (Stripe), accessed 2026-10-13. Example of signed webhooks: signature check, replay tolerance, retries, duplicates, ordering, queues, secret rotation.https://docs.stripe.com/webhooks
10. RFC 9110: HTTP Semantics, section 9.2.2 Idempotent Methods (Internet Engineering Task Force (IETF)), accessed 2026-10-13. Definition of idempotent methods and when a client may automatically retry.https://www.rfc-editor.org/rfc/rfc9110.html
11. Code node (n8n documentation) (n8n GmbH), accessed 2026-10-13. What the Code node does, npm module limits on Cloud versus self-hosted, no file system or HTTP access.https://docs.n8n.io/code/code-node/
12. Using Code by Zapier (Zapier), accessed 2026-10-13. Languages and versions, runtime and memory limits per plan, extended runtime, rate limits, page date.https://help.zapier.com/hc/en-us/articles/45405528551181-Using-Code-by-Zapier
13. NIST SP 800-145: The NIST Definition of Cloud Computing (National Institute of Standards and Technology (NIST)), accessed 2026-10-13. Five essential characteristics including rapid elasticity, and the definition of a private cloud.https://nvlpubs.nist.gov/nistpubs/Legacy/SP/nistspecialpublication800-145.pdf
14. The Twelve-Factor App: III. Config (The Twelve-Factor App (Adam Wiggins)), accessed 2026-10-13. Strict separation of config from code and the open-source litmus test for credentials.https://12factor.net/config
15. The Twelve-Factor App: VIII. Concurrency (The Twelve-Factor App (Adam Wiggins)), accessed 2026-10-13. Scaling out through share-nothing processes and the limit of vertical scaling.https://12factor.net/concurrency
16. Back Up Business Data (Cybersecurity and Infrastructure Security Agency (CISA)), accessed 2026-10-13. The 3-2-1 backup rule, scheduled recovery tests, seven-day rollback, protections for backups.https://www.cisa.gov/audiences/small-and-medium-businesses/secure-your-business/back-up-business-data
17. 815 ILCS 530/5: Personal Information Protection Act, Definitions (Illinois General Assembly), accessed 2026-10-13. Definitions of data collector, breach and personal information, including login credentials for online accounts.https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K5.htm
18. 815 ILCS 530/10: Notice of breach; notice to Attorney General (Illinois General Assembly), accessed 2026-10-13. Notice to residents, duty of a holder that does not own the data, Attorney General notice above 500 residents.https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K10.htm
19. 815 ILCS 530/40: Disposal of materials containing personal information (Illinois General Assembly), accessed 2026-10-13. Disposal standard for electronic media, civil penalty and cap, exempt institutions.https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K40.htm
20. 815 ILCS 530/45: Data security (Illinois General Assembly), accessed 2026-10-13. Reasonable security measures for owners and holders of records, and the contract clause for disclosures.https://www.ilga.gov/Documents/legislation/ilcs/documents/081505300K45.htm
21. 17 U.S.C. Chapter 1, section 101: Definitions (work made for hire) (U.S. Copyright Office), accessed 2026-10-13. Two-part definition of a work made for hire and the nine commissioned-work categories.https://www.copyright.gov/title17/92chap1.html
22. 17 U.S.C. Chapter 2, section 204: Execution of transfers of copyright ownership (U.S. Copyright Office), accessed 2026-10-13. A transfer of copyright ownership must be in writing and signed by the owner.https://www.copyright.gov/title17/92chap2.html
23. Define your purchasing strategy (Government Digital Service and Central Digital and Data Office (UK government)), accessed 2026-10-13. Criteria for when building or buying technology may be best, and the advice to configure rather than customize.https://www.gov.uk/guidance/define-your-purchasing-strategy
24. Enroll in the Apple Developer Program (Apple Developer), accessed 2026-10-13. Organization enrollment requirements and the seller name shown for apps.https://developer.apple.com/programs/enroll/
25. Email sender guidelines (Google Workspace Admin Help), accessed 2026-10-13. Authentication and TLS requirements for senders to Gmail, extra rules at 5,000 or more messages a day.https://support.google.com/a/answer/81126
26. Node.js Releases (OpenJS Foundation (Node.js)), accessed 2026-10-13. LTS support duration and the advice to run production on Active or Maintenance LTS releases.https://nodejs.org/en/about/previous-releases

How we checked this page

Last verified 2026-10-13 · Media Express LLC

General information, not legal, financial or security advice. Rules and vendor terms change; check the cited source before you rely on a figure.

Related

• AI automation agency for Chicago businessesAI automation agency
• AI development company for Chicago teamsAI development
• A static website CMS, explained honestlyStatic website CMS
• Custom web design in ChicagoWeb design