Skip to content

Senior Laravel, DevOps and mobile engineering. Secure by default.

We design, build and run business-critical web and mobile systems for companies across the EU and the US. A senior nearshore team in Zagreb since 2013, with a security review built into every delivery.

  • Offensive Security certified
  • In business since 2013
  • 1,170+ projects delivered
  • EU company, EUR or USD invoicing
Trusted by teams in tourism, retail, publishing and hosting Galileo Travel Maskice.hr xHosting.hr Čitaj knjigu Chili Tours Technostore World Dog Finder
What we do

Four disciplines, done properly.

We do not do everything. We go deep on the four things every serious product needs, and we have done each of them for over a decade.

Laravel & PHP engineering

Custom web applications, e-commerce and ERP systems on Laravel 12 and PHP 8.4, built modular so they stay maintainable for years.

  • TALL stack: Livewire 3, Alpine, Tailwind, Filament admin panels
  • REST APIs and integrations: payments, ERPs, shipping, banks
  • E-commerce with fiscalization and EN 16931 e-invoicing
  • Upgrades: PHP 7.x to 8.4, Laravel 5 to 12, vendor takeovers
  • Performance: queues, caching, Meilisearch, Octane

DevOps & managed infrastructure

Servers, pipelines and monitoring for the systems we build and the ones you already run. Hetzner, DigitalOcean and our own hardware, kept patched.

  • Linux builds, hardening and monitoring with on-call response
  • Docker, CI/CD pipelines, zero-downtime deploys
  • Backups with tested restores and recovery plans
  • Mail servers, DNS, Cloudflare, TLS
  • Proxmox, Ceph and ZFS for private clouds

Mobile apps with React Native & Expo

Cross-platform iOS and Android apps that share one TypeScript codebase with your web platform, shipped through EAS and the app stores.

  • Expo SDK 55 and the New Architecture
  • Biometric auth, secure storage, offline-first sync
  • Push notifications, deep links, camera, payments
  • Migration of older React Native apps to Expo
  • App Store and Google Play release management

Application security

Penetration testing and secure development for web and mobile applications, done by engineers who also build them. Certified by Offensive Security.

  • Web and mobile penetration tests (OWASP ASVS and MASVS)
  • Secure code review for Laravel and React Native
  • Dependency and supply-chain audits
  • Hardening of servers, headers, auth and sessions
  • Reports your developers can act on, retest included
Security

Security is in our name, not in an upsell.

Our tagline has read Quality, Technology, Security since 2013. In practice it means the people who write your code are the same people who try to break it before anyone else can.

How we test

Credentials

  • Offensive Security certified Penetration testing by a certified engineer on the core team.
  • Thirteen years of production systems E-commerce, invoicing and booking platforms that handle money and personal data every day.
  • GDPR by default Data processing agreements, EU hosting and documented retention on every project.

Every delivery includes

  • Pre-launch penetration test with a written report
  • Dependency and package audit (Composer, npm)
  • Hardened server configuration and TLS
  • Backup and restore test
  • Access review: 2FA, least privilege, secrets out of the repository
Tested against OWASP ASVS OWASP MASVS OWASP Top 10 CIS Linux benchmarks GDPR EN 16931
Selected work

Systems that run businesses.

A few of the platforms we built and still operate.

Galileo Travel
Travel agency, Croatia
2024 to today

Booking platform for group and school trips

A booking system where every trip can carry deposits, mandatory extras and taxes, separate child and adult prices, room limits and a choice of payment methods. Offers, bookings and invoices come from the same data.

LaravelLivewireMySQLFiscal invoicingManaged hosting
  • Offers, bookings and invoices in one system
  • Runs on our managed infrastructure with a care plan
Maskice.hr
Retail e-commerce, Croatia
2016 to today

One application for the whole business: web shop, warehouse, stores and vending machines

A single Laravel platform runs the company: web shop, warehouse and stock, a React point-of-sale app in the stores, Maksomat vending machines, invoicing and reporting. Over a million product-to-device compatibility links keep the catalog accurate on every channel.

LaravelReact POSMeilisearchFiscalizationVending integrationManaged servers
  • Web, stores and vending machines sell from one stock
  • 1,000,000+ product-to-device compatibility links
  • Servers, POS and e-invoicing operated by us
Extreme Fiscalization 2.0
Own product, Croatia and EU
2025 to today

E-invoicing platform for the 2026 Croatian mandate

Issuing, receiving and archiving EN 16931 UBL e-invoices with B2B and B2G exchange, Croatian fiscalization (JIR and ZKI), POS integration and a REST API for ERPs and web shops. Inbox and outbox processing run unattended.

LaravelUBL 2.1EN 16931REST APIQueue workers
  • Automated inbox and outbox processing
  • Integrated into web shops, POS and ERPs
xHosting.hr
Hosting brand, Croatia
2016 to today

Managed hosting, VPS and business e-mail

Our own hosting brand: customer panel, billing, provisioning and mail, running on servers we administer in EU data centres and our own rack.

LaravelLinuxProxmoxMail serversDNS
  • In-house provisioning and recurring billing
  • Own mail and DNS infrastructure

Over 1,170 projects since 2013 across tourism, retail, publishing, hosting and finance.

All case studies
Working together

Three ways to engage.

All three come with a senior engineer on the other end and an EU contract.

Dedicated senior engineer

For teams that need capacity now

One of our seniors joins your team for 80 to 160 hours a month. Your repository, your process, our engineering.

from €680 per day billed monthly, EUR invoice, no recruitment fee

  • Weekly planning with your lead
  • Direct Slack or Teams access
  • Monthly report of work and hours
  • Two-week notice on either side
Check availability

Fixed-scope project

For new products and rebuilds

A short discovery, then a fixed quote with milestones. Delivered with a penetration test and documentation.

projects from €8,000 fixed price after discovery

  • Discovery workshop and written scope
  • Fixed price and timeline
  • Security test before launch
  • 30-day warranty after hand-over
Start with discovery

Care plan

For systems already in production

Monitoring, patching, backups and a response time you can rely on, for Laravel apps, servers and mobile apps.

from €400 per month per system, cancel with 30 days notice

  • Monthly security updates
  • Uptime and resource monitoring
  • Response within one business day
  • Hours bank for small changes
Get a care plan

Prices are indicative and exclude VAT. EU companies with a VAT ID are invoiced with reverse charge; US clients receive USD invoices. Fixed quotes follow a discovery call.

Tools

The stack we build and run.

Back-end

PHP 8.4Laravel 12Livewire 3FilamentMySQLMariaDBRedisMeilisearchQueue workers

Front-end

Tailwind CSSAlpine.jsReactInertiaTypeScriptVite

Mobile

React NativeExpo SDK 55EAS BuildTypeScriptExpo Router

Infrastructure

DebianUbuntuDockerNginxProxmoxCephZFSHetznerDigitalOceanCloudflare

Security

OWASP ASVSOWASP MASVSBurp Suitenmapdependency audits2FA everywhere

Compliance

GDPREN 16931UBL 2.1PeppolCroatian Fiskalizacija 2.0ZUGFeRD
Questions

Before you get in touch

Can we hire you from the US?

Yes. Extreme IT d.o.o. is a Croatian company in the EU. We contract business to business, invoice in EUR or USD, sign NDAs and data processing agreements, and overlap with US East Coast mornings. Croatia is on Central European Time, six hours ahead of New York.

Do you work as a nearshore team for companies in Germany, Austria, the Netherlands or the UK?

Yes. Croatia is in the EU and on Central European Time, so we share working hours with DACH and Benelux and are one hour ahead of the UK. Contracts and invoices are EU business to business, in EUR, with reverse-charge VAT where it applies.

Who actually does the work?

Senior engineers who have been with the company for years, including the founders. No outsourcing and no juniors learning on your project.

Do you take over existing codebases?

Regularly. We start with an audit of code, infrastructure and security, then agree on a plan: stabilise first, upgrade second, new features once the base is solid.

Who owns the code and the accounts?

You do, from day one. We work in your repositories and cloud accounts whenever possible, and hand over everything if we ever part ways.

How fast can you start?

A dedicated engineer can usually start within two weeks. Projects begin with a discovery call this week and a written scope a few days later.

Tell us what you are building.

A 30-minute call is enough to tell you whether we are the right team and roughly what it would cost.