A software firm that works from idea to product.
Working from Turkey into Europe and North America: enterprise client engagements alongside our own catalogue on the App Store and CodeCanyon.
- Markets
Turkey · Europe · North America
Remote delivery with working overlap into UK and US Eastern hours.
- Regulatory scope
Saudi Arabia · UAE · European Union
Production integrations with ZATCA Phase 2, UAE EIS and EU ESPR.
- Engagement types
Fixed-fee audit · Capped scope · Retainer
Contracting on your paper or ours, with named SLA tiers.
- Languages
English · Turkish
Documentation, releases and support delivered in both.
Who we are
What our own products taught us.
WebKoding operates from Turkey, serving clients in Turkey, Europe and North America. The firm was built on two kinds of work at once: enterprise client engagements, and a commercial software catalogue distributed through the App Store and CodeCanyon.
That second half is unusual for a services firm, and it is the reason the first half works. Our own products run in thousands of merchant environments we never configured and cannot inspect. Every incompatibility, every regulator specification revision and every support ticket lands on us directly.
The standards that came out of that — upgrade safety, backward compatibility, support answers measured in hours — are the ones we bring to client work. We build software as though we will have to maintain it, because we usually do.
How we operate
Principal-led, not bench-staffed
The engineer who scopes an engagement is the engineer who delivers it and stays through handover. No transition from the people you met to the people who arrive.
Two engineers on every codebase
Nothing we build depends on a single person's memory. Continuity is a delivery requirement, not a nice-to-have we add when a client asks.
Written down or it did not happen
Architecture decisions, runbooks and incident procedures are produced during the work, not assembled in the final week for the handover meeting.
Governance
Security, data and contracting.
- Data protection
- GDPR and KVKK aligned. Data processing agreement signed before any system access is granted, with residency in your region where required.
- Access control
- SSO where you support it, least-privilege by default, individual named accounts, and access revoked on engagement close as a documented step.
- Code security
- Dependency scanning in the pipeline, secrets held in a managed store rather than configuration, and review required before any merge to a release branch.
- Intellectual property
- You own the code and repositories from the first commit. No escrow arrangements, no licence-back clauses, no shared-component dependencies you cannot fork.
- Contracting
- Fixed-fee audit to start, then capped scope or retainer. We work on your standard agreement or ours, and we will complete your security questionnaire before a first call.
- Subcontracting
- Disclosed in advance if used at all. No undisclosed offshore delegation of work you contracted us to deliver.
Evaluating vendors?
We will send a capability statement, named references under NDA, and answers to your security questionnaire before the first call.