Sanddev best tech stack – technologies we built with

Most agency websites answer “what tech stack do you work with?” with a wall of logos. Ours did too. It looks impressive for about two seconds and then it stops working, because a logo wall is an image, and an image says nothing to a search engine, to a language model, or to anyone using a screen reader.

So here is the same wall of tech stack, written out. Over one hundred and fifty technologies, grouped by what we build with them rather than sorted alphabetically, because the grouping is the part that carries the argument. OpenRTB on its own proves nothing. OpenRTB sitting next to Prebid Server, a 100-millisecond budget and the sentence explaining why those two facts are related proves a great deal.

One rule applied throughout: only list of techb stack what you can be asked about. A CTO who asks “you use Temporal – what for?” and gets silence has learned something far worse than if the name had never been on the page. Everything below is something we have shipped to production.

The tech stack

Languages

We pick the language the problem calls for, not the one we are fastest in. TypeScript and Python carry most of the work; Go and Rust show up where latency is the product; Java, Kotlin and Scala when we are working inside someone’s existing JVM estate.

• TypeScript,
• JavaScript,
• Python,
• Go,
• Rust,
• Java,
• Kotlin,
• Scala,
• PHP,
• C++,
• SQL.

Ad platforms & RTB

Bidders, ad servers and self-service advertiser portals. Every decision in this group is shaped by one constraint: the auction closes in about 100 milliseconds, and no amount of feature work compensates for missing it.

• OpenRTB 2.6,
• Prebid.js,
• Prebid Server,
• VAST 4.x,
• ads.txt,
• sellers.json,
• SupplyChain object,
• IAB Tech Lab standards,
• Google Ad Manager,
• Google AdSense,
• Google Ads API

Identity, consent & privacy in tech stack

Consent lineage and post-cookie identity designed in from the first sprint, not retrofitted the week before an audit. This is the group where inherited AdTech codebases most often turn out to be quietly broken.

• IAB TCF 2.2,
• Google Consent Mode v2,
• server-side Google Tag Manager,
• OneTrust,
• Didomi,
• Sourcepoint,
• UID2,
• Privacy Sandbox (Topics, Protected Audience),
• ID5,
• LiveRamp / RampID

Customer data & attribution

Event pipelines and custom attribution models for the channels an off-the-shelf MTA tool cannot see. When a client’s own numbers disagree with their ad platform’s reporting, the answer is usually somewhere in here.

• Segment,
• RudderStack,
• Snowplow,
• Google Analytics 4,
• Meta Marketing API,
• custom attribution models (MTA, MMM)

Data engineering & analytics

Streaming and batch, warehouse and lakehouse. Most AdTech work we take on generates more events per day than the rest of the client’s business combined, so this layer gets designed before anything else does. Tech stack:

• Apache Kafka,
• Redpanda,
• Apache Pulsar,
• Apache Spark,
• Apache Flink,
• Apache Airflow,
• Apache Hadoop,
• dbt,
• Fivetran,
• Airbyte,
• Apache Iceberg,
• Delta Lake,
• ClickHouse,
• Snowflake,
• Google BigQuery,
• Amazon Redshift,
• Databricks,
• DuckDB,
• Trino,
• Looker,
• Apache Superset

Applied AI & LLMs in tech stack

Language-model features wired into systems that were never designed for them, with evaluations, tracing and audit trails rather than a prompt and optimism. We stay deliberately multi-vendor here, including open-weight models that run on your own hardware when the data is not allowed to leave the EU.

• OpenAI GPT,
• Anthropic Claude,
• Google Gemini,
• Mistral,
• Llama,
• Qwen,
• DeepSeek,
• Bielik,
• PLLuM,
• Hugging Face,
• retrieval-augmented generation (RAG),
• pgvector,
• Qdrant,
• Weaviate,
• LangGraph,
• LangChain,
• LlamaIndex,
• Langfuse,
• Model Context Protocol (MCP),
• vLLM,
• Ollama,
• PyTorch,
• scikit-learn,
• XGBoost

Backend & APIs

The services in tech stack underneath everything above, plus the unglamorous part nobody demos: retries, idempotency, and workflows that survive a deploy halfway through.

• Node.js,
• NestJS,
• FastAPI,
• Spring Boot,
• REST,
• GraphQL,
• gRPC,
• JWT / OAuth 2.0,
• Temporal,
• WebSockets,
• webhooks

Tech stack in databases

Operational stores, chosen for the access pattern rather than the fashion. Analytical stores live in the data group above.

• PostgreSQL,
• MongoDB,
• Redis,
• Apache Cassandra,
• Elasticsearch / OpenSearch

Frontend tech stack

Interfaces for operators, traders and advertisers. These are screens people sit in front of for eight hours, which is a different design problem from a marketing page.

• React,
• Next.js,
• Angular,
• TypeScript,
• Tailwind CSS,
• Vite,
• Storybook,
• D3.js,
• Recharts,
• Highcharts

Cloud & platform

Infrastructure as code, on whichever cloud your data is legally allowed to live on. We hand over the Terraform, not a diagram of it. Tech stack:

• AWS,
• Google Cloud,
• Microsoft Azure,
• Cloudflare,
• Docker,
• Kubernetes,
• Helm,
• Terraform,
• Pulumi,
• Ansible,
• Argo CD,
• GitHub Actions,
• GitLab CI,
• CircleCI

Observability & quality

How we know it works in production, and how your team keeps knowing after we hand it over. Instrumentation goes in from the first sprint, because retrofitting it means guessing at what mattered.

• OpenTelemetry,
• Datadog,
• Grafana,
• Prometheus,
• Loki,
• Sentry,
• PostHog,
• Playwright,
• Vitest,
• k6,
• Testcontainers

Security & supply chain

SBOMs, secret scanning and dependency provenance. These are also the artefacts the EU Cyber Resilience Act starts asking for in December 2027, which is sooner than it sounds when the codebase is five years old.

• SBOM (CycloneDX / SPDX),
• Semgrep,
• gitleaks,
• osv-scanner,
• Trivy,
• Sigstore,
• HashiCorp Vault,
• OWASP ASVS

Integration & workflow

Getting systems to talk to each other without a rebuild. Usually the cheapest thing we can do for a client, and the one most often skipped.

• MuleSoft,
• Workato,
• Zapier,
• n8n,
• Braze,
• Klaviyo,
• Iterable,
• HubSpot,
• Salesforce

Blockchain

Where an auditable shared ledger genuinely beats a database, and we will tell you when it does not. Most of the time, it does not.

• Hyperledger Fabric,
• Ethereum / EVM,
• Solidity,
• smart contract audits

Not on the list?

Ask. Roughly half our work starts on a codebase somebody else wrote, in a stack nobody would choose today, which is how a good number of these names ended up here in the first place. Inheriting an unfamiliar stack is a normal week for us, not an exception we price around.

And if you would rather see how we write code than which logos we have collected, the open-source work is at sanddev.com/open-source.