Home/Services/Magento Development
security service

Magento Development

Magento development and Adobe Commerce builds, migrations and integrations across Europe, security-reviewed in-house. Get a fixed quote.

Manual, expert-ledEvidence-based findingsFree remediation retest

Magento development is a specialist craft, and most stores that come to us are either slow, stuck on an old version, or held together by extensions that fight each other. We build and rebuild Magento (Adobe Commerce) stores for European merchants, and because our other line of work is offensive security, the code we ship is written by people who also break into applications for a living.

A quick note before anything else. SafetyBis is a European cybersecurity firm first. Our penetration testers spend their days finding the flaws attackers use, and a few years ago merchants kept asking us to fix the broken stores we were auditing. So we built a proper custom development practice next to the security one. They are separate teams with separate deliverables, but they sit in the same building, and every store we build gets reviewed by the people who normally attack them. That is the difference on this page.

What Magento development actually covers

Magento is not one thing. “I need Magento development” can mean a fresh Adobe Commerce build, a rescue of a store someone else abandoned, a jump from Magento 1 to Magento 2, or a single checkout feature that keeps failing on live. We scope each of those differently, and we say so on the call rather than quoting a headline number that turns out to be wrong.

New Adobe Commerce (Magento 2) storefronts, front to back
Magento 1 to Magento 2 migration with catalogue and order history intact
Custom modules and extensions written to Magento coding standards
Theme and PWA storefront work, including Hyvä front ends
ERP, PIM, payment and shipping integrations that survive upgrades
Performance work: caching, indexing, Elasticsearch, Core Web Vitals
Version upgrades and security patch cycles kept current

How our Magento development process works

We work in short, visible stages so you always know what has been done and what comes next. There is no six-week silence followed by a demo of the wrong thing. Each stage below has a deliverable you can look at.

Discovery and scoping

We start by reading the store you already have, or the requirements you already wrote. For a rebuild we take an inventory of every extension, every customisation in the code, and every integration that talks to the outside world. That inventory is where the real cost of a project lives, and it is usually the thing other agencies skip. You get a written scope with fixed milestones before a line of code is touched.

Architecture and data model

Magento gives you a lot of structure for free, and it punishes you hard when you fight it. We decide early where custom logic belongs: a proper module with its own dependency injection, a plugin on a core method, or a service contract. Store data, especially product attributes and customer records, gets modelled so that a future upgrade does not rewrite half of it.

Build in reviewable increments

Development happens on a staging environment that mirrors production. We commit small, we write the module so the next developer can read it, and we keep third-party extensions to the ones that actually earn their place. Every custom module is documented enough that you are never hostage to us. This is where a good Magento development company separates itself from a cheap one: the code is boring, predictable, and yours.

QA and a security pass

Before anything reaches your customers it goes through functional QA on real devices and real payment sandboxes. Then it goes to our own security team for a review of the checkout, the customer account area, and any custom endpoint we added. Adobe Commerce handles a lot of card data adjacency, so we treat those flows the way we would treat a client we were paid to attack.

Fixed
milestone pricing, no open-ended hourly meter
NDA
on every engagement, before code or credentials change hands
In-house
security review of every store we ship

Magento 2 and Adobe Commerce specifics

Most work now lands on Magento 2, and the platform has matured in ways that reward doing it properly. Our Magento 2 development services cover both the open-source edition and Adobe Commerce, and we are honest about which one you actually need. Plenty of merchants pay for Commerce features they never switch on.

Themes, Hyvä and the front end

The default Luma theme is heavy. For new builds we lean toward Hyvä, which strips the front end back to something fast and maintainable, and the difference in Core Web Vitals is not subtle. Where a client is committed to a PWA Studio front end we build that too, but we will tell you when a headless setup is more cost than benefit for your catalogue size.

Extensions without the mess

A store with forty extensions is a store that breaks on every upgrade. We audit what you have, remove the overlap, and write custom modules only where an off-the-shelf one genuinely does not exist. When we do buy an extension, we pick vendors with a track record of patching, because an unmaintained extension is a security liability as much as a technical one.

Upgrades and migration

If you are still on Magento 1, you are running unsupported software that stopped getting security patches in 2020. Migration to Magento 2 is a project in its own right: the data moves, but themes and custom code have to be rebuilt against a new architecture. We map catalogue, customers, orders and SEO URLs so that search rankings and customer logins carry over. For merchants already on Magento 2, we keep the version current on a patch cycle rather than letting three years of updates pile into one scary jump.

Performance and scale

Slow Magento is almost always fixable. We tune Varnish and full-page cache, get indexing onto a schedule that does not lock the catalogue, move search to a properly sized Elasticsearch or OpenSearch cluster, and profile the slow pages with real tooling instead of guessing. Merchants running seasonal spikes get load testing before the spike, not a post-mortem after it.

Get a fixed quote

Want this tested on your own systems?

Free 20-minute scoping call, a fixed price with no hourly surprises, and a free retest once you fix what we find.

Get a fixed quote

Integrations, payments and the systems around the store

A store rarely lives alone. It talks to an ERP, a warehouse, a PIM, a tax engine and one or more payment providers, and every one of those connections is a place where an upgrade can go wrong. We build integrations as their own modules with clear boundaries, so that when Magento updates, the integration does not silently stop syncing stock at 2am.

Payment providers

We integrate the providers European merchants actually use, from Adyen and Stripe to local acquirers and 3-D Secure flows that satisfy PSD2. If you need a deeper treatment of card handling and PCI scope, we have a dedicated page on payment gateway integration, and the same developers do that work.

Back-office and data

ERP and PIM connections get built to fail safely. If the ERP is down, orders still capture and queue rather than vanish. That sounds obvious. It is the single most common integration bug we are called in to fix on stores other people built.

Security is a separate practice, and you get it anyway

This is worth stating plainly because it is unusual. Our development team and our penetration testing team are separate, with separate contracts and separate deliverables. You are not buying a pentest when you buy Magento development. But the developers writing your checkout learned to code from people who break checkouts, so a whole category of bugs never makes it into the build. Input that reaches the database gets parameterised. Customer account endpoints get authorisation checks that actually verify ownership. Admin access is scoped and logged.

If you also need the formal test

When a payment brand or an enterprise customer asks for evidence, our offensive team can run a proper application penetration test against the finished store and produce the report and attestation letter. That is a separate, security-side engagement with its own quote. Buying the development does not commit you to it, and the two are priced independently.

Magento development pricing

Development is scoped, not sold from a menu. What drives the number is how much custom logic you need, how many integrations touch the store, whether it is a fresh build or a rescue, and how clean the existing code is. We do not publish day-rates for project work, because a real quote comes from the discovery stage, not a price sticker. Here is the shape of the engagements we take.

Project type What’s included Typical timeline Pricing
Store audit and fix-list Full review of code, extensions and integrations on an existing store, with a prioritised list of what to fix and why 1–2 weeks project-scoped, from a free quote
New Magento 2 storefront Fresh Adobe Commerce or open-source build, theme (often Hyvä), core catalogue and checkout, launch support 6–12 weeks project-scoped, from a free quote
Magento 1 to 2 migration Data migration of catalogue, customers, orders and SEO URLs, plus a rebuilt theme and re-implemented custom logic 8–14 weeks project-scoped, from a free quote
Custom module or feature A specific piece of functionality built as a clean, documented module against Magento standards 1–4 weeks project-scoped, from a free quote
Performance and upgrade cycle Caching, indexing and search tuning, plus keeping the version and security patches current ongoing or fixed sprint project-scoped, from a free quote
Large multi-store estate Multiple sites, multiple languages, shared codebase, scoped after a discovery workshop on scoping project-scoped, from a free quote

Every project is fixed against agreed milestones and quoted after a free scoping call, so you know the number before we start. Work happens under NDA across Europe, on-site or fully remote. Scope my project

What you get as deliverables

Code you own and can read

You get the repository, the deployment setup, and modules documented well enough that another developer could pick them up. We do not hold your store hostage with undocumented custom code, and we do not lock you into a proprietary framework bolted on top of Magento.

A handover, not a disappearance

At launch you get a written handover covering the architecture, the integrations, the cron and indexing schedule, and the things to watch. If your own team takes it from there, they have what they need. If you want us to stay on for the patch cycle, that is a separate, clearly-priced arrangement.

FAQ

How much does Magento development cost?
There is no fixed sticker, because Magento development cost depends on scope: a single custom module is a different world from a full Adobe Commerce build or a Magento 1 migration. You get a fixed, milestone-based quote after a free scoping call, so there are no open-ended hourly surprises.
Do you work on Magento 2 and Adobe Commerce both?
Yes. Our Magento 2 development services cover both the open-source edition and Adobe Commerce. Part of the scoping call is being honest about which one your catalogue and traffic actually justify, since many merchants pay for Commerce features they never use.
Can you migrate my old Magento 1 store?
Yes, and you should not wait. Magento 1 stopped receiving security patches in 2020. We migrate catalogue, customers, orders and SEO URLs to Magento 2 and rebuild the theme and custom logic against the new architecture so rankings and customer logins carry over.
Are you a full Magento development agency or freelancers?
We are a European firm with a dedicated development team sitting alongside our security practice. As a Magento development company we handle build, integrations, performance and upgrades, and every store gets an in-house security review before launch.
Will the store be secure?
Security is a separate practice at SafetyBis, but the developers building your checkout are trained by people who break checkouts for a living, so a large class of bugs never ships. If you need a formal application penetration test and attestation, our offensive team can run one as a separate engagement.
Do you keep my store on the latest version?
If you want us to, yes. We run a patch cycle so security updates and platform releases are applied in small, tested steps rather than a single terrifying jump after three years of neglect.
How do you handle payment integrations?
We integrate the providers European merchants use, including Adyen, Stripe and local acquirers, with 3-D Secure flows that satisfy PSD2. Deeper card-handling and PCI-scope work is covered on our payment gateway integration page and done by the same developers.
Is my code and data confidential?
Yes. Every engagement runs under an NDA signed before any code or credentials change hands, and access to your systems is scoped and logged. We work with merchants across Europe on this basis as standard.

Related services

Who needs this

Merchants on Magento or Adobe Commerce who need a serious build, a rescue of a store someone else left broken, a Magento 1 to 2 migration, or a development partner who understands that a store handling payments is also a security target.

why safetybis

Security you can prove

The same standard on every engagement, big or small.

Evidence, not opinions

Every finding ships with a reproduction and proof of concept — no vague "maybe vulnerable".

Humans over scanners

Certified engineers find the logic flaws and chained attacks automated tools walk straight past.

Fixed price, free retest

You know the cost up front, and verifying the fix is part of the deal — not a second invoice.

500+
assessments delivered
<30min
incident first response
12k+
infections removed
98%
fixed within one retest
$ safetybis quote --service "Magento Development"

Ready to lock this down?

Free scoping call, fixed price, free retest. Tell us what you're running and we'll take it from there — usually within one business day.

get in touch

Tell us what you're running

Scoping is free. We reply within one business day, and under 30 minutes for active incidents.