Holos33 is my own wellbeing platform: an app for iOS and Android, with an admin environment, a CMS and its own API behind it. Outsourced to an agency, the build was estimated at around €250,000. I took a different route. I set up the architecture together with a freelance software architect. After that I built everything myself, and a freelance cybersecurity specialist reviewed the security. After five months of development, Holos33 is now in its final test phases.
Holos33 in numbers
- 5 months of development, and now in the final test phases.
- 278 API endpoints in 27 modules, in the release of 30 October 2026.
- 169 screens in the first design for app, admin and CMS, worked out in Figma.
- 27 design documents and 10 SQL files for the architecture and the data model. My own audit found eleven errors in them, which were fixed before any code was built on them.
- 3 apps on one backend: the app, the admin and the CMS.
- 1 builder, 2 specialists: I build, an architect helped design it and a security specialist reviewed it.
Why I brought in an architect and a security specialist
I can do a lot myself. But an app that works with sleep, heart rate and journal entries is not something I want to build on my own judgement alone. That is why I did not come up with the architecture on my own. With a freelance architect I first set down how the parts work together, where the boundaries are and what must never happen to data. Only then did I start building.
Once it was in place, a freelance cybersecurity specialist reviewed the security. To me that is part of good work: build it yourself, and bring in a second pair of eyes where trust is at stake.
From Figma to a working app
Every screen started in Figma, including the states you would rather not think about: there is no data yet, synchronisation is delayed, a verification code has expired. I design those screens up front, because that is where you win or lose the trust of someone who has just installed the app.
The app itself is built in Flutter: one codebase for iOS and Android. The backend is its own API in NestJS with Fastify. Admin and CMS talk to the same API as the app, so there is one place where the rules apply.
The architecture
- One API for three apps. NestJS with Fastify, 278 endpoints, spread across 27 modules such as onboarding, content, daily rhythm, journal, consent, notifications and the AI coach.
- Shielded access. All traffic runs through Cloudflare to a shielded tunnel. The admin and the CMS also require a separate login for each person (Zero Trust).
- Data in the EU. PostgreSQL and the storage for audio and video run on servers in the EU.
- AI without lock-in. The AI coach goes through its own gateway to an open language model (Qwen) on its own server in a closed network. Connecting a different model is a configuration choice.
- Encrypted journal. The journal is encrypted on the device with AES-256-GCM. The server only stores encrypted text.
Privacy you can see in the screens
In Holos33, every use of data starts switched off. Anyone who connects health data chooses per purpose: only show it on the device, store it with Holos33, let a coach use it, and separately, take part in research. Choose “only on this device” and no measurements go to the server.
Health data comes in through Apple Health on iPhone and Health Connect on Android. Direct integrations with Garmin and Oura, among others, are in the design but not yet active.
The admin side is designed the same way. Support sees the technical status per integration, without individual health values. A deletion request follows a fixed route with proof: the user confirms, data use is paused, and then come the active storage, the derived data and a proof of completion.
Maintenance: who keeps an eye on it once it runs?
Servers and app are in the AIAgentCycle maintenance system, with monitoring, security updates and an alert as soon as something deviates. That is the same maintenance I do for clients.
Where it stands
Holos33 has now been in development for five months and is in its final test phases. I only publish figures on usage and effect once they have been measured. Holos33 is not a medical device and does not replace professional care.
What this means for you as a business owner
If you have an app, a client portal or your own backend built, what you mostly want to know is that it is done right. That your data stays yours, that you are not tied to one supplier, and that there is someone who understands it when something goes wrong. With Holos33 I made those choices for my own product. I use the same building blocks with clients: design in Figma, an API of your own, integrations with what you already have, AI behind a gateway and maintenance afterwards. And you talk to the person who builds it.
Want to know what that means for your process? Book a free assessment.
Frequently asked questions about Holos33
Who built Holos33?
I did: Stefan, founder of AIAgentCycle. I designed the architecture together with a freelance software architect. I then built the app, API, admin and CMS myself, and a freelance cybersecurity specialist reviewed the security.
How long has Holos33 been in development?
Five months, and Holos33 is now in its final test phases. First came the architecture and the design in Figma, then the build of the app, API, admin and CMS.
What technology is Holos33 built with?
The app is built in Flutter for iOS and Android. The backend is its own API in NestJS with Fastify, with 278 endpoints in 27 modules, on PostgreSQL. The design is in Figma, and the AI runs through its own gateway to an open model on its own server in the EU.
How does Holos33 protect health data?
Every use of data starts switched off and the user chooses per purpose. “Only on this device” sends no measurements to the server. The journal is encrypted with AES-256-GCM, administrators do not see individual health values, and deletion follows a fixed route with proof.
Can AIAgentCycle build an app or backend like this for my business?
Yes. I use the same approach for apps, client portals and custom backends: first the architecture and the screens, then the build, with integrations to the systems you already have and maintenance afterwards. In the free assessment we look at whether it fits and what it costs.
