Blog23 articles · 4 topics

What we learn building custom software

Every article comes out of a project we shipped — with the number, the decision, and what did not work. No second-hand theory.

The latestChoosing and buying custom software

How your company gets recommended by ChatGPT and Google's AI answers

ChatGPT and Google's AI answers recommend the company that has the answer written on its own site and confirmed by third parties, in reviews, directories and lists. You can't pay your way into the answer, and an llms.txt file on its own changes nothing. On our site, appearances in Google's AI answers went from 262 to 1,482 in eight weeks and a manufacturer 900 km away reached us through ChatGPT, but contact through the site did not grow at the same pace.

Pedro Cunha · CTO at EpicoraNovember 9, 2026 · 19 min read

Read article

Where to start

Two paths, depending on what you want to do

I want to organize and automate my company

Get operations out of spreadsheets, automate what repeats, connect the systems and have the right numbers at hand.

I want to build a software product to sell

Turn an idea or your method into an app or platform: validate it, work out the cost and choose who builds it.

01When an app built on Lovable needs to leave Lovable, and when it doesn't15 min read

Topic 01

Choosing and buying custom software

When building is worth it, when to stay with off-the-shelf software, when to replace a legacy system and what decides the platform of a website. Written for buyers, not for developers.

6 articles

How your company gets recommended by ChatGPT and Google's AI answers

Nov 09, 202619 min read

Nov 09, 2026
19 min read

Why your team stops using the new system and goes back to spreadsheets

A team goes back to the spreadsheet, the notebook or WhatsApp when the new system takes more work than the old way on the task it does every day, not because people resist change. Adoption is decided on the screen of the most repeated action, in what each role sees and in a rollout done alongside the team, and it is measured after launch by the work done in the system, not by logins. At Fitness Academia, the client created all 15 user accounts on its own and entered its targets through December inside the tool.

Nov 02, 202615 min read

Nov 02, 2026
15 min read

Already paying for off-the-shelf software: configure, integrate or build your own

If you already pay for off-the-shelf software and something is missing, you have three ways out, in this order of cost: switch on what the software already offers, integrate around it or build a module alongside it, and build your own system. In one audit we ran, three of a client's four requests already existed in the software they were paying for, switched off. Your own system pays off when the process is what your customers buy from you, and even then it can live alongside the off-the-shelf software instead of replacing it.

Oct 15, 202615 min read

Oct 15, 2026
15 min read

Spreadsheet, off-the-shelf ERP or custom software: the answer is almost always more than one

A spreadsheet, an off-the-shelf ERP and custom software are not competing for the same spot: they sit in different layers of the same operation, and almost every healthy company runs all three at once. The expensive mistake is not picking the wrong one, it is changing layers when you did not have to: at a five-location gym chain the off-the-shelf ERP stayed as the source of every sale, and the custom system simply started reading from it every five minutes. The spreadsheet, in turn, stops working for three objective reasons, and none of them is size.

Sep 17, 202614 min read

Sep 17, 2026
14 min read

Open the topic page

Topic 02

Applied AI, responsibly

Where AI belongs in a serious process, where it does not, and how that boundary is enforced in practice.

9 articles

Prompt injection: what an outside text can make your company's AI do

Any text an AI reads, whether an email, a WhatsApp message, a PDF or a transcribed voice note, can carry an instruction, and that is the first risk on the OWASP list for applications built on language models (LLM01:2025). No prompt can shield the model, because the rule and the attacker's text arrive through the same channel. The defense is to decide what the AI does on its own, what needs approval and what it never does, with the lock in code: at Balcão, the WhatsApp agent reads everything, but it has no way to start a conversation or do anything beyond replying, recording and handing off to a person.

Nov 05, 202617 min read

Nov 05, 2026
17 min read

AI agent on WhatsApp Business: what you pay for, what is free and what changes between the official and an unofficial API

Choosing between the official WhatsApp API and an unofficial library such as Baileys is not only about price: on the official API, Meta's rules shape the service, with a 24-hour window, approved message templates, one integration per number and per-message billing; on an unofficial one those rules disappear and what remains is the risk of the number being banned, because the use breaks WhatsApp's terms. The official API is not just the expensive option, since every number gets 1,000 free replies a month, and the unofficial one is not free. On the WhatsApp customer service platform we run, we operate both and choose client by client.

Nov 04, 202618 min read

Nov 04, 2026
18 min read

Code review with AI: what it catches and what slips through

AI code review is good at logic errors, side effects in other parts of the system and obvious security flaws. It does not catch business rules nobody wrote down, architecture decisions or what only the team knows about production. Across 26 pull requests in our projects, between August and September 2026, it flagged 51 problems before merge, and the largest group was wrong output on screens and reports. It only works when it reviews against the team's written standard, and the merge is always approved by a person.

Oct 29, 202615 min read

Oct 29, 2026
15 min read

How much it costs to put AI to work inside a company system, and what makes the bill go up or down

When AI runs inside a company system, you pay per token, and a customer service conversation costs cents: on Balcão, our WhatsApp customer service platform, triage comes to about R$ 0.15 (roughly US$ 0.03) per conversation. What weighs most is the text the AI rereads on every reply, and prompt caching bills that part at 10% of the price or less; model size comes next, with up to a 100x gap between the largest and smallest model from the same company. The bill also changes when you measure the result: in the simulation of a sales agent, the model that cost four times more brought more leads to the call, and the math by result came out in its favor.

Oct 09, 202617 min read

Oct 09, 2026
17 min read

Open the topic page

Topic 03

Apps and app stores

When a system needs an app, what changes for it to work offline, and the App Store and Google Play rules: account, commission and distribution.

5 articles

Why TestFlight is not a way to distribute your company's app

TestFlight is Apple's testing tool: each build lasts 90 days and then becomes unavailable to whoever installed it, so it cannot be the way your team uses an app every day. The right channel depends on who uses the app. A public app goes to the store; your own team's app goes to the store behind a login the company provides, or ships as a private or unlisted app; an app built for a client company ships as a private app for that organization, on Apple and on Google. Apple's Enterprise Program is not a shortcut: it requires 100 or more employees and is for internal use only.

Oct 22, 202613 min read

Oct 22, 2026
13 min read

When your app pays a commission to Apple and Google, and when it can charge outside the store

An app pays the store a commission when it sells something digital that people use inside it, such as a subscription, content or an unlocked feature; physical services, live consultations between two people and free apps that accompany a paid web system charge outside the store, with no commission. In Brazil, since June 2026, Apple charges 21% plus a 5% processing fee on purchases through its system, and still takes a commission when digital content is paid for outside it. The most expensive mistake is mixing, in the same app, what is exempt with what is not.

Oct 12, 202616 min read

Oct 12, 2026
16 min read

Mobile app or web system: how to decide what goes on the phone

The question is answered per user profile, not for the whole system. An app makes sense for people who work away from a desk and need what only an app does well: keep working with no signal, talk to a device over Bluetooth, use location with the screen off. Whoever manages the system, uses it now and then or arrives through a link stays on the web. In our projects that have an app, the web system keeps doing everything and the app handles only the field work: at Beckers, the technician fills in the report in an Android app and the office reads everything in the web system.

Oct 05, 202616 min read

Oct 05, 2026
16 min read

Who owns the App Store account: you or the company building your app

Owning the app is three things decided in three different places: the code, in the contract; the store listing, in the developer account; and the ability to ship the next version, in the signing certificates — and whoever controls the account controls the product. What matters isn't which account the app is born in, but which account it ends up in, whether yours started being opened on day one, and whether the migration is a planned step in the contract. We've run that full cycle: the transfer preserves ratings and your installed base, and it breaks specific things that need to be mapped beforehand.

Aug 18, 202616 min read

Aug 18, 2026
16 min read

Open the topic page

Topic 04

How the system is designed

The design decisions the client feels in daily use: integrating with what already exists, keeping rules configurable, deciding every alert and protecting people who must not be identified.

3 articles

The notification map: the document that settles every system alert before the code

A notification map, also called a notification matrix, is the document that lists, before development, every alert a system sends: the event that triggers it, who receives it, through which channel, at what moment, with what text, what happens if it does not arrive and who must not receive it. In the health app we are modeling, it holds 78 notifications, and users can turn off only 3 of them. Written before the code, it prevents alerts to people on leave, verification codes over WhatsApp stuck waiting for Meta approval and sensitive data on a locked phone screen.

Oct 26, 202615 min read

Oct 26, 2026
15 min read

How to keep an anonymous whistleblowing channel truly anonymous

An anonymous reporting channel loses its anonymity in places the form never shows: the IP address recorded by the hosting platform, the location inside a photo, the author inside a PDF, third-party analytics and bot checks, and the combination of department, shift and date in a small team. Each of these has a technical fix that has to be in the system from the scope onward. In the reporting channel we are building for a client, the portal was moved off Vercel because of the IP, every attachment loses its metadata before it is stored, and follow-up with the reporter happens through a case code and password, with no email.

Oct 19, 202616 min read

Oct 19, 2026
16 min read

Integrating with an ERP: what the other system decides for you

The architecture of an integration is not your choice: it is imposed by what the other system offers. Across three integrations we built — NextFit, Altimus and Controlle — the same question (what changed over there?) had three different answers, because the sources were different. And whatever the source does not provide becomes a limit on your product, not just a line of code.

Aug 11, 202616 min read

Aug 11, 2026
16 min read

Who writes here

Pedro Cunha

CTO at Epicora

Pedro Cunha leads engineering at Epicora, in Chapecó, Brazil. He writes about the technical decisions behind the systems the team puts into production — architecture, scope, estimation and applied AI.

Subscribe via RSS Articles by Pedro Cunha

What we learn building custom software

How your company gets recommended by ChatGPT and Google's AI answers

Two paths, depending on what you want to do

I want to organize and automate my company

I want to build a software product to sell

Choosing and buying custom software

How your company gets recommended by ChatGPT and Google's AI answers

Why your team stops using the new system and goes back to spreadsheets

Already paying for off-the-shelf software: configure, integrate or build your own

Spreadsheet, off-the-shelf ERP or custom software: the answer is almost always more than one

What decides the platform for a company website

When a legacy system needs replacing — and when it doesn't

Applied AI, responsibly

Prompt injection: what an outside text can make your company's AI do

AI agent on WhatsApp Business: what you pay for, what is free and what changes between the official and an unofficial API

Code review with AI: what it catches and what slips through

How much it costs to put AI to work inside a company system, and what makes the bill go up or down

When an app built on Lovable needs to leave Lovable, and when it doesn't

How to organize company knowledge so AI can work with it

AI chatbot, assistant or agent: how to pick the right level for each task in your company

How to make AI follow your company's method

What can be salvaged from AI-generated code

Apps and app stores

Why TestFlight is not a way to distribute your company's app

When your app pays a commission to Apple and Google, and when it can charge outside the store

Mobile app or web system: how to decide what goes on the phone

Who owns the App Store account: you or the company building your app

What changes in a system when the app has to work with no signal

How the system is designed

The notification map: the document that settles every system alert before the code

How to keep an anonymous whistleblowing channel truly anonymous

Integrating with an ERP: what the other system decides for you

Let's talk about your project

Prefer to talk directly?