Starting a tech company in Hong Kong is exciting, but the number of decisions you need to make before writing a single line of product code can be overwhelming. Domain registration, hosting, email, version control, CI/CD, cloud provider, monitoring, security — miss any one of these and you will be firefighting later when you should be shipping features.
This checklist is the exact list we work through with every startup client at Astera. It is organized by phase so you can tackle things in the right order, and each item includes our recommended tool or approach. Bookmark this page — you will come back to it more than once.
If you want us to handle this entire setup for you as part of a custom software development engagement, we can have your entire stack provisioned and ready to go in under a week.
1. Pre-Development Foundations
These are the business and operational basics you need before any code is written. Skipping them leads to painful migrations later.
- Domain name: Register your primary .com and optionally .hk domain. Use Cloudflare Registrar or Namecheap for .com; HKDNR for .hk domains. Set up DNS with Cloudflare for free CDN and DDoS protection from day one.
- Business email: Set up a professional email address (you@yourcompany.com). Google Workspace is the standard in Hong Kong — HK$48/user/month gets you Gmail, Calendar, Drive, and Meet. Alternatively, Microsoft 365 if your clients expect Outlook compatibility.
- Project management: Choose one tool and stick with it. Linear is excellent for dev-heavy teams. Notion works well for mixed technical/non-technical teams. Avoid Jira unless you are already embedded in the Atlassian ecosystem — its overhead is not justified for early-stage startups.
- Version control: GitHub is the default. Create an organization account, enable branch protection on your main branch from day one, and require pull request reviews even if you are a team of two. This discipline pays dividends immediately.
- Communication: Slack for internal team communication. Create dedicated channels for engineering, product, and alerts. Set up a WhatsApp Business account for client-facing communication — it is the standard in Hong Kong.
- Document storage: Google Drive or Notion for shared documents, specs, and design assets. Establish a folder structure early — "Specs," "Design," "Contracts," "Finance." Future you will be grateful.
2. Development Environment
Your development workflow determines how fast your team can ship. Get this right early and every sprint will be faster.
- Code repository: One monorepo or a small number of well-defined repos. Use a clear branching strategy — trunk-based development with short-lived feature branches works best for small teams. Document your Git workflow in a CONTRIBUTING.md file.
- CI/CD pipeline: GitHub Actions is free for public repos and generous for private ones. Set up automated linting, type checking, and tests on every pull request. Deploy to staging automatically on merge to main. This is non-negotiable — manual deployments are a liability.
- Staging and production environments: You need at least two environments from the start: staging (for testing) and production (for users). They should be as identical as possible. Use infrastructure-as-code (Terraform, Pulumi, or even Docker Compose) so environments are reproducible.
- Secrets management: Never put API keys, database passwords, or tokens in your code. Use environment variables at minimum. For anything beyond a solo project, use a dedicated secrets manager: AWS Secrets Manager, Doppler, or 1Password for Teams with their CLI integration.
- Local development: Standardize your local setup with Docker Compose or a well-documented setup script. Every new team member should be able to run the project locally within 30 minutes of cloning the repo. If it takes longer, fix the onboarding before adding more features.
3. Frontend Stack
Your frontend is what users see and interact with. Choose tools that maximize developer productivity without over-engineering.
- Framework: Next.js (React) is our default recommendation for most Hong Kong startups. It handles SSR, routing, and API routes out of the box. If your team prefers Vue, Nuxt is the equivalent. Avoid building SPAs with Create React App — it is effectively abandoned.
- UI component library: shadcn/ui for maximum flexibility and customization. Ant Design if you are building a data-heavy dashboard. Avoid building a component library from scratch at the MVP stage — that is a trap.
- State management: Start with React's built-in useState and useContext. If you genuinely need global state, Zustand is lightweight and simple. You do not need Redux for an MVP. You probably do not need Redux ever.
- Styling: Tailwind CSS is the fastest path from design to implementation. It pairs perfectly with shadcn/ui. If your designer insists on CSS modules or styled-components, that works too — just be consistent across the project.
- Testing: Vitest for unit tests, Playwright for end-to-end tests. Write tests for your critical user flows (signup, checkout, core feature) from day one. You do not need 100% coverage, but you need confidence that the happy path works.
4. Backend Stack
The backend is where your business logic lives. Prioritize simplicity, reliability, and the ability to hire local talent.
- Language and framework: Node.js with NestJS or Express for JavaScript teams. Python with FastAPI or Django for data-heavy or AI-integrated products. Go for high-performance microservices. Pick one language and stick with it — polyglot backends at the startup stage are a mistake.
- Database: PostgreSQL is the answer for 95% of startups. It handles relational data, JSON documents, full-text search, and geospatial queries. Use Supabase or Neon for managed Postgres with generous free tiers. Add MongoDB only if you have a genuinely document-centric data model.
- Caching: Redis for session storage, rate limiting, and frequently-accessed data. Upstash offers a serverless Redis with a free tier. Do not add caching until you have measured a performance problem — premature optimization is the root of all evil.
- Queue and background jobs: BullMQ (Node.js) or Celery (Python) for tasks that should not block the request/response cycle: sending emails, processing uploads, generating reports. AWS SQS is a solid managed alternative. You will need this sooner than you think.
- API design: REST for most startups. GraphQL only if you have multiple client apps with very different data needs. Document your API with OpenAPI/Swagger from the start — it costs almost nothing and saves hours of debugging later.
5. Infrastructure
Infrastructure decisions are hard to reverse, so make them deliberately. The goal is reliability and low operational overhead.
- Cloud provider: AWS is the safe default with the deepest ecosystem. GCP is excellent if you are AI-heavy. Vercel or Cloudflare Pages for frontend hosting — they handle CDN, SSL, and edge caching automatically. For most Hong Kong startups, the ap-southeast-1 (Singapore) or ap-east-1 (Hong Kong) regions provide the best latency.
- CDN: Cloudflare's free tier is remarkably capable — CDN, DDoS protection, SSL, and basic analytics. Enable it from day one. There is no reason to serve assets from your origin server directly.
- Monitoring and alerting: Uptime monitoring with BetterStack or UptimeRobot (free tier). Application Performance Monitoring (APM) with Datadog, New Relic, or the free tier of Grafana Cloud. Set up alerts for downtime, high error rates, and slow response times.
- Logging: Structured JSON logging from the start. Ship logs to a centralized service: Datadog, Logtail, or AWS CloudWatch. Search and filter by request ID, user ID, and error type. Unstructured console.log statements will not help you debug production issues at 2am.
- Backups: Automated daily database backups with at least 7-day retention. Test your restore process at least once before launch — a backup you have never restored is not a backup. Store backups in a different region from your primary database.
6. Security
Security is not optional, and in Hong Kong you have specific legal obligations under the Personal Data (Privacy) Ordinance (PDPO). Get the basics right from the start.
- SSL/TLS: HTTPS everywhere, no exceptions. Cloudflare provides free SSL certificates. If you are using a custom server, Let's Encrypt with auto-renewal via Certbot. Set HSTS headers to enforce HTTPS at the browser level.
- Authentication: Do not build your own auth. Use Clerk, Auth0, or Supabase Auth. Enforce strong passwords, offer social login (Google, Apple), and implement multi-factor authentication for admin accounts. Store sessions securely with httpOnly cookies.
- PDPO compliance: If you collect personal data from Hong Kong users (and you almost certainly will), you must comply with the PDPO. This means: a clear privacy policy, data collection consent, the right for users to access and correct their data, and reasonable security measures. Not optional — it is the law.
- Dependency scanning: Enable GitHub Dependabot or Snyk to automatically flag vulnerable dependencies. Review and patch critical vulnerabilities within 48 hours. This is one of the simplest security wins you can get.
- Penetration testing: For your MVP, a manual security review by an experienced developer is sufficient. Before handling payments or sensitive personal data at scale, invest in a professional pen test. Budget HK$20,000-50,000 for a thorough assessment.
7. Launch Checklist
You have built the product. Before you go live, run through these final checks. Launching without them creates problems that are much harder to fix after users are in the system.
- SEO basics: Unique title tags and meta descriptions on every page. Proper heading hierarchy (one H1 per page). Submit your sitemap to Google Search Console. Set up robots.txt. Add Open Graph and Twitter Card meta tags for social sharing.
- Analytics: Google Analytics 4 or PostHog installed and tracking page views, signups, and your core conversion event. Verify data is flowing before launch — not after. Set up a simple dashboard showing daily active users, signups, and your primary KPI.
- Error tracking: Sentry or Bugsnag configured in both frontend and backend. Source maps uploaded for readable stack traces. Alert on new and escalating errors. Test it by deliberately throwing an error in staging and confirming the alert arrives.
- Load testing: Run a basic load test with k6 or Artillery to understand your breaking point. You do not need to handle 10,000 concurrent users at launch, but you should know what happens when 100 people sign up in the same hour. Fix any bottlenecks before they become outages.
- Backup verification: Restore your most recent database backup to a temporary environment. Confirm the data is complete and the application works against it. This is the single most important pre-launch check that teams skip — and the one they most regret skipping.
- Legal pages: Privacy policy, terms of service, and cookie consent banner. These are legal requirements in Hong Kong, not nice-to-haves. Have a lawyer review them, or at minimum use templates customized for PDPO compliance.
What Comes Next
This checklist covers the foundations. Once you are live, the focus shifts to iteration: monitoring user behavior, fixing what is broken, and building what users actually ask for. That is where the real work — and the real fun — begins.
If you are a Hong Kong startup looking for a technical partner to set up your stack and build your MVP, we would love to talk. Our MVP development guide walks through the build process in detail, and our custom software development service covers everything from discovery to deployment.
Need help setting up your tech stack? Book a free consultation and we will walk through this checklist together, tailored to your specific project and budget.