He didn’t know what that meant. Six months later a bot scraped the open Firestore endpoint at 4am. By morning the project had burned through £3,400 of unbounded reads. Crashlytics flagged it. Nobody had wired the alert.
Service Firebase development services · Auth + Firestore + Gen 2 · UK
Firebase development for the MVP that ships this quarter. not next year’s rebuild.
Firebase Auth + Firestore + Cloud Functions + FCM, built with hardened security rules, real backups, and a documented path off Firebase the day you outgrow it.
23Firebase apps since 2019
0security-rule audit fails
800mscold start, hot paths
Why CTOs sign
You don’t need another Firebase team. You need engineers who’ve shipped 23 Firebase apps and watched what breaks at scale.
Firestore rules that hold, budget caps that catch the £3,400 scrape, and a documented path off Firebase the day you outgrow it. We build all three on day one.
“P99 dropped from 1.4s to 180ms. The bill cut a third. Best engagement we’ve paid for.”
001
23
Firebase apps shipped to production since 2019
002
<800ms
Cold start on hot paths, Gen 2 functions
003
0
Friday-night outages across our 2025 deploys
The founder this page is for4am scrape · one week · £3,400 burned
Marcus built his MVP on Firebase. The rule read allow read, write: if true.
The CEO asked the obvious question. “Why is a tool that costs £0 to start now costing more than our AWS estate?” The honest answer: nobody had tested the rules, capped the budget, or set up a backup. Why would they? It worked in the demo.
We rebuilt the Firestore rules with proper auth checks, wired budget caps and anomaly alerts, set up scheduled exports, and shipped over 6 weeks. The bill stabilised at £180 a month. This page is for CTOs who recognise themselves in that paragraph.
UK Firebase development studio · senior-only
Four things in-house teams and offshore shops can’t hand you
Senior Firebase plus Firestore rules is rare. We bring it, and we put it in writing on day one.
Firestore rules as code
Rules tested in the Emulator Suite. PR gate on every change. Open-rule incidents become architecturally impossible after our handover.
Budget caps + anomaly alerts
Firebase budget caps and Cloud Monitoring alerts wired in week one. The £3,400 surprise scrape bill ends before it starts.
Senior-only, no juniors
The engineers who sign your scope are the engineers who ship. No staff aug, no day-rate juniors hiding behind a senior title.
30-day walk-away both ways
You keep everything. IP assigns on commit. No lock-in. The migration path off Firebase ships documented from day one.
The Firebase pain. The day-1 answer.
Each one is a single architectural decision made on day one of our build.
- 01
“The read rule was `if true`. Anyone could query the entire database.”
Rules tested in the Emulator Suite, PR-gated. Every rule change passes the emulator and a PR gate. Cross-tenant leak is architecturally impossible after handover.
- 02
“A collection grew to 200K docs, an untyped query read all of it, and the bill hit £3,400.”
Every query gets an index and a limit. Composite indexes pre-deployed, budget alerts wired. Unbounded reads become architecturally impossible.
- 03
“The query worked in dev and failed in prod with a `requires an index` error.”
Index baseline plus a CI check. Indexes deployed via firebase.json. CI checks every query has its index, so index-missing prod errors end.
- 04
“A function cold-started at 3.2s and the customer assumed the app had broken.”
Min instances, Gen 2, slim deps. Hot paths keep warm. Gen 2 functions, slim dependencies, cold start under 800ms. The customer never notices.
- 05
“A customer changed phones and push notifications kept going to the old device.”
Token rotation plus a cleanup job. Tokens rotate on auth state change. Stale-token cleanup runs nightly. Push goes to the right device.
- 06
“We need Identity Platform features and the Firebase Auth upgrade scares us.”
Staged Identity Platform migration. Auth shadow keeps sessions live, custom claims preserved. The migration ships without forcing a re-login.
- 07
“A customer asked for a restore, we had no backup, and recovery was impossible.”
Scheduled exports plus a restore test. Firestore exports to GCS on schedule, restore tested quarterly, PITR window documented. Restore requests stop being scary.
- 08
“We outgrew Firebase and the migration off it scares us. Lock-in fear.”
Migration path documented from day one. Firestore data exports cleanly to managed Postgres. Auth migration to Auth0 rehearsed. Lock-in fear ends.
The stack we ship every Firebase build on.
Firebase handles auth, data, compute, and push on day one. AWS sits underneath for the infrastructure that proves scale, and the path off Firebase stays open the whole time.
T1
What every Firebase build runs on
FirebaseFirebase AuthFirestoreRealtime DatabaseCloud Functions Gen 2Firebase HostingFCMCrashlyticsRemote ConfigApp CheckEmulator SuiteMixpanel + GA4Sentry
T2
When your Firebase brief calls for it
reach when neededPythonJavaGoGraphQLtRPCDrizzle / Prisma
T3
The infrastructure layer
AWS-defaultAWSCloudFrontCloudflareAWS LambdaS3 + CloudFrontAWS RDS / AuroraMongoDB AtlasRedisInngest / Trigger.devTerraformDatadog + SentryGitHub Actions
The numbers CTOs sign off on
A UK B2B SaaS rebuild, 1,800 customers. Rules audited, Cloud Functions on Gen 2, budget caps and exports wired in a ten-week sprint.
<800ms
Cold start on hot
The £3,400 surprise bill went away and stabilised at £180 a month. Rules tested, budgets capped.
Results
A UK B2B SaaS rebuild,
A UK B2B SaaS rebuild,
1,800 customers, in numbers
We audited the Firestore rules and fixed a cross-tenant leak, rebuilt the Cloud Functions on Gen 2, wired budget caps and anomaly alerts, and added scheduled exports with restore tests. Ten-week sprint. The £3,400 surprise bills ended.
Rules + cost
£3,400£180
Monthly bill, stabilised
0
Cross-tenant leaks after audit
Performance
<800ms
Cold start, hot paths
99.95%
Uptime SLO held
Track record
23
Firebase apps since 2019
0
Security-rule audit fails
Three ways to start. Pricing in the email back.
Pick the shape that fits and Mohit will send your real number inside 24 hours.
Firebase audit week
5 days, £8K fixed. We audit your existing app or a new brief: architecture, perf, scale, hire path.
- 5-day senior audit
- Rules map + ADRs
- Signed scope, line-item GBP
- No commitment to build
Full Firebase build sprint
8 to 14 weeks of fixed-scope shipping. Auth + Firestore + Cloud Functions Gen 2, budget caps and Crashlytics built in.
- Firebase + Gen 2 + Emulator Suite
- Two senior engineers paired
- 30-day walk-away both ways
- IP assigns on every commit
Firebase migration / rebuild
8 to 12 weeks. Take your existing Firebase codebase and rebuild for production. Behind-flag cutover, cost and perf targets locked.
- Rules audited + tested
- Functions Gen 1 Gen 2
- Budget caps + alerts wired
- Cold-start + bill targets locked
“P99 dropped from 1.4s to 180ms. The bill cut a third. Best engagement we’ve paid for.”
— Eleanor B., CTO, UK B2B SaaSWhat CTOs actually ask before signing
Pain-first, soft-second.
We default to the patterns the Firebase community has settled on for production: rules tested in the Emulator Suite, every query with its index, observability from day one, idempotent writes, budget caps wired in week one. If you have a strong reason to deviate, we’ll discuss it in the audit week. Default is hardened Firebase development services, not a demo that breaks at scale.
Firebase budget caps and Cloud Monitoring anomaly alerts wired in week one, every query gets an index and a limit, and the open `if true` rule that caused the scrape gets rebuilt with proper auth checks. One client went from a £3,400 surprise week to a steady £180 a month. The unbounded read becomes architecturally impossible.
Yes, and the migration path ships documented from day one. Firestore data exports cleanly to managed Postgres, the Auth migration to Auth0 is rehearsed, and the off-Firebase plan sits in your repo as an ADR. You’re never trapped. You move when the product needs it, not when a vendor decides.
Yes. We’ve done it for UK clients in 2025. Your existing backend (Rails, Django, .NET, Java, Go) stays, and we build the Firebase layer with typed contracts on top. You get senior-grade Firebase development without rebuilding the backend you already trust.
30-day walk-away both ways. Milestone billing 25/25/25/25. UK VAT registered, listed on Companies House, shipping since 2019. You’re never more than four weeks at risk of paying for nothing.
Every Firebase project has two senior engineers paired, not one. Every decision goes into an ADR the same day, and Mohit reviews every PR. If one engineer leaves, the other has full context the next morning. In seven years, two engineers have left mid-project. Both handovers were inside 48 hours, and neither client noticed.
Yes, with 14 days’ notice. Engineers move to other projects, spend pauses, and you resume with another 14 days’ notice. No cancellation fee, no restart fee.
NDA signed inside 30 minutes via DocuSign, mutual template ready. Once the brief lands, Mohit replies inside 24 hours and audit week can begin the following Monday.
In context
See it in context.
A look at the kind of firebase development surface we hand over — real screens, real data, documented and yours from day one.
One paragraph. That’s it.
Tell us what the build needs to do, who uses it, and what success looks like for you. Mohit replies inside 24 hours: a clear yes, a clear no, or the one question that decides it.
What happens after the email lands
- < 24h
A personal reply.
Yes, no, or the deciding question. Straight to your inbox.
- Week 1
Firebase audit begins.
Rules map, budget caps, restore plan, signed scope.
- Launch
Holds at scale.
Rules tested, budgets capped, exports rehearsed. In the runbook.