MVP development: live in 6–12 weeks, on a stack you can keep building on

First, three terms that often get mixed up: a clickable prototype shows what a product could look like, but it stores no data. A proof of concept tests whether something is technically feasible, such as an AI feature working with your data. An MVP (minimum viable product) is the smallest product that customers can use with real data and pay for.

Why startups fail: CB Insights looked at why venture-backed startups have shut down since 2023. For 385 of them, the cause could be identified, and for 43% of those, weak product-market fit was among the reasons (multiple reasons possible; CB Insights, March 2026).

An MVP shows you early on whether the market wants your product: do customers use it, do they come back, and do they pay? There are four routes to that answer, and not all of them lead to us.

Sources for the table: Lovable on plans and credits, data export and hosting and ownership; freelancermap on hourly rates for software developers (in German). Our prices exclude VAT and are as of October 2026.

Before you choose a route, answer one basic question: if you want to digitize an existing process inside your company, you need custom software. If you want to find out whether customers will use and pay for a new product, you need an MVP.

Not sure an MVP is what you need? If you want your customers to log in and pull up orders, documents or invoices themselves, see customer portal development. If a legacy system is holding you back and you want the new product to grow alongside it, software modernization is the better route. If you want the product in the App Store and Google Play, web app development explains how to get there.

If you want AI to handle tasks in your own operations, start with AI consulting. If you need existing systems to exchange data without manual work, that's a job for process automation. And if you're building a new product alongside a Java core system, Two-Speed IT in Practice describes the setup.

We quote the fixed price after the concept check, a paid 1–2-week discovery phase. It applies to a clearly defined scope, and we lay that scope out here so you can compare quotes. All prices in this section exclude VAT and are as of October 2026.

Base scope from €8,000: the smallest scope that lets customers use your product while you measure what they do. It includes email login, one complete core workflow for one user group and a test environment. Tracking counts four steps: first click, sign-up started, sign-up completed and first real use. That shows you where prospects drop off.

Operations and handover: application and database run on EU servers, with daily backups. We test the restore once and document it, because a backup that has never been restored is not a backup. The handover includes a meeting, a short runbook and a roadmap for the build-out. Repository and provider accounts are in your name from the start.

Up to €20,000: we add one integration. Your product then reads data from another system, such as a CRM, or processes payments through a standard provider like Stripe. Each business customer gets its own organization, and Postgres keeps their data apart with access rules at the database level (Row Level Security, or RLS). The MVP goes live in 6–12 weeks, concept check included.

Why payments fit this budget: writing data into someone else's system requires error handling, retry logic and testing against a live system nobody will let you experiment on. For payments, a standard provider like Stripe offers a test mode and a documented flow. An integration that writes into your ERP, by contrast, belongs in the build-out stage.

Organization or tenant? In the MVP, each business customer is an organization within the same application, separated by RLS. We only call it multi-tenancy once each tenant gets its own isolated data and its own roles. A platform like that is a separate project: we quote it at a fixed price after a requirements analysis, as described on our custom software page.

Available as an add-on: the enterprise package adds single sign-on (SSO) via SAML, connected to an identity provider such as Microsoft Entra ID. It also includes the documents your customers' procurement teams typically ask for, from the deletion policy to the list of subprocessors. It is billed on time and materials, typically 1.5–3 person-days for the whole package with one identity provider. Details follow further down, under “Ready for enterprise security questionnaires.”

Fixed price after review: we quote an AI feasibility test or the takeover of an existing prototype at a fixed price once we've seen the data or the code.

Twelve items quotes often leave out

The list comes from our article on software costs: these items are regularly missing from quotes, and you end up paying for them anyway. The article also says: “A quote without a list of what is not included is not a quote. It is an entry price.” The table shows how we handle each item (prices excl. VAT, as of October 2026).

For us, an MVP isn't a throwaway prototype; it's the first version of your product. We build with Next.js and Supabase, which means Postgres with access rules at the database level (RLS) from day one. Later stages usually extend that foundation instead of starting over: you only pay for it once. The exceptions follow below.

Our article Migrating from Firebase to Supabase sums up in one sentence what makes a later rebuild expensive: “What blows up projects is the data model.” That's why we sketch the data model during the concept check, including the parts that only come after the MVP.

For login, product MVPs start with Supabase Auth. A product that may be discontinued after the measurement phase doesn't need its own identity server that someone has to maintain and monitor. That saves running costs for as long as it's unclear whether the product has a future.

Keycloak comes in once you have requirements that Supabase Auth doesn't cover. There are four typical cases: a direct connection to LDAP or an on-premises Active Directory, including group sync; your product acting as a SAML identity provider for other systems; tenants with their own login page and admins; and running the product in your own data center.

If you know from the start that one of these cases applies, we include Keycloak from day one. It isn't part of the base scope; the fixed-price quote after the concept check includes the cost. If Keycloak only comes in later, the switch happens at the front door, not in the foundation: database and access rules stay unchanged, as Is Supabase Auth Enough? shows.

Usually no rebuild—with three exceptions

A major pivot: if the numbers show that customers want a different product, the data model often no longer fits either. In that case, we rebuild, based on what the numbers have shown.

SSO added late: when someone with a password account signs in via SSO for the first time, Supabase creates a second account with the same email address. The accounts are not merged automatically: you need a dedicated function to move data and permissions over. If you know early on that business customers are coming, plan for SSO from the start.

Taking over someone else's prototype: we review code from an AI app builder or another team first. The fixed-price quote then states whether we continue it or rebuild parts of it.

Ready for enterprise security questionnaires

Often your very first business customer sends a security and data protection questionnaire. The technical basis is in place from day one: access rules at the database level, EU servers for application and database, daily backups. With the optional enterprise package, you have the answers ready before procurement asks:

Single sign-on (SSO): your customer's employees sign in with their existing work account, for example from Microsoft Entra ID (formerly Azure Active Directory) or Okta. Under the hood, this uses SAML 2.0 through Supabase Auth.

Technical documentation: a description of the technical and organizational measures (TOMs), a deletion policy, a sketch of the data flows and an overview of which role can see and change what. You also need the TOMs description as an annex to the data processing agreements (DPAs) you sign with your customers.

Subprocessors: we list every service we use, with its registered office and data location, including payment providers such as Stripe and the email service. The Supabase data processing addendum, including the EU Standard Contractual Clauses, applies automatically to all customers; you don't need to sign anything separately. If you subscribe to the notifications, you hear about changes to Supabase's subprocessor list at least 30 days in advance.

Log data: we document which usage and log data the system collects. Data protection officers ask about this, and in Germany, your customer's works council often does too.

Certifications: an MVP has no certification of its own. Supabase is audited for SOC 2 Type 2 and certified to ISO 27001. You only get the report and the certificate on the Team plan or higher, which starts at $599/month (as of October 2026).

Data location: application and database run on EU servers, either in Supabase Cloud in the Frankfurt region or self-hosted in Germany. However, Supabase runs all regions on AWS. Under its terms of service, your contract is with a Singapore-based entity and is governed by California law. So we can't rule out access under the US CLOUD Act; we can only reduce the risk, for example by self-hosting in Germany.

During the concept check, we decide together which hosting route suits your customers. We don't give legal advice: we provide the technical documentation for your data protection officer or legal counsel.

Trust is a lot to ask for a first project. That's why you can check four things before you commission the MVP, and a fifth from day one of the project:

Published prices: the price ranges for the concept check, MVP, support and build-out are on this page, excl. VAT and dated. So you know the ballpark before we talk.

Eleven questions: check our fixed-price quote against the eleven questions for your quote from our article on software costs. Every question a vendor can't answer in two sentences is a cost risk, and that applies to us too.

Documented technology choices: three articles explain, with sources, why we recommend Supabase and Keycloak: Is Supabase Auth Enough?, What Does Keycloak Really Cost? and Supabase or Firebase. The third also shows when Firebase is the better choice.

A small first engagement: the concept check takes 1–2 weeks and costs €1,500–3,000 excl. VAT (as of October 2026). Afterwards, you know how we work, and you have a project brief and a fixed-price quote. You can compare that quote with others before you decide on the MVP.

Repository in your name: the source code belongs to you, and the repository is in your name from the start. That way, you can follow every change yourself instead of seeing the result only at handover. You don't have to trust us blindly: you can check at any time.