# Pharos Production
> Custom software development company since 2013. 90+ engineers in Las Vegas and Kyiv. AI, FinTech, healthcare, Web3 and blockchain specialists.
> Last Updated: 2026-10-20

## Services

### AI Development
- [AI Development Services](/services/ai-services/): AI agents, LLM integration, RAG systems, ML platforms
- [AI Consulting Services](/services/ai-consulting-services/): AI strategy, readiness assessment, roadmap and implementation advisory
- [AI Agent Development](/services/ai-agent-development/): Multi-agent systems, autonomous workflows
- [Generative AI & LLM](/services/generative-ai-development/): GPT, Claude, open-source model integration
- [Machine Learning](/services/machine-learning-development-services/): Custom model training, computer vision, NLP
- [How We Build AI](/services/how-we-build-ai-solutions/): AI development methodology and process

- [Intelligent Document Processing](/services/intelligent-document-processing/): Document extraction and human review, with an anonymized clinic workflow linking records, documents and medical research.

### Blockchain & Web3
- [Blockchain Development](/services/blockchain-development-company/): Smart contracts, DeFi, multi-chain
- [Smart Contract Development](/services/smart-contracts-development/): Solidity, audits, gas optimization
- [DApp Development](/services/dapp-development-company/): Decentralized applications with wallet integration
- [DeFi Development](/services/defi-development-company/): Liquidity pools, yield farming, AMMs
- [Tokenization & RWA](/services/tokenization-and-rwa-development/): Real-world asset tokenization platforms
- [Crypto Wallet Development](/services/crypto-wallet-development/): Multi-chain HD wallets, institutional custody
- [Crypto Exchange Development](/services/crypto-exchange-development/): Matching engines, multi-chain infrastructure
- [Blockchain Proof of Concept](/blockchain-proof-of-concept/): 8-week engagement, working ledger in your Azure subscription, written build or no-build verdict, fixed scope from $50,000
- [How We Build Blockchain](/services/how-we-build-blockchain-solutions/): Security-first blockchain methodology

### FinTech Development
- [FinTech Development](/services/fintech-development-services/): Full-cycle FinTech software, aligned with PCI DSS
- [Payment Solutions](/services/payment-solutions-development/): Payment gateways, mobile wallets, reconciliation
- [Banking Software](/services/banking-software-development/): Digital banking, core modernization, open banking
- [Insurance Software](/services/insurance-software-development/): Claims automation, underwriting, policy management
- [Compliance & RegTech](/services/compliance-and-regtech-solutions/): KYC/AML platforms, transaction monitoring
- [Digital Assets & Trading](/services/digital-assets-and-trading-platforms/): Crypto exchanges, tokenization, DeFi integration
- [How We Build FinTech](/services/fintech-development-services/): Compliance-first FinTech methodology

- [KYC Software Development](/services/kyc-software-development/): Build or improve identity verification workflows with provider integrations, review tools and traceable decisions.

### Web3 x FinTech Crossover
- [Web3 FinTech Development](/services/web3-fintech-development/): Intersection of blockchain and financial services
- [Tokenized Finance](/services/tokenization-and-rwa-development/): RWA tokenization, security tokens
- [Compliant Wallets](/services/crypto-wallet-development/): Institutional-grade crypto wallets with KYC
- [DeFi for Institutions](/services/defi-development-company/): Compliance wrappers, yield optimization

### Software Development
- [Services Hub](/services/): All 6 service categories with descriptions
- [Custom Software](/services/software-development/): Full-cycle software development
- [Mobile Apps](/services/mobile-app-development/): React Native, Flutter, native iOS/Android
- [Frontend Development](/services/front-end-development/): React, Angular, Vue.js SPAs
- [UX/UI Design Services](/services/ux-ui-design-services/): UX/UI and product design for web and mobile, design systems, design plus build
- [Backend Development](/services/back-end-development/): Node.js, Python, Elixir APIs
- [DevOps](/services/devops/): AWS, Kubernetes, CI/CD automation
- [RPA Development](/services/rpa-development-services/): UiPath, Automation Anywhere, invoice processing, data entry
- [Digital Transformation](/services/digital-transformation-services/): Legacy modernization, cloud migration, process automation
- [Legacy Modernization](/services/legacy-modernization-services/): Monolith to microservices, cloud migration, database upgrades

- [Data Engineering](/services/data-engineering-services/): Build event pipelines and data integrations with explicit contracts, replay checks and an operations handover.
- [EHR Integration Services](/services/ehr-integration-services/): Connect clinical systems with agreed data mappings, read/write boundaries and recovery behavior.
- [Loyalty Software Development](/services/loyalty-platform-development/): Build reward rules, partner integrations and a ledger that explains how customer balances change.
- [Online Casino Software Development](/services/online-casino-software-development/): Develop casino platform components for game providers, sessions, wallet transactions and operator reconciliation.
- [Patient Portal Development](/services/patient-portal-development/): Build patient access to appointments, records and care-team communication around your existing clinical systems.
- [Sportsbook Software Development](/services/sportsbook-software-development/): Build or modernize betting workflows with odds-feed integration, wallet handoffs and operator controls.

### Security and QA
- [Cybersecurity](/services/cybersecurity-services/): Penetration testing, security architecture
- [Security Audits](/services/security-audits-and-gas-optimization/): Smart contract audits, gas optimization

### Consulting
- [IT Consulting](/services/it-consulting/): Architecture design, technology strategy
- [Staff Augmentation](/services/staff-augmentation-services/): Dedicated engineers for your team

## Ranked Vendor Comparisons
- [Top 10 AI Development Companies](/insights/comparisons/ai-development-companies/): Numbered ranking of 10 named AI vendors, founded year/headcount/HQ/specialization per company, comparison table, stated methodology, Pharos Production ranked first by disclosed editorial decision, source conflicts disclosed
- [Top 10 Blockchain Development Companies](/insights/comparisons/blockchain-development-companies/): Numbered ranking of 10 named blockchain vendors, founded year/headcount/HQ/specialization per company, comparison table, stated methodology, Pharos Production ranked first by disclosed editorial decision, source conflicts disclosed
- [Top 10 FinTech Development Companies](/insights/comparisons/fintech-development-companies/): Numbered ranking of 10 named FinTech vendors, founded year/headcount/HQ/specialization per company, comparison table, stated methodology, Pharos Production ranked first by disclosed editorial decision, source conflicts disclosed
- [Pharma Software Development Companies](/insights/comparisons/pharma-software-development-companies/): 12 named pharma software vendors profiled from public sources, founded year/headcount/HQ per company, what each shows on GxP delivery, seven stated shortlist criteria, Pharos Production placed first by disclosed editorial decision

## Industries
- [FinTech](/industries/fintech-software-development/): Payment platforms, digital banking, lending, compliance
- [Healthcare](/industries/healthcare-it-solutions/): HIPAA-aligned EHR, telemedicine, patient portals
- [Pharmaceutical](/industries/pharmaceutical-software-development/): Integrations, data platforms and AI layers around validated GxP systems, validation-ready delivery, the client's QA team owns validation
- [Crypto and Web3](/industries/crypto-web3-and-blockchain-development/): DeFi protocols, crypto wallets, NFT marketplaces
- [Banking](/industries/banking-software-development/): Core banking, open banking APIs, PCI DSS alignment
- [Insurance](/industries/insurance-software-development/): Claims automation, underwriting, policy management
- [E-Commerce](/industries/e-commerce-software-development/): Product catalogs, checkout, inventory management
- [Education](/industries/education-software-development/): LMS, virtual classrooms, student management
- [Manufacturing](/industries/manufacturing-software-development/): Production planning, IoT monitoring, MES
- [Logistics](/industries/logistics-software-development/): Fleet management, route optimization, warehouse
- [Energy](/industries/energy-software-development/): Smart grid, utility monitoring, predictive maintenance
- [Construction](/industries/construction-software-development/): BIM/IFC integration, digital twins, offline-first field apps
- [Real Estate](/industries/real-estate-software-development/): PropTech, MLS/IDX integration, property management platforms

## AI Solutions by Industry
- [AI Solutions for FinTech](/services/ai-services/): AI agents for trading, fraud detection, loan approval
- [AI Solutions for Healthcare](/services/ai-services/): AI diagnosis, patient records analysis, appointment scheduling
- [AI Solutions for Insurance](/services/ai-services/): AI claims processing, fraud detection, policy management
- [AI Solutions for E-Commerce](/services/ai-services/): AI recommendations, chatbots, inventory optimization
- [AI Solutions for Manufacturing](/services/ai-services/): AI predictive maintenance, quality control, demand forecasting
- [AI Solutions for Logistics](/services/ai-services/): AI route optimization, demand forecasting, warehouse automation
- [AI Solutions for Automotive](/services/ai-services/): AI autonomous systems, quality inspection, supply chain
- [AI Solutions for Energy](/services/ai-services/): AI grid optimization, demand forecasting, renewable integration
- [AI Solutions for Education](/services/ai-services/): AI tutoring, learning personalization, assessment automation
- [AI Solutions for Gaming](/services/ai-services/): AI game agents, player behavior prediction, content generation
- [AI Solutions for Legal](/services/ai-services/): AI contract analysis, legal research, document automation
- [AI Solutions for Marketing](/services/ai-services/): AI campaign optimization, content generation, lead scoring
- [AI Solutions for Real Estate](/services/ai-services/): AI property valuation, lead matching, market analysis
- [AI Solutions for Food Industry](/services/ai-services/): AI supply chain optimization, demand forecasting, quality control
- [AI Solutions for HR and Recruitment](/services/ai-services/): AI resume screening, interview scheduling, talent matching
- [AI Solutions for Customer Service](/services/ai-services/): AI support agents, ticket routing, sentiment analysis

## AI Use Cases
- [AI Chatbot Development](/ai-chatbot-development/): Multi-language chatbots, knowledge base integration, API connectivity
- [AI Fraud Detection](/services/ai-services/): Real-time fraud detection, anomaly detection, risk scoring
- [AI Document Processing](/services/ai-services/): OCR, information extraction, document classification
- [AI Recommendation Engine](/services/ai-services/): Personalization, collaborative filtering, real-time ranking
- [AI Predictive Maintenance](/services/ai-services/): Equipment health monitoring, failure prediction, scheduling
- [AI Sales Agent Development](/ai-sales-agent/): Autonomous sales calls, lead qualification, deal management
- [AI Code Review Automation](/ai-code-review/): Automated code analysis, security scanning, best practice detection
- [AI Content Moderation](/services/ai-services/): Text/image moderation, harmful content detection, brand safety
- [AI Data Analysis Agent](/ai-data-analysis/): Automated reporting, insights generation, data exploration
- [AI Customer Support Agent](/ai-customer-support-agent/): Omnichannel support, context-aware responses, escalation routing
- [AI Invoice Processing](/services/ai-services/): Invoice extraction, validation, automated approval workflows
- [AI Appointment Scheduling](/services/ai-services/): Calendar integration, conflict resolution, meeting coordination
- [AI Development](/ai-development/): Custom AI solutions, training, deployment, optimization

## Technologies
- [React](/technologies/react-development-services/): 40+ projects, SPAs, dashboards, Next.js
- [Node.js](/technologies/nodejs-development-services/): 50+ backends, real-time APIs, microservices
- [Python](/technologies/python-development-services/): 35+ projects, AI/ML pipelines, Django, FastAPI
- [Solidity](/technologies/solidity-development-services/): 484 contracts deployed, security audits
- [Elixir](/technologies/elixir-development-services/): 20+ real-time projects, 2M+ concurrent connections
- [LangChain](/technologies/langchain-development-services/): 15+ RAG systems, multi-agent orchestration
- [TypeScript](/technologies/typescript-development-services/): 60+ projects, strict mode, full-stack
- [Go](/technologies/golang-development-services/): 15+ microservices, high-performance backends
- [Flutter](/technologies/flutter-development-services/): 12+ cross-platform mobile apps
- [AWS](/technologies/aws-development-services/): 25+ cloud projects, Lambda, ECS, Bedrock

## Case Studies
- [Case Studies Hub](/cases/): All client project case studies across FinTech, healthcare, gaming and Web3
- [Ludo Web3 Reputation](/cases/ludo-reputation-platform-of-web3/): Real-time reputation scoring across 15+ blockchains, 2M+ wallets, 10K events/sec at sub-200ms and 99.9% uptime on Kafka/Flink/Cassandra/Pinot
- [CareConnect Patient Portal](/cases/careconnect-patient-portal-healthcare-engagement-platform/): HIPAA-aligned, 78% patient adoption
- [Pleenk Payments](/cases/pleenk-secure-payments-platform/): Secure payments platform, aligned with PCI DSS
- [Kimlic KYC](/cases/kimlic-blockchain-based-kyc/): Blockchain-based identity verification
- [PumpTap Crypto Wallet](/cases/pumptap-crypto-wallet/): Multi-chain crypto wallet
- [MedCore EHR](/cases/medcore-ehr-platform/): Electronic health records platform
- [NoMoreBets Rapid Bets](/cases/nomorebets-rapid-bets-platform/): Sub-50ms bet placement latency, 10,000+ concurrent users at peak
- [Gambit Stream Sportsbook](/cases/gambit-stream-sportsbook-platform/): Sportsbook platform with instant odds, live-stream betting, secure wallet management and integrated risk controls, live since 2021
- [Gambit Stream Casino](/cases/gambit-stream-online-casino-platform/): Online casino platform with multi-game play, secure payments, loyalty features and mobile-first interface, live since 2020
- [GridTradeX Prediction Game](/cases/gridtradex-crypto-prediction-game/): Crypto prediction game with 2.8ms order-to-ack p99 latency
- [Nextcheck KYC](/cases/nextcheck-the-kyc-platform/): Automated KYC verification for 5,000+ documents daily at 99.8% accuracy
- [Dostyq Loyalty Platform](/cases/dostyq-loyalty-platform/): Loyalty platform scaled from 80K to 2.4M daily transactions
- [Lucky Bets Aggregator](/cases/lucky-bets-casino-games-aggregator/): Casino games aggregator with 100+ providers, sub-100ms latency
- [Pro Gambling Forecasting](/cases/pro-gambling-sports-forecasting-platform/): AI-powered sports forecasting with 78% prediction accuracy
- [Pulse Social Network](/cases/pulse-social-network-with-prizes/): Social network with prizes, 100,000+ daily active users
- [Sagas Time-lapse Network](/cases/sagas-time-lapse-social-network/): Time-lapse social network with 1M+ stories created
- [Taxi Aggregator App](/cases/taxi-aggregator-app/): Taxi aggregator matching 5,000+ rides per hour

## Engineering Insights
- [Ludo Web3 Reputation Engine Architecture](/insights/engineering/ludo-web3-reputation-engine/): A technical account of transaction ingestion, project analysis, search and cross-chain identity in Ludo's dual-engine architecture.
- [E2B R3](/insights/healthcare/e2b-r3/): ICSR message structure, validation layers, acknowledgment handling and the regional implementation rules used by FDA and EMA.
- [Software Used by Pharmaceutical Companies](/insights/healthcare/software-used-by-pharmaceutical-companies/): Pharmaceutical system classes across the value chain, their owners, integrations and the boundaries for custom development.
- [GxP Software Development](/insights/healthcare/gxp-software-development/): Requirement traceability, validation evidence, risk-based testing and the division of work between a software team and regulated QA.
- [GxP Vendor Qualification](/insights/healthcare/gxp-vendor-qualification/): Questions for QA, IT, procurement and AI governance, supplier evidence, qualification red flags and a weighted scoring template.
- [Shipping a Dense Retrieval Baseline Before Hybrid Search](/insights/engineering/dense-retrieval-before-hybrid/): Our first index used 1024-dimensional dense vectors, with a serving constraint, a versioned collection alias and a deliberately limited retrieval milestone
- [Versioned Sources and Frozen Citations in a Medical Learning RAG](/insights/engineering/versioned-sources-frozen-citations/): Our source lifecycle separated active retrieval from saved citation snapshots, preserving history after replacement while deleted files could return 404
- [Source Weights After the Cutoff: The Limits of Our First Retrieval Policy](/insights/engineering/source-weights-after-cutoff/): Weights of 0.10 to 5.00 reordered surviving results but could not rescue a source outside raw top-k or below the similarity cutoff in our first retrieval policy
- [Evolving Citations From Pages to Figures and Timed Media](/insights/engineering/citations-pages-figures-timed-media/): Figures and recordings changed citation fields, history parsers and page-based progress, with code checks recorded separately from browser verification
- [Two Time Scales for Audio: Model Requests and Searchable Moments](/insights/engineering/audio-model-pieces-searchable-moments/): Our audio pipeline used 10-minute model requests and 60-to-120-second retrieval fragments, with stored segments allowing reindexing without another speech call
- [State of FinTech Custom Development 2026](/insights/engineering/state-of-custom-software-tco-2026/): Real MVP costs USD 150K-USD 950K, 9-18 month regulated timelines, compliance tax and Five Hidden Cost Layers
- [State of AI Development Costs 2026](/insights/engineering/state-of-ai-development-costs-2026/): 5 hidden AI cost layers - evals, safety, context, observability, model churn. Token prices fell 80-90% but total cost rose. Paid discovery surfaces hidden layers before overruns
- [LLM Observability Cost](/insights/engineering/llm-observability-cost/): Pricing models for Langfuse, LangSmith, Braintrust, Arize and Confident AI - three metering families (event-count, data-volume, volume-time), LLM-as-judge token cost and OpenTelemetry GenAI maturity gap
- [Blockchain Development Timeline](/insights/engineering/blockchain-development-timeline-2026/): 2 weeks to 12+ months by project type
- [FinTech Compliance Checklist](/insights/engineering/fintech-compliance-checklist-2026/): PCI DSS, SOC 2, GDPR requirements
- [AI Agent Frameworks Comparison](/insights/engineering/ai-agent-frameworks-comparison-2026/): LangChain vs CrewAI vs AutoGen
- [Build vs Buy AI Agent](/insights/engineering/build-vs-buy-ai-agent/): Decision framework for 2026
- [RAG vs Fine-Tuning](/insights/engineering/rag-vs-fine-tuning/): When to use each approach
- [AI Agent vs LLM](/insights/engineering/ai-agent-vs-llm/): Difference between an LLM and an AI agent - tools, memory, control loop and when to use each
- [MCP Server Development](/insights/engineering/mcp-server-development/): Stateless architecture post-2026-07-28 spec, per-request _meta negotiation, server primitives and transports, OAuth 2.1 authorization, security failure modes and build cost model
- [Data Act Cloud Switching Requirements](/insights/engineering/data-act-cloud-switching-requirements/): EU Data Act Article 30 and 31 - cloud switching capability scope, functional equivalence testing without published standards, export surface beyond raw data
- [What Is MiCA?](/insights/engineering/what-is-mica/): EU Markets in Crypto-Assets Regulation explained - scope, CASP rules, ART and EMT tokens, timeline and compliance
- [FinTech Trends 2026](/insights/business/fintech-trends-2026/): Hybrid finance, AI agents, RWA tokenization
- [How to Build a Crypto Exchange](/insights/engineering/how-to-build-a-crypto-exchange/): Architecture, tech stack and cost. Median USD 252K-1.5M over 12-24 months across 8 Pharos builds. CEX vs DEX, matching engine, custody, liquidity, compliance
- [Embedded Finance](/insights/engineering/embedded-finance/): Architecture, use cases and how to build it. First feature shipped in a median 7 weeks across 21 BaaS integrations. Embedded payments, lending, banking, insurance
- [How to Build a Neobank](/insights/engineering/how-to-build-a-neobank/): Tech stack, licensing and cost. Median MVP USD 454K over 12 months across 4 builds, 7-month licensing lead time. BaaS vs sponsor bank, core banking
- [HIPAA-Compliant Software Development Cost](/insights/healthcare/hipaa-compliant-software-development-cost/): HIPAA premium a median 22% over baseline, median build USD 418K across 6 healthcare projects. Where the compliance budget goes
- [EHR Integration Guide](/insights/healthcare/ehr-integration-guide/): HL7, FHIR and SMART on FHIR. Median 7 weeks and USD 74K across 33 integrations, Epic most common at about 40 percent
- [EHDS Conformity Assessment](/insights/healthcare/ehds-conformity-assessment/): Self-declaration route under Regulation (EU) 2025/327 with no notified body - the Article 26(2) deferral pushes the real Chapter III deadline to 26 March 2031 for SaaS and in-house EHR systems, the deliverable set is Annex III technical documentation, an Annex IV declaration of conformity, an Article 38 information sheet and CE marking, and the EUR 20 million fine ceiling sits in the secondary-use chapter, not the conformity chapter
- [Prior Authorization API](/insights/healthcare/prior-authorization-api/): CMS-0057-F requires FHIR R4, US Core and SMART rather than CRD, DTR or PAS, the (g)(31)-(33) IG versions changed on October 1 2026 and X12 278 sits under enforcement discretion
- [AI Agent EHR Write Access](/insights/healthcare/ai-agent-ehr-write-access/): What makes an LLM agent's write to a FHIR EHR defensible - authorship and provenance, clinician attestation, scopes as a ceiling rather than a permission, retraction after downstream consumption and where it collides with EU AI Act and MDR classification
- [AI Citation UX for Aesthetic Medicine: Our Mockups Hallucinated Before the Model Did](/insights/healthcare/ai-citation-ux-aesthetic-medicine/): Case study of citation UX for an aesthetic-medicine AI learning platform: a self-audit that found 6 of 7 demo citations wrong, printed-page citations, designed honesty states and separate source classes
- [RWA Tokenization Platform Development](/insights/engineering/rwa-tokenization-platform-development/): 2026 engineering roadmap. Median USD 258K over 6 months across 8 platforms, compliance 52% of effort. Token standards ERC-3643 and ERC-1400
- [Tokenized Fund Register Reconciliation](/insights/engineering/tokenized-fund-register-reconciliation/): A tokenized fund keeps two records of share ownership, an on-chain ledger and an off-chain transfer agent register - an SEC Form 497 prospectus supplement gives control to the chain, a Form 40-APP application gives it to the register and FCA COLL 6 Annex 4 removes the register instead of choosing, and none of the three publishes how a divergence is detected, at what cadence or where the investor stands before it is caught - five failure scenarios from chain reorg to sanctions freeze
- [Smart Contract Audit Cost](/insights/engineering/smart-contract-audit-cost/): Pricing by project type. Median 27 findings per audit and 71% with a critical or high across 130 audits. What drives the quote
- [EU AI Act Compliance](/insights/engineering/eu-ai-act-compliance/): Dated compliance timeline and applicability map after Regulation (EU) 2026/1744 - what changed in Article 113, Article 6 and Article 50 and why EUR-Lex and the Commission's AI Act tool still show pre-amendment rules
- [AI Act Article 50](/insights/engineering/ai-act-article-50-transparency/): The two mandatory marking layers for Article 50, the transitional date hidden in Article 111(4) and what actually survives screenshots, cropping and paraphrasing
- [AI Act High Risk Classification](/insights/engineering/ai-act-high-risk-classification/): How to classify an AI system as high-risk under Article 6 and Annex III after the Digital Omnibus - the new 1a to 1c carve-outs, a decision tree and worked examples
- [AI Act Technical Documentation](/insights/engineering/ai-act-technical-documentation/): Annex IV translated point by point into engineering deliverables, plus the logging and retention duties in Article 12, Article 19 and Article 26 and the unconfirmed SME simplified-documentation route
- [GPAI Model Obligations](/insights/engineering/gpai-model-obligations/): What a general-purpose AI model provider owes under Annex XI versus downstream integrators under Annex XII, where the open-source carve-out stops and why GPAI penalties sit in Article 101, not Article 99
- [AI Act Conformity Assessment Routes](/insights/engineering/ai-act-conformity-assessment-routes/): Which conformity assessment procedure a high-risk system takes - Annex III point 5 credit scoring and life and health insurance pricing route to Annex VI internal control with no notified body under Article 43(2), so the provider self-assesses and holds the evidence
- [AI Act Post-Market Monitoring Plan](/insights/engineering/ai-act-post-market-monitoring-plan/): The Article 72 post-market monitoring plan - the binding template was repealed by the Digital Omnibus before it was ever issued and replaced by guidance due 2 September 2027, so teams design and instrument their own plan now
- [AI Act Serious Incident Reporting](/insights/engineering/ai-act-serious-incident-reporting/): Article 73 reporting - the Article 3(49) definition has four alternative limbs selecting among three clocks of 15 days, two days and 10 days, and new Article 75(1a) changed who the report goes to
- [AI Act Fundamental Rights Impact Assessment](/insights/engineering/ai-act-fundamental-rights-impact-assessment/): The Article 27 deployer duty, its six required elements and the DPIA reuse the Digital Omnibus introduced - Annex III point 5(b) creditworthiness and 5(c) life and health insurance pricing are named expressly
- [AI Act and DORA Overlap for Financial Entities](/insights/engineering/ai-act-dora-overlap-financial-entities/): How AI Act duties sit beside DORA for a supervised financial entity - neither instrument cites the other, and Article 74(6) puts AI Act market surveillance with the national financial supervisor
- [Smart Contract Risk in Crypto Custody](/insights/engineering/smart-contract-risk-crypto-custody/): 130 audits, 71% with a critical or high finding - how upgrade privilege is proved from the admin slot, what a proxy admin key does to an Article 75(7) segregation argument and the Article 68(9) retention duty
- [Omnibus vs Segregated Crypto Wallets](/insights/engineering/omnibus-vs-segregated-crypto-wallets/): MiCA Article 75(7) limb one tests client assets against the CASP's own, not client against client - where per-client granularity sits in the Article 75(2) register and the cost on UTXO versus account-model chains
- [CASP Wind Down Plan](/insights/engineering/casp-wind-down-plan/): Required by MiCA Article 74 with no paragraph numbering or deadline - the Article 64(8) transfer versus Article 75(6) return conflict MiCA never reconciles, walked phase by phase from trigger to register closeout
- [CASP vs VASP](/insights/engineering/casp-vs-vasp-crypto-authorization/): Which EU crypto entity license applies: VASP registrations under AMLD5, CASP authorization under MiCA Title V, the Article 60 notification route and EMI licensing
- [CASP License Application](/insights/engineering/casp-license-application/): What the MiCA Article 62 application file contains, the RTS and ITS items, and the 25 and 40 working day clocks as rules
- [MiCA White Paper Requirements](/insights/engineering/mica-white-paper-requirements/): Who must draft a Title II crypto-asset white paper, the Annex I content, iXBRL format, the 20 working day notification and the withdrawal right
- [NIS2 Compliance Outsourcing](/insights/engineering/nis2-compliance-outsourcing/): Which Article 21 measures can be bought and what Article 20 keeps with management, the supply chain duty outsourcing creates
- [NIS2 Entity Registration](/insights/engineering/nis2-entity-registration/): The Article 3(4) and Article 27 filings, their two week and three month clocks and what national portals ask
- [ISO 20022 Structured Address Migration](/insights/engineering/iso-20022-structured-address-migration/): What breaks at the November 2026 address cutover and how to triage records for parse, enrich or reject
- [Verification of Payee Implementation](/insights/engineering/verification-of-payee-implementation/): Building both the requesting and the responding side, and where the scheme leaves the matching decision to the responder
- [Instant Payments Sanctions Screening](/insights/engineering/instant-payments-sanctions-screening/): The exact bounds of what the instant rail prohibits and which controls survive
- [E-Money Safeguarding Reconciliation](/insights/engineering/e-money-safeguarding-reconciliation/): Proving the ledger equals the safeguarding accounts when no instrument sets a cadence
- [Electronic Money Token Issuance](/insights/engineering/electronic-money-token-issuance/): Following one euro through issuance, placement, redemption and attestation under MiCA Title IV
- [PSD3 Compliance Requirements](/insights/engineering/psd3-compliance-requirements/): PSD3 and PSR duties are offsets from an unset entry-into-force date, not calendar deadlines - the 21 and 27 month tiers from the Council's April 2026 compromise texts and why the still-circulating 18 and 24 month figures trace to the superseded 2023 proposal
- [CRA Incident Reporting Deadlines](/insights/engineering/cra-incident-reporting-deadlines/): Article 14 sets two separate reporting clocks, not one - the 24 hour early warning and 72 hour notification stages match for an actively exploited vulnerability and a severe incident but the final report deadline diverges, 14 days after a fix becomes available against one month after the 72-hour notification
- [CRA Severe Incident Classification](/insights/engineering/cra-severe-incident-classification/): Article 3 never defines severe incident - the threshold sits in Article 14(5), narrowing the general incident test to sensitive or important data or functions in one limb and to introduced or executed malicious code in the other, while a separate Article 3(42) bar requires reliable evidence of actual exploitation before a vulnerability counts as actively exploited
- [CRA Vulnerability Handling Requirements](/insights/engineering/cra-vulnerability-handling-requirements/): Annex I Part II sets eight standing vulnerability handling duties, from a software bill of materials to secure update distribution, and Article 13 layers a support period manufacturers must set at no less than five years unless the product's expected use is genuinely shorter, plus a ten year retention duty for every security update issued during that period
- [CRA Single Reporting Platform](/insights/engineering/cra-single-reporting-platform-integration/): The Single Reporting Platform is a web form and case management system ENISA runs, not an API - ENISA's own guidance confirms no interfaces are planned at launch, so a team files its first CRA notification manually and mirrors the field schema in its own systems rather than integrating against one
- [CRA NIS2 and DORA Reporting](/insights/engineering/cra-nis2-dora-reporting-overlap/): A company that is a CRA manufacturer, a NIS2 Directive essential or important entity and a DORA Regulation financial entity keeps three separate reporting duties with three different triggers and clocks - the CRA's Single Reporting Platform consolidates notifications within the CRA itself and does not fold NIS2 or DORA obligations into that filing
- [EUDI Wallet Integration](/insights/engineering/eudi-wallet-verifier-openid4vp-implementation/): The credential format decision is also the presentation-route decision - the remote SD-JWT VC route over OpenID4VP profiled by HAIP keeps a verifier build inside specifications the Architecture and Reference Framework sets requirements out from, so ISO/IEC 18013-5 and ISO/IEC 18013-7 never enter scope
- [EUDI Wallet SCA](/insights/engineering/eudi-wallet-strong-customer-authentication/): TS12 states that the verified jti claim in the Key Binding JWT of a wallet-presented SCA Attestation serves as the Authentication Code PSD2 requires for electronic payments - the build order from signed and encrypted requests through locale checks to the amr array gate, run as a second acceptance path beside an existing implementation
- [EUDI Wallet Relying Party](/insights/engineering/eudi-wallet-relying-party-registration/): Access certificates are issued exclusively to registered relying parties under Regulation (EU) 2024/1183 Article 5b and CIR (EU) 2025/848 - registration is a precondition to any wallet integration, the registered attribute list under Annex I caps every subsequent request and a suspension or cancellation revokes both certificates within 24 hours
- [EUDI Wallet Data Deletion](/insights/engineering/eudi-wallet-data-deletion-requests/): The wallet's dashboard routes the erasure tap as a GDPR Article 17 request and nothing more - the one-month deadline, the two narrow retention exceptions, the Article 19 duty to notify every recipient and the free-of-charge rule all come from Regulation (EU) 2016/679 and land on the relying party as controller, since the wallet provider is designed to hold no insight into the transaction
- [EUDI Wallet Onboarding](/insights/engineering/eudi-wallet-pid-attributes-onboarding/): Table 1 of the Annex to CIR (EU) 2024/2977 guarantees only five person identification data fields, family_name, given_name, birth_date, birth_place and nationality, against fourteen more left optional - and a Member State that does not know a mandatory field's true value substitutes one appropriate to the situation with no flag marking the substitution, so a populated field proves presence and never proves truth
- [NDC API Integration](/insights/engineering/ndc-api-integration/): NDC replaces the fare-and-PNR model with an Offer and Order message set open to any implementer without IATA membership, and the aggregator-versus-direct choice decides who carries the last-Distributor obligation to populate that chain data correctly
- [Booking Engine Development](/insights/engineering/booking-engine-development/): a flight booking engine runs as six distinct states (search, price, hold, order, ticket and service) - order creation alone can take up to 120 seconds so the client needs a timeout of at least 130 seconds plus a reconciliation path instead of a blind retry
- [Hotel Channel Manager Integration](/insights/engineering/hotel-channel-manager-integration/): a BookingLimit write above 255 gets silently clamped to 254 rather than rejected, so the fix is a reconciliation job that diffs PMS state against the last confirmed channel write on the platform's own clock rather than retrying the call
- [AI Travel Agent Development](/insights/engineering/ai-travel-agent-development/): a travel agent's tool calls must re-fetch and re-confirm a live offer before completing an order rather than trust the price a conversation started with, and we run five sequential checks with concrete pass criteria before launch rather than judging readiness on vibes
- [Tour Operator Software Development](/insights/engineering/tour-operator-software-development/): a reservation system migration has to encode two Package Travel Directive rulesets at once, the 2015/2302 duties binding today and the 2026/1024 amendment applying only from 29 March 2029, and a parallel run with a hard divergence stop rule catches allotment logic the two systems disagree on before cutover
- [Travel Software Development](/insights/engineering/travel-software-development-2026/): a platform-level guide to travel software types, the build-versus-buy decision and the cost drivers that determine which route a travel business should take
- [Bordereaux Reporting](/insights/engineering/bordereaux-reporting/): Lloyd's Coverholder Reporting Standards Version 5.2 mandate the data set, not the platform - risk, premium and claims bordereaux as an extraction, mapping, validation and re-submission pipeline with ten validation field groups, DDM listed as an elective LIMOSS service
- [GPSR Online Marketplaces](/insights/engineering/gpsr-online-marketplaces/): What a provider of an online marketplace implements under Regulation (EU) 2023/988 Article 22 - the four listing information blocks, the Safety Gate contact point, orders acted on without undue delay and in any event within two working days, the recall notice elements and the trader suspension rule, mapped to software behavior and an evidence log
- [UKGC Technical Standards](/insights/engineering/ukgc-technical-standards/): The Gambling Commission's seventeen remote technical standards read as platform behavior, with the test house versus licensee testing route per standard from the testing strategy, the ISO/IEC 27001:2022 Annex A security controls with their audit clocks, GAMSTOP checks and the MGA system audit compared
- [CBAM Annual Declaration](/insights/engineering/cbam-annual-declaration/): The authorized declarant's annual declaration as a data model under the consolidated CBAM Regulation - goods by CN code and the 50 tonne de minimis rule, embedded emissions on actual or default values, verification, certificate sale, surrender, quarterly holding, repurchase and cancellation as rules, the registry modules, with every calendar date in one snapshot table
- [OpenADR Integration](/insights/engineering/openadr-integration/): Wiring OpenADR 3 into a charging or energy platform - the platform as the VEN behind OAuth, programs, events, reports and subscriptions, event intervals mapped to OCPP 2.0.1 SetChargingProfile schedules, an outage fallback the standard leaves to the platform and a certification that tests only the VTN to VEN interface
- [OPC UA Integration](/insights/engineering/opc-ua-integration/): OPC UA integration for an MES or IIoT platform as four decisions - companion specification or custom information model, decoding structure types without silent loss, MonitoredItem queue and interval sizing against a server that revises what you ask for, and certificate trust lists and roles administered before code - with a decision table and the client/server versus PubSub choice per leg
- [Pipeline Leak Detection Software](/insights/engineering/pipeline-leak-detection-software/): Computational pipeline monitoring under 49 CFR Part 195 - the 195.2 definition, the 195.134 design and 195.444 operating duties that point at API RP 1130, the seven method families the regulator restates, the sensitivity versus false alarm trade with no numerical threshold in the rule, alarm management as a regulated activity under 195.446, and the CPM engine beside SCADA
- [Crew Rostering Software](/insights/engineering/crew-rostering-software/): What a crew rostering engine computes under EASA Subpart FTL as consolidated in the Easy Access Rules - acclimatization state and reference time selecting the FDP table, the three duty limits as rolling windows plus the calendar-year flight time aggregate, rest, standby and reserve on separate counters, commander's discretion as an exception, and a duties-and-rest data model with replayable verdicts
- [LTI Advantage Integration](/insights/engineering/lti-advantage-integration/): The platform role of LTI 1.3 and LTI Advantage in a custom LMS - the OIDC login the platform issues, JWKS publication and key rotation, state and nonce roles, the client credentials service token, Deep Linking, Assignment and Grade Services and Names and Role Provisioning as endpoints the platform exposes, Dynamic Registration as a Candidate Final companion, and the Complete certification level required of learning platforms
- [ISOXML Integration](/insights/engineering/isoxml-integration/): How ISO 11783-10 task data reaches a farm platform and comes back - the two transfer directions, the task data container and its element families, the ISO 11783-11 dictionary kept as a registry on isobus.net, AEF task controller functionalities and what a certification warrants, the ADAPT framework route with its maintenance status, and the folder-structure and file-naming failures the AEF names as the most reported
- [IFC Data Integration](/insights/engineering/ifc-data-integration/): IFC data ingestion for a construction platform - which encoding to accept, how the spatial tree is discovered, what entity identity is keyed on, where properties and quantities live, validating uploads with IDS and placing two models against each other, with each decision opening a specific failure mode
- [eSIM Provisioning Integration](/insights/engineering/esim-provisioning-integration/): eSIM provisioning from SM-DP+ to the eUICC on a connectivity platform - the provisioning step sequence and what fails at each one, the activation code entry points on Android versus iOS, the profile lifecycle and the identifiers keyed on, testing before subscriber exposure
- [FIT File Ingestion](/insights/engineering/fit-file-ingestion/): FIT file ingestion from sport and fitness devices on a platform - the binary message structure and which messages a platform needs, the FIT epoch offset constant for timestamp conversion, handling corrupt and truncated uploads, deduplication on re-upload and what to store beside the raw file
- [HACCP Software Requirements](/insights/engineering/haccp-software-requirements/): HACCP software requirements for a food or restaurant platform - modeling a plan as a data model with hazards and process steps, critical limits with version history, monitoring records carrying person and device, corrective action as a workflow with states and retention as a rules engine
- [TCF Consent String](/insights/engineering/tcf-consent-string/): TCF consent string decoding for a marketing or adtech platform - three version counters that are not the same number, purpose bitfields indexed from zero while purposes are numbered one through twenty-four, vendor list pinning to the string version and determining platform actions from consent values
- [RESO Web API Integration](/insights/engineering/reso-web-api-integration/): RESO's own wiki defines ListingKey as a local key scoped to the system that issued it, not the durable cross-system identifier most integration plans assume - the ten decisions a RESO Web API integration gets wrong on the second MLS, from ModificationTimestamp polling against the EntityEvent alternative to what a RESO certified server actually promises to expose
- [Secure HLS Delivery](/insights/engineering/secure-hls-delivery/): RFC 8216 spends exactly one sentence on protecting an HLS decryption key and says nothing about who may ask for one - the key request as an authorization decision, signed manifests against signed segment URLs, CDN caching rules that can silently leak a key response and where AES-128 stops helping and a licensed DRM system takes over
- [CAMARA Network API Integration](/insights/engineering/camara-network-api-integration/): CAMARA Location Verification answers TRUE, FALSE or PARTIAL rather than a plain boolean, and a SIM Swap null can mean the operator would not disclose a date rather than no swap occurred - the four CAMARA network APIs a product team actually integrates, the identity and consent layer behind all of them, and an error model that treats its own published codes as incomplete by design
- [Battery Passport Data Model](/insights/engineering/battery-passport-data-model/): Article 77 of the EU Batteries Regulation requires an electronic record for LMT, industrial and electric-vehicle batteries - why one passport belongs to one battery instance rather than one model, how three access tiers become an authorization matrix, and where custody of the record moves across a battery's life
- [IATA One Record Integration](/insights/engineering/iata-one-record-integration/): ONE Record replaces sending a shipment record with publishing it once and granting access by URI, revocable at any time - the logistics ontology and where its class hierarchy actually breaks, the API surface from creation to audit trail, subscriptions and access delegation, and the version and vocabulary conflicts a real integration hits inside the specification itself
- [OpenXR Cross Platform Development](/insights/engineering/openxr-cross-platform-development/): OpenXR standardizes the interface between an XR application and a device runtime but leaves reference spaces without a shared origin across devices - core versus extension capability detection, action-based input as the real portability unit across interaction profiles, the runtime, loader and API layering, Unity, Unreal and Godot engine support, and visionOS as the separate path
- [Legacy Data Migration Strategy](/insights/engineering/legacy-data-migration-strategy/): Two writes to two databases can silently diverge, and a transactional outbox replaces the second write with a relayed event that the target applies idempotently - inventory and profiling before choosing a sync method, big bang against outbox-based trickle and log-based CDC, reconciliation tiers, rehearsals, rollback triggers and sign-off, and the failure modes worth planning for
- [NFT Metadata Storage](/insights/engineering/nft-metadata-storage/): A CID is a content-addressed identifier, not a URL, so a gateway going offline breaks retrieval without breaking the token's on-chain integrity - the five ways to store NFT metadata scored against a decision matrix, the tokenURI and metadata JSON schema, frozen metadata against reveals and the EIP-4906 update event, and the failure modes of pin loss, gateway shutdown and mismatched media types
- [Insurance Rating Engine](/insights/engineering/insurance-rating-engine/): A rate filed under prior approval and a rate filed under file-and-use follow different regulatory clocks before either can reach a policyholder - the core components of a rating engine, what SERFF does, the excessive, inadequate or unfairly discriminatory standard, effective-dated rate versions for new business against renewal, the rating trace, and parity and regression testing through change management
- [dApp Wallet Connection](/insights/engineering/dapp-wallet-connection/): EIP-6963 adds race-free wallet discovery beside the shared window.ethereum global, and a smart-account signature is verified through ERC-1271 or the ERC-6492 wrapper for undeployed accounts rather than ecrecover - EIP-1193 as where a connection begins, WalletConnect Sign for mobile, SIWE session identity with nonce and domain binding, EIP-5792 capability detection and what EIP-7702 delegation changes for a dApp
- [Payment Reconciliation Engine](/insights/engineering/payment-reconciliation-engine/): A payment reconciliation engine proves that every ledger movement also happened at the bank and, where a PSP carried it, at the PSP - normalizing bank, PSP and ledger legs into one event model, matching on references before tolerances, posting fees and chargebacks separately and turning every unexplained difference into a typed break with an owner
- [Carrier Integration Layer](/insights/engineering/carrier-integration-layer/): The layer between a logistics platform and its carriers maps generic parcel API statuses, LTL EDI 214 status messages and DCSA Track and Trace events onto one canonical shipment event model, with per-carrier adapters, idempotent handling of duplicate and out-of-order events and detection of shipments that stop reporting
- [Driver Location Tracking](/insights/engineering/driver-location-tracking/): A driver location tracking system carries a phone's location fix to the rider's map and the dispatch index through background limits on Android and iOS, sampling by driver state, an H3 cell index and map matching, closing with what the EU Platform Work Directive means for collection and human review
- [OBD-II Data Access](/insights/engineering/obd-ii-data-access/): A vendor-neutral comparison of the four ways a fleet or app platform gets vehicle data - dongle PIDs under SAE J1979, J1979-2 OBDonUDS vehicles, OEM connected-car APIs and raw CAN logging with DBC decoding - with a criteria matrix, dongle security controls and the EU Data Act rule on who may ask for vehicle data
- [Aircraft Maintenance Records](/insights/engineering/aircraft-maintenance-records/): EASA sets no single retention period for aircraft maintenance records - mapping each record class under Part-M, Part-145 and Part-CAMO to its rule, holder and clock, then turning the rules into build requirements for append-only corrections, CRS records bound to an identifiable signatory and exports that carry every clock through a change of operator or CAMO
- [LDAR Software](/insights/engineering/ldar-software/): Leak detection and repair software built around the first repair attempt within 5 days and completion within 30 days, with survey intervals set by pipe material and component records keyed to the P&ID
- [IBM i Insurance Integration](/insights/engineering/ibm-i-insurance-integration/): Integrating IBM i policy systems with modern platforms - PCML has no Date type so effective dates cross as text, IWS REST over RPG programs and journal-based change data capture
- [Popularity Bias in Recommender Systems](/insights/engineering/popularity-bias-in-recommender-systems/): Measuring popularity bias from serving logs with exposure Gini and lift, why no cited source sets an absolute threshold, re-ranking first and the DSA Article 38 context
- [Payment Orchestration Retry Logic](/insights/engineering/payment-orchestration-retry-logic/): Which declines can be retried or cascaded, why Category 1 declines cannot, answering SCA soft declines with a step-up and idempotency keys per intent and attempt
- [ML Model Rollback](/insights/engineering/ml-model-rollback/): Rolling back an ML model with a pinned manifest - rollback versus rolling through versus retraining, PSI cutoffs calibrated by batch size and rehearsal from the manifest
- [Build Operate Transfer](/insights/engineering/build-operate-transfer/): Build operate transfer for a Kyiv team - why the Acquired Rights Directive and TUPE stop short, the consent, share deal or Article 36-1 routes and the IP assignment chain

## Key Facts
- Founded: 2013
- Team: 90+ engineers
- Projects delivered: 110+
- Clients: 200+
- Clutch rating: 5/5 (107 reviews, 2026)
- Offices: Las Vegas NV, Kyiv Ukraine
- CTO: Dr. Dmytro Nasyrov, PhD in AI, 23+ years experience
- AI Scientific Advisor: Victor Sineglazov, D.Sc., Professor of Artificial Intelligence, Igor Sikorsky Kyiv Polytechnic Institute
- FinTech and AI Scientist and Advisor: Olena Zaichenko, D.Sc., Professor of Mathematical Methods of System Analysis, Igor Sikorsky Kyiv Polytechnic Institute

## Contact
- Website: https://pharosproduction.com
- Email: hello@pharosproduction.com
- Phone US: +1 (702) 359-6297
- Phone UA: +380 (99) 776-2791
- LinkedIn: https://www.linkedin.com/company/pharos-production-web3-software-development
- GitHub: https://github.com/PharosProduction