The forty things between a prototype and a business that trades
Anyone can get a working demo now. Nobody warns you about the fortnight of unglamorous administration between that demo and legally taking someone’s money.
Matter5 min read
Something genuinely changed in the last two years: the expensive half of building software got cheap. A paragraph of description and twenty pounds a month will now get you a clickable app that looks like the thing you imagined. That is real, it is not a trick, and it is the part of this that people find exciting.
It is also, increasingly, the easy half. What has not got cheaper is everything between a working prototype and a business that can legally accept a stranger’s card payment on a Sunday. That list has always existed. It has never been shorter. And because it is boring, nobody puts it on a landing page.
The demo is not the business. The demo is the part that got easy.
So here it is — the version we work through, roughly in order. Not everything applies to everyone, and a few are judgement calls rather than requirements. But if you are looking at a prototype and wondering what is left, this is broadly what is left.
Before you can trade at all
A company registered — or a considered decision to stay a sole trader, which is a real option and not a lesser one
A registered office address, which becomes public: your home address is the default and often the regret
A SIC code that actually describes what you do, because banks and insurers read it
A business bank account, and the two-week identity check nobody schedules around
An accountant, or at minimum a written answer to who files what, and when
Corporation tax dates, the VAT threshold, and a reminder set well before you cross it rather than after
Professional indemnity and public liability cover, if you touch anybody else’s money, data or premises
The address people reach you at
A domain bought in your name — not your developer’s, not your cousin’s, yours
DNS you can personally log into, which is a different thing from owning the domain
SPF, DKIM and DMARC records, or a meaningful share of your quotes will land in spam and nobody will tell you
A real business mailbox rather than a personal address quietly forwarding somewhere
An SSL certificate that renews itself, because the one that does not expires on a bank holiday
The obvious near-miss domains, if the name is worth protecting
A renewal reminder thirteen months out, on a calendar that will still exist
Actually taking money
A payment processor that will approve you — several industries are quietly declined, and launch day is a bad time to discover yours is one
Underwriting completed, which can take longer than the build did
Card fees you have read rather than assumed, including the ones charged on refunds
A refund and chargeback policy that exists before the first chargeback, not in response to it
Invoice numbering that is sequential and does not reset when you change tools
Terms of sale that say what happens when something goes wrong
A decided answer to what happens when a payment fails at nine on a Sunday evening
The legal minimum
A privacy policy describing what you actually collect, rather than what a generator guessed
A cookie banner that genuinely does what it claims when somebody clicks decline
Terms of use for the product itself
ICO registration — most UK organisations processing personal data need it, and it costs less than an afternoon
A data processing agreement with every processor you use, which is more of them than you think
Accessibility taken seriously early, where it is cheap, rather than late, where it is not
A clear answer to where your data physically lives and who else can reach it
Knowing whether any of it is working
Analytics installed and configured, which are two separate jobs
Conversion events defined before launch, because you cannot backfill the week you were not measuring
Search Console verified, so you find out what people actually searched to reach you
One place every enquiry lands, even if that place is a spreadsheet to begin with
Somewhere errors are reported that is not a customer eventually mentioning it
Uptime monitoring, so you are not told your site is down by the person who wanted to buy
When it breaks, and it will
Backups running — and one restore actually tested, because an untested backup is a belief, not a backup
A record of who holds which credentials, readable by somebody other than you
A way to roll back a bad deploy that does not involve rebuilding from memory
Somebody to call at eleven at night, named, who has agreed to it
Dependency and security updates on a schedule rather than on discovery
One written inventory of every account, subscription and renewal date, somewhere your accountant could find it
Why this list is the actual work
None of it is difficult in the way engineering is difficult. It is difficult in the way moving house is difficult: forty small things, each individually trivial, several with two-week lead times, a handful with a legal deadline, and no obvious order until you have done it before. It is also almost entirely invisible — nobody has ever complimented a business on its DMARC record.
That is exactly why it gets skipped, and exactly why it is where launches actually fail. Not on the software. On the fortnight nobody costed, at the point where the person is most tired and least able to face another form.