Sotto Software

Software that works quietly underneath.

Custom systems, and a firewall that listens first.

Our first product

Vigilance

A web application firewall for PHP sites, on your own server.

It sits between nginx and PHP. It installs with one pasted command, and one command takes it out again.
It starts by listening. A new install records what it would have refused, and you decide, site by site, when it starts refusing.
What it records never leaves your server. We receive its licence and the counts we bill by, and we never connect to it.

"Security is a lifestyle, not a project."

Early access

From the blog

22 October 2026

We put Vigilance in front of PHP2Shell an hour before PHP's fix

All posts

Custom software

Web applications and internal tools

The system your staff use all day. Built for the work as it is actually done, not as an off-the-shelf product assumes it is done.

The load-bearing parts

Billing, authentication, data models, deployment. Unglamorous, rarely demonstrated, and the first thing to take a business down when it is done carelessly.

Integrations between systems that were never meant to speak

The accounting package, the warehouse, the vendor portal, the spreadsheet somebody's whole department depends on.

How we work

We hold only what the work requires

Every piece of data we store is a liability we have taken on for you. Less of it is a feature, not a limitation.

We do not put our name on your product

No badge in your footer, no script on your pages, no analytics you did not ask for. What we build is yours.

We build to be handed over

Documentation and tests arrive with the work, not after it. You should be able to take it to another developer and have them thank you.

Experience

20+ years building software

Most of it the kind that runs unattended — systems that outlived their launch, their framework, and occasionally the company that commissioned them.

Request a quote

Tell us what you are building.