Software house · Wrocław, Poland
Innovix is a software house in Wrocław, Poland, that designs and builds software for large companies and enterprises - and tests its security in-house. We work with finance and insurance companies, healthcare providers, law firms, manufacturers and the public sector - under an NDA, a data processing agreement and an SLA, with data kept in the European Union.
Security by design across the development lifecycle
Requirements analysis
Architecture and threat model
Implementation
Pre-release testing
Deployment
Maintenance
Each new release goes back to analysis - we check security in every iteration, not once at the end of the project.
01Who we are
A software house is a company that designs, builds and maintains software to order for its clients - from requirements analysis, architecture and coding to deployment and the ongoing development of the system. Innovix combines this with a second capability: a team of penetration testers who test the security of our own systems and of systems built by other vendors.
We work mainly for large companies and enterprises in regulated industries, where software handles customer data, money or confidential information and every supplier has to pass vetting by procurement, security and data protection teams.
For these organisations, it is not enough that the system works. They also need to know:
The way we work, described on this page, is built around these four points.
02Why Innovix
Four things that set us apart from a typical software house - each one backed by evidence you can check.
Security
Penetration testing is part of the release cycle (before every major release), not a separate add-on ordered at the end of the project. The same pentesters also test systems built by other vendors - for companies that do not buy software from us.
Regulation
We record NIS2/KSC, DORA and GDPR requirements as acceptance criteria from the requirements analysis onwards. Preparing companies for audits is part of our everyday work, so we know what auditors ask about.
Data in the EU
We keep hosting, databases, model training and logs in EU data centres, with no transfers to third countries - or we deploy the system in your own infrastructure.
Contracts
We run every project under an NDA, a contract and an SLA with measurable acceptance criteria. We transfer the rights to the code to you, and any personal data entrusted to us in a project is covered by a data processing agreement.
You will find the evidence on our security service pages: we carry out penetration testing for companies that do not buy software from us, while the NIS2/KSC audit and DORA compliance are areas where we help organisations prepare for regulatory requirements.
03What we build
Service
Systems tailored to your processes: when they pay off, how they are built, what drives the cost and who owns the code.
Web
Customer and partner portals, admin panels and internal systems that run in the browser.
Integration
ERP, CRM, MES and WMS connected through APIs, queues and batch processing.
Legacy
Gradual replacement of legacy systems, without downtime and with data migration.
We also build desktop applications and SaaS platforms, and we run every project according to the principles described on our secure by design page.
04Process
A large organisation means many stakeholders: the business, IT, security, data protection, procurement and legal. We shape the process so that each of them gets what they need at the right time.
Goals, context and constraints. Before any details are exchanged, we sign an NDA - on your legal team's template if you prefer.
Security questionnaires, a data processing agreement and a framework agreement - in parallel with the project work, not after it.
An analysis workshop, requirements with acceptance criteria, a release plan and a proposal broken down into stages.
A working system demonstrated regularly, progress and risk reports, code review and testing in every iteration.
Acceptance tests against the criteria in the contract, a penetration test and a retest of fixes before production.
Monitoring, security fixes and further development under an SLA.
We report on progress regularly: what has been done, what comes next, what the risks are and which decisions are needed on your side.
The acceptance criteria for each stage also cover security and performance requirements. You know what you will get and when.
Code review, static analysis and dependency analysis in the CI/CD pipeline, and a penetration test by our team before every major release.
05Engagement models
We agree the scope, schedule and acceptance criteria after the requirements analysis. We work in stages, with milestones and sign-off of each stage.
A permanent Innovix team develops your system at your organisation's pace. We put the team together to suit the project.
We match the billing model to your organisation's cost policy: licence, subscription or hybrid. A fixed-scope project works well when the requirements can be clearly described at the outset; a dedicated team, when the system will evolve over several years and priorities shift with the business. You will find details and a comparison of the models on our engagement models page.
06Procurement readiness
Procurement, security and legal teams vet suppliers against their own checklists. Here is what we can offer from the very first call.
We sign a non-disclosure agreement before discussing the details of your system, including your own extended version.
We can work under a framework agreement with successive orders - without renegotiating terms for every project.
We transfer the author's economic rights to the code written for the client in the fields of exploitation specified in the contract, and hand over the source code after acceptance.
When we process personal data on the client's behalf, we sign a data processing agreement in line with Art. 28 GDPR.
We provide maintenance and further development after go-live under an SLA with agreed service levels.
Every stage has measurable acceptance criteria written into the contract - you know what you will get and when.
We complete vendor security questionnaires and surveys from procurement and security teams.
The company holds third-party liability insurance covering its business activities.
07Industries
Industries · Finance and insurance
Software for banks, insurers and brokers: DORA and ICT providers, Polish KNF rules after 2025, policy document automation and penetration testing.
Industries · Healthcare
Healthcare software development: special category data (GDPR), patient confidentiality, medical records, Polish e-health integration, NIS2/KSC, accessibility.
Industries · Law firms
Legal software and AI for law firms that respect professional secrecy: case-file analysis on an on-premises model (LegalAI), secure documents, AI control.
Industries · Manufacturing and logistics
Software for manufacturing, transport and logistics: ERP, MES and WMS integration, systems for hauliers, shop-floor apps, NIS2/KSC and business continuity.
We also work for the public sector. In each of these industries, software is subject to different rules - from professional secrecy and health data to financial supervision requirements - and it is these rules that set the non-functional requirements of each project.
08Case studies and products
Projects delivered for clients, and our own products, which are in development. The same expertise goes straight into our clients' projects.
InsurTech · Document AI
A production system for a client in the insurance sector. A dedicated language model extracts data from PDF policies, with no transfer to external AI providers.
Delivered
Consumer AI · Multimodal platform
A commercial AI platform that brings together models from leading providers - native on iOS and Android, in the browser and on Windows, macOS and Linux, localised into 40 languages.
Delivered
Cybersecurity · SaaS · Compliance
Takes your organisation through the NIS2 and KSC Act compliance cycle - from scope assessment and gap analysis, through policies and procedures, to reporting incidents to the CSIRT within 24 and 72 hours.
In development
Legal Tech · Neuro-Symbolic AI
Analysis of multi-volume court case files with a local language model fine-tuned on Polish law - the files never leave the law firm's infrastructure.
In development
Enterprise DLP · Zero Trust
Secure access to AI tools at work - data stays on the employee's device, and sensitive content is pseudonymised before it is sent to public models.
In development
09Technologies
| Area | Technologies |
|---|---|
| Web applications | TypeScript, React, Next.js, Node.js |
| Backend and data | Node.js, Python, Rust, PostgreSQL, Redis |
| Mobile applications | Swift (iOS), Kotlin (Android), React Native, Flutter, Tauri 2 |
| Desktop applications | Tauri 2, Rust, TypeScript, SQLCipher |
| AI and documents | Python, language model fine-tuning, OCR, knowledge graphs |
| Infrastructure | AWS, Azure, GCP (EU regions), private EU cloud with dedicated GPUs, on-premises |
| Security | OAuth 2.0, AES-256-GCM, SQLCipher, CI/CD with security testing |
We choose technology to fit the requirements, the team that will develop the system and your organisation's policies - for example, lists of approved programming languages and cloud providers. We justify the choice in the architecture document, so that years from now it is clear why the system was built the way it was.
10Location
Our office is in Wrocław, Poland (Aleja Śląska 1, 54-118 Wrocław) - meetings at the office by appointment. We deliver projects and security tests for companies across Poland and the European Union, remotely and on site: we run workshops, progress reviews and board presentations wherever your team works.
For clients outside Poland, this means working with a supplier based in the European Union: data stays in EU data centres or in your own infrastructure and is processed in line with the GDPR, and we work in English and Polish. How we work with clients from other countries is described on our software development company in Poland page.
We reply to enquiries within 24 hours on business days - we work Monday to Friday, 08:00-16:00 Polish time (CET/CEST). Tell us what you need: the first call is simply to establish whether and how we can help, and it puts you under no obligation. You will find our contact details on the contact page.
Check five things: whether the supplier understands your industry and its regulations; how it ensures security (and whether it can demonstrate it rather than just claim it); what contract terms it offers - rights to the code, confidentiality, data processing, an SLA; where the data will be processed; and how the work is signed off. Ask for sample acceptance criteria and a description of the release process. A good partner will give you specific answers to these questions before sending a proposal.
We transfer the author's economic rights to the code we write for you in the fields of exploitation listed in the contract, and hand over the source code after acceptance. The exceptions are our own products and open-source libraries, which you use under a licence. Details: code ownership and licences.
Every code change is reviewed by a second person, so knowledge of the system never sits in one developer's head. With a dedicated team, we agree the team composition with you and plan any changes well in advance, with time to bring a new person up to speed on the project.
Security is part of every iteration: OWASP ASVS requirements in the acceptance criteria, a threat model at the architecture stage, code review, static analysis and dependency analysis in the CI/CD pipeline and, before release, a penetration test by our own pentesters with a retest of the fixes. We describe the full lifecycle on our secure by design page.
Yes. We can deploy the system in your own infrastructure (on-premises), in your AWS, Azure or GCP account in a European Union region, or in a private cloud in the EU. If your company policy requires it, we work in your environments with access granted and controlled by your IT team.
Yes. When we process personal data on your behalf in a project - for example when maintaining a system that holds customer data - we sign a data processing agreement in line with Art. 28 GDPR. We also complete the vendor security questionnaires that procurement and security teams ask for.
We prepare every proposal individually. For a fixed-scope project, we give the cost of each stage after the requirements analysis; for a dedicated team, the cost of the team per billing period. The cost depends on factors such as scope, integrations, security and regulatory requirements, and maintenance. More: how much bespoke software costs.
We reply to enquiries within 24 hours on business days. Next come a call and an NDA, an analysis workshop and a proposal with a schedule - how long these steps take depends mainly on the availability of people on your side and on your procurement procedures. We give the start date in our proposal.
Software house · Custom software
Bespoke software development: when it pays off, the types of system, the process from analysis to maintenance, what drives the cost and who owns the code.
Software house · Artificial intelligence
AI implementation without sending data outside the EU: models in a private cloud, on-premises or in your own cloud, a PoC with metrics, the AI Act and GDPR.
Cybersecurity · Penetration testing
Penetration testing services for web and mobile apps, APIs, infrastructure, cloud and source code. OWASP and PTES, evidence-based reports and retests.
Tell us briefly what you need - we will come back with proposed next steps. We work in English and Polish.
or call +48 575 621 877