From Arucas. No messing about.
DAMN, WE MAKE
BLOODY GOOD
SOFTWARE.
We make
Design, engineering and security. From Arucas, with no sales pitch and no five departments between you and the person coding your project.
Others talk. We code.
Mi Jornada
Jean Blazer
Pablo Batista
Carolina & Gelardo
DAB Center
16
Northern Gran Canaria. With guts. We are KHM Studio, an independent studio from Arucas. We bring design, engineering and security together to build websites, apps and custom software. We like understanding your business, working through ideas with you and turning them into code. We are not your typical agency. Thank God. Here you talk to the people designing and coding. We build our own products and projects for people who want character, usefulness and proper craft. Technology can be complicated. Talking about it should not be.
Who we are
Great things get built in Arucas too. Clients and our own products.
- Mi JornadaMi Jornada · Producto propio
Services
Plenty of design. Plenty of code. Zero nonsense.
Good design. Straight-up coding. Websites, apps and the systems behind them, built around what your business actually needs.
Why us
Software made in the Canaries. No imported nonsense.
01
Want a sales pitch? Best look elsewhere.
Here you talk to the person doing the work. We tell you what's possible, what's worthwhile and where the limits are. If an idea doesn't hold up, we say so.
Direct contact02
A reason for every decision
The fashionable tool isn't always right for you. Before coding, we decide together what solves the problem and what just adds to the bill.
A plan before the code03
Security doesn't come last
We think about access, backups and alerts from the start. We agree what your project needs and explain what each measure does.
14 security controls04
Put the numbers on the table
Saying it works brilliantly is easy. We look at what people do, where they get stuck and what changes when we improve the product. That guides the next step.
Measurable decisionsCybersecurity
Security takes work, not a badge on a website. In the apps, databases and services connected to our system, we use access controls, monitoring and checked backups, inspired by KHM Aegis. We explain what applies to your project and how it is set up.
01AccessWho gets in, how they prove it and what they can touch.4 controls
- CSRF protectionNo other site can act on your behalf using your session.
- Google sign-in and a second factor by codeWith expiry, attempt limits and resend control.
- Separate rolesClients, administrators and internal processes, each with their own permissions.
- Protected sessionsAgainst session fixation, with HttpOnly, Secure and SameSite cookies.
02ProtectionThe fewer open doors, the better.2 controls
- CSP and security headersAgainst injected content, unwanted scripts, clickjacking and needless access to camera, microphone or location.
- Least privilege in databasesThe application account, separate from the one that runs migrations.
03DetectionEarly warnings when something smells off.4 controls
- Digital canariesIn files and databases, so we hear about odd access, changes or queries.
- Isolated SQL decoysWithout putting fake data in the client's real databases.
- Discovery of new projects and databasesThey join monitoring on their own, without setting each one up by hand.
- PostgreSQL monitoringAvailability, recovery and replicas where they exist.
04RecoveryBackups that are checked before you need them.1 control
- Verified automatic backupsManifests, SHA-256 integrity, controlled retention and a check before anything is restored.
05TraceabilityKnowing what happened, when and who it was.3 controls
- Protected audit logKeeps admin operations and security events so they can be looked into.
- HMAC-signed communicationBetween the portal and the server agents, and no message can be replayed.
- Alerts and a central dashboardProjects, databases, canaries, backups and incidents, all in one place.
Data and strategy
Doing the same old thing? What a waste.
So much talk of innovation. So little code. We look at how people find you on Google and what they do on your website or app. Then we decide what to change and check whether it helps your business.
- 1
Measure
What you want to achieve and what data there is (and what's missing).
- 2
Understand
Search Console to see how you show up on Google; Analytics to see what happens inside.
- 3
Decide
A diagnosis and a list of changes, the ones that pay off most first.
- 4
Improve
The changes go live and we check they worked. If not, we adjust.
What you receive
- Measurement plan
- Diagnosis
- Prioritised list of changes
- Roadmap
- Decision log
Digital advice and funding opportunities
Everyone's talking tech.
Still doing it all by hand?
AI this, platforms that, and jargon everywhere. Meanwhile, you're still juggling spreadsheets, WhatsApp and scraps of paper. Tell us how your business works. We'll help you work out what technology is actually useful and where to start.
We'll also look into funding programmes that might fit your business. If there's a suitable opportunity, we'll go through the requirements, deadlines and what the project would involve. A useful plan, in plain language.
Come on, let's get you moving.Funding depends on each programme, its requirements and the awarding body's decision.
How we work
Come on, fewer meetings.
More getting things done.
Less posing. More software that works. Each phase leaves you something to see, try and discuss with us. That's how we move forward.
- 01
First, listen
Tell us what's causing headaches, how your business works and who will use this. We ask until we understand.
- 02
Put the cards on the table
Good ideas. No appetite for the same old thing. We agree what to solve, what's included and what can wait.
- 03
Shape it and try it
Screens, journeys and how everything fits inside. You see it and we discuss it before signing it off.
- 04
Roll up our sleeves and code
We build, test and show you progress. If something fails, we fix it; if something isn't clear, we explain it.
The idea is yours. The nonsense stays outside. Go on, tell us.
From the Canaries.
Ready to shake things up.
Prefer email? You'll hear from the person who will work on your project.