Your data, your call. Your process, our build.
Use it in the cloud right away or host it on your own servers, and when the standard flow does not fit, we build what you need. Every layer, from accounts and permissions to attachments, is protected.
Two ways to deploy
Sign up and go: nothing to install or maintain. Each company's data is isolated, and every query is scoped to your company automatically.
Deploy with Docker on your own servers, with the database and attachments in your own data center, for teams with strict data requirements.
Custom development
Standard features not quite enough? We adapt Stepwise to the way you work.
Features, fields and status flows adjusted to how you manage projects.
DingTalk, Feishu, OA, single sign-on and more, with accounts and notifications connected (WeCom is built in).
Your own logo and domain, so your team and clients see your brand.
Bring your requirements and bugs over from TAPD, Jira or Excel without losing history.
We set up self-hosting and train your team and your clients to go live.
How we work together
- 01Talk it through
We learn about your team, your process and the systems to connect.
- 02Scope and quote
You get a plan, a timeline and a quote.
- 03Build and deliver
We build, test and deliver the agreed scope.
- 04Go live
We deploy and train your team and your clients.
How we protect your data
Companies are isolated as tenants; projects are isolated by membership; clients only see their own company's projects.
Passwords of 8-12 characters with upper and lower case letters, digits and symbols; lock-out after repeated failures; changing a password or disabling an account ends existing sessions immediately.
Positions set the data scope, menus and actions are granted per role, and sensitive data such as person-days is granted separately. The client portal never shows staff names.
Rich text is stripped of scripts and unsafe content; attachments are stored privately and served through expiring links.
Every status change, approval and comment on requirements, bugs and tasks is recorded; deleted requirements and bugs go to a recycle bin first.
Production will not start without its secrets configured, and production logs leave out sensitive data.
Want to talk about self-hosting or custom development?
Start free, set up your team space in minutes, and invite your team and clients.
