What shapes a software project in the United States
The United States regulates software indirectly, through the data it holds, the people it serves and the money it moves. Which rules reach your system depends on your states, your sector and your customers.
| Topic | What it means for your system | Decide early |
|---|---|---|
| Privacy by state | Around twenty states had comprehensive consumer privacy laws in effect when this page was reviewed, led by California, with more scheduled. Each gives residents rights to see, correct and delete their data, and each sets thresholds for which businesses are covered | Which states your users live in, and whether you meet each law's thresholds |
| Sector rules | Health information handled for providers and insurers falls under HIPAA, financial institutions follow the Gramm-Leach-Bliley Act, student records fall under FERPA and services for children under 13 fall under COPPA | Whether the system touches any of these kinds of data |
| Accessibility | Courts and the Department of Justice treat the websites and apps of businesses open to the public as covered by the Americans with Disabilities Act, and WCAG at Level AA is the working standard. State and local governments have dated deadlines of their own | The WCAG version you will build to, and how it will be tested |
| Sales tax | Each state decides whether software and digital services are taxable, and a seller can owe tax in a state where it has customers but no premises | Whether a tax service calculates every invoice |
| Payments and signatures | Cards dominate consumer payments, while businesses pay each other by ACH bank transfer and, increasingly, over real-time networks. Electronic signatures are valid under federal and state law | Which payment and signature services the system connects to |
| Text messages and calls | Federal law requires consent for automated texts and calls, and carriers ask businesses to register their brand and message types before an application sends texts | What the system sends, and who registers it |
| Security reviews | Larger customers send security questionnaires and often ask for an audit report such as SOC 2. That is a market expectation, not a statute | Which controls and records the system must be able to show |
Workflows we build for American businesses
Four systems in which the American details decide the design.
Customer onboarding with e-signature
For lenders, insurers, property managers and service firms that sign agreements remotely.
- Application completed online
- Identity and details checked
- Agreement signed electronically
- Bank account linked for ACH
- Account opened
- Welcome message sent with consent on file
Field service across state lines
For companies whose crews, customers and tax rules span several states.
- Job booked by phone or web
- Crew dispatched from the nearest branch
- Work recorded on a tablet
- Tax worked out for the job's location
- Invoice emailed
- Paid by card or ACH
Trade ordering portal
For distributors and manufacturers that take repeat orders from business accounts.
- Buyer signs in to a company account
- Contract prices shown
- Order placed against payment terms
- Order passed to the ERP
- Shipment tracked
- Invoice settled by ACH
Patient or client intake
For practices that still collect forms on paper at the front desk.
- Forms sent before the visit
- Completed on a phone
- Insurance details captured
- Staff review the exceptions
- Record created in the practice system
Where a system handles protected health information, a business associate agreement is needed with each vendor that touches it. We develop against test data, so real records stay with you until those agreements are in place.
What we build
Line-of-business applications
Systems for sales, operations, service and finance teams, shaped around your process instead of a vendor's template.
Privacy request tools
Screens and logs that let your staff find, export, correct and delete one person's data when a state law gives them that right.
Accessible interfaces
Design and code checked against WCAG with automated scans and with manual testing by keyboard and screen reader.
Integrations
Links to your ERP, CRM, payment processor, tax engine and e-signature service, built on their published APIs.
Audit-ready engineering
Access control, logging, encryption and change records arranged so the evidence a security audit asks for comes straight from the system.
Modernization
Step-by-step replacement of aging systems while the business keeps running. See legacy software modernization.
What we need from you
- The states you operate in and sell to
- Your counsel's view on which privacy and sector laws apply
- Access to the systems to be connected, or to their owners
- Any security questionnaire a customer has already sent you
- A product owner with authority over scope
Ownership and licensing terms are defined in the project agreement.
A readiness checklist for a US project
Before development starts
0 of 7 checkedWhat to do next
Tell us what the system has to do, which states and sectors it serves and what it must connect to. We will come back with an approach and the decisions to take first. Start a conversation or book a 30-minute call.
Weighing an outside team against hiring? Our comparison of in-house development and a studio sets out when each makes sense.
Common questions
Which privacy laws apply to our software in the United States?
It depends on who your users are and what data you hold. There is no single federal privacy law. Around twenty states have comprehensive laws, each with thresholds that decide which businesses are covered. Sector laws apply regardless of size to health, financial, student and children's data. The Federal Trade Commission also acts against companies whose practices do not match their privacy promises. Your counsel confirms the list, and we build the controls.
Does the ADA apply to our website or app?
If your business serves the public, assume it does. The Department of Justice's position is that the Americans with Disabilities Act covers online services, and private lawsuits over inaccessible websites are common. No regulation sets a technical standard for private businesses, but WCAG at Level AA is what courts, settlements and buyers refer to. State and local governments have a formal rule with compliance dates.
Do we need a SOC 2 report?
No law requires one. It becomes necessary when customers ask for it, which is common once you sell software or services to larger companies. The report comes from an independent auditor who examines your company's controls over a period. Software can make that audit far easier by producing access logs, change records and backups as a matter of course. We build with those requirements in view, and the audit itself is yours to arrange.
How should our software handle sales tax across states?
Record where each customer is and let a tax service work out the rest. Every state sets its own rules on whether software and digital services are taxable, and a seller can owe tax in a state where it has enough sales, even with no premises there. Hard-coding rates does not hold up, because rules and rates change. Your accountant decides where you register, and the system applies the result on every invoice.
Where to go from here
Related serviceCustom Software DevelopmentSoftware that fits the process you already run