Library · Glossary
Software and AI terms, in plain words.
145 terms for buying software, running LLMs, building AI features and meeting compliance rules. Each one has a short definition, an example, the mistakes to avoid and a tool to try it out.
Buying software
Contracts, scope and the real cost of a build.
- Change request A written request to change the agreed scope of a project, with its effect on cost and timeline agreed before work starts.
- Clickable prototype A set of linked screens you can click through, built to test a design before the real software exists.
- Fixed-price contract A contract where the price for an agreed scope is set up front.
- Handover (software handover) Moving the code, accounts, documents and know-how of a product from the team that built it to the team that will run it.
- IP assignment The part of a contract that transfers ownership of code, designs and other work from the people who made them to the client.
- MVP (minimum viable product) The smallest version of a product that real users can use, built to test whether the core idea works.
- Open source license The terms under which open source code may be used, changed and shared, including what you owe in return.
- PaaS (platform as a service) Cloud hosting where you deploy your own application and the provider runs the servers, operating system and runtime underneath.
- Retainer (software retainer) An ongoing agreement where a client pays each month to reserve a set amount of a team's time.
- SaaS (software as a service) Software you use over the internet, usually by subscription, while the provider runs the application and everything under it.
- Source code escrow An arrangement where a vendor's source code is held by a neutral third party and released to the customer if agreed events happen.
- Statement of work (SOW) The document that sets out what a supplier will deliver, by when, for how much, and how the work will be accepted.
- Technical debt The future cost of shortcuts taken in code today.
- Time and materials (T&M) A contract where you pay for the hours actually worked, at agreed rates.
- Total cost of ownership (TCO) Everything a piece of software costs over its life, not just the price to build or buy it.
- Vendor lock-in When leaving a supplier, platform or tool would cost so much time or money that you are effectively stuck with it.
Running a build
How software gets scoped, designed, planned and shipped.
- Acceptance criteria The testable conditions a feature must meet before the person who asked for it accepts it as done.
- Backlog (product backlog) The ordered list of everything still to be built or fixed in a product, with the most important work at the top.
- Definition of done (DoD) The shared checklist every piece of work must pass, such as tested, reviewed and deployed, before the team calls it finished.
- Design system A shared set of reusable components, styles and usage rules that designers and engineers both build screens from.
- Discovery phase The short stretch before a build where the team works out the problem, the users, the scope and the rough cost.
- High fidelity prototype A prototype that looks almost exactly like the finished product, with final styling, real content and realistic interactions.
- Milestone A checkpoint in a project where an agreed piece of work is delivered, checked and, often, paid for.
- Product roadmap A plan showing what a product team intends to build over the coming months, and the goal behind each step.
- Proof of concept (PoC) A small, often throwaway build that tests whether one risky technical idea can work at all.
- Scope creep The slow growth of what a project must deliver, without a matching change to its time or budget.
- Sprint A fixed time box, one month or less and often two weeks, in which a team builds and shows a working piece of the product.
- Usability testing Watching real people try to complete real tasks with a product, to find where they get stuck.
- User story A short description of a feature from the point of view of the person who needs it, and why they need it.
- Velocity The amount of finished work a team completes in a sprint, used to forecast how much fits in the time left.
- Wireframe A simple, usually grey, sketch of a screen showing layout, content and actions, without final styling.
Reliability
Uptime, recovery and the promises made about them.
- RPO (recovery point objective) The point in time to which data must be recoverable after an outage: in practice, how much recent data you can afford to lose.
- RTO (recovery time objective) How long a system can stay down after a failure before the outage seriously harms the business.
- SLA (service level agreement) A contract that promises a level of service, such as uptime or support response time, and says what happens if it is missed.
- SLO (service level objective) An internal reliability target for a service, such as 99.9% of requests succeeding, measured by a service level indicator (SLI).
- Uptime The share of time a service is working and reachable, usually written as a percentage such as 99.9%.
LLM costs
How model usage is measured, billed and brought down.
- Batch API A way to send many LLM requests to run later, usually at a discount.
- Context window The most tokens a model can take in and produce in one request.
- Inference (AI) Running a trained AI model on new input to get an output, such as an answer, a label or an embedding.
- Model routing Sending each AI request to the model best suited to it, instead of using one model for everything.
- Prompt caching Reusing the processed start of a prompt across calls, so repeated input is billed at a lower rate.
- Token (LLM) The unit an AI language model reads and writes, and the unit most LLM APIs bill by.
AI building blocks
The parts that AI features in software are made of.
- AI agent Software where a language model decides which steps to take and which tools to call, in a loop, to reach a goal.
- Embedding (vector embedding) A list of numbers that represents the meaning of a piece of text, an image or other data, so that similar items have similar numbers.
- Fine-tuning Training an existing model further on your own examples so it behaves the way you want, such as following a format, tone or task more reliably.
- Guardrails (AI) Checks placed around an AI model that block, fix or flag unsafe, off-topic or incorrect inputs and outputs.
- Hallucination (AI) When an AI model produces information that is false or made up, presented as if it were true.
- Human-in-the-loop (HITL) A design where a person reviews, corrects or approves what an AI system produces before it takes effect.
- LLM (large language model) An AI model trained on very large amounts of text that predicts the next piece of text, which lets it read, write and reason in language.
- LLM evals (evaluations) Repeatable tests that score how well a model, prompt or AI feature does a specific task.
- RAG (retrieval-augmented generation) A pattern that finds relevant passages from your own data and gives them to a language model along with the question, so it answers from your content.
- Structured output Getting a language model to reply in a fixed, machine-readable format, such as JSON that matches a schema you define.
- Temperature (LLM setting) A setting that controls how random a language model's output is: lower is more predictable, higher is more varied.
- Tool calling (function calling) A way for a language model to ask your application to run a defined function and give it the result.
- Vector database A database built to store embeddings and quickly find the ones closest to a query vector.
Compliance
Rules that change how regulated software is built.
- Audit trail A secure, time-stamped history of who created, changed or deleted a record, kept so the record can be trusted later.
- BAA (business associate agreement) The contract HIPAA requires between a covered entity and a vendor that creates, receives, keeps or sends its PHI.
- Business associate (HIPAA) A person or company that creates, receives, keeps or sends protected health information on behalf of a HIPAA covered entity.
- Cardholder data environment (CDE) The people, processes and systems that store, process or transmit payment card data, plus the systems connected to them.
- Conformity assessment The process of showing that a product meets the EU rules that apply to it before it is placed on the market.
- Covered entity (HIPAA) Under HIPAA, a health plan, a healthcare clearinghouse, or a healthcare provider that sends health information electronically in standard transactions.
- Data controller (GDPR) Under the GDPR, the organisation that decides why and how personal data is processed, alone or jointly with others.
- Data processor (GDPR) Under the GDPR, an organisation that processes personal data on behalf of a controller and only on its documented instructions.
- Data residency Where data is physically stored and processed, and the laws or contracts that say where it may and may not go.
- Data subject request (DSR) A request from a person to use one of their GDPR rights over their personal data, such as access, correction, deletion or a copy to take elsewhere.
- DPA (data processing agreement) The contract the GDPR requires between a data controller and a processor that handles personal data for it.
- DPIA (data protection impact assessment) An assessment the GDPR requires before processing personal data in ways likely to put people's rights at high risk.
- Electronic signature (e-signature) A way of signing a document or approving a record electronically, so it carries the signer's intent the way a handwritten signature would.
- Encryption at rest Encrypting stored data, such as databases, files and backups, so it cannot be read without the key.
- Encryption in transit Encrypting data while it moves between systems, usually with TLS, so it cannot be read or changed on the way.
- ePHI (electronic protected health information) Protected health information that is stored or sent in electronic form, which is what the HIPAA Security Rule protects.
- GxP (good practice regulations) The family of good practice rules, such as manufacturing (GMP), clinical (GCP) and laboratory (GLP) practice, that regulated life sciences work must follow.
- High-risk AI system (EU AI Act) An AI system the EU AI Act places in its high-risk class, which brings extra duties before and after it is placed on the market.
- Lawful basis (GDPR) One of the six reasons listed in GDPR Article 6 that make processing personal data lawful, such as consent or a contract.
- Maker-checker (four-eyes principle) A control where one person makes a change and a different person must approve it before it takes effect.
- Minimum necessary (HIPAA) The HIPAA rule that covered entities and business associates should use, share or request only the PHI needed for the purpose at hand.
- PHI (protected health information) Health information that can identify a person and is created or held by a HIPAA covered entity or its business associate.
- SOC 2 Type II An independent audit report on whether a service organisation's controls were designed well and worked over a period of time.
Payments and fintech
Money movement, card rules and financial crime checks.
- AML (anti-money laundering) The laws, checks and controls that stop criminals from moving or hiding illegal money through financial services.
- AOC (attestation of compliance) The official PCI SSC form a merchant or service provider signs to attest to the results of its PCI DSS assessment.
- Chargeback A forced reversal of a card payment, started by the cardholder's bank after the cardholder disputes the charge.
- Double-entry bookkeeping Recording every transaction as equal debits and credits in at least two accounts, so the books always balance.
- Interchange fee The fee the merchant's bank pays the card-issuing bank on each card payment, usually the largest part of what a merchant pays to accept cards.
- KYB (know your business) Checking a business customer: that it legally exists, who owns and controls it, and how risky it is.
- KYC (know your customer) The checks a regulated business runs to confirm a customer is who they say they are and to judge the risk they pose.
- Ledger The record of every movement of money in a system, kept so that any balance can be explained entry by entry.
- Open banking Letting customers give licensed third-party apps access to their bank account data, or let them start payments, through secure bank APIs.
- PCI scope Every system, person and process that PCI DSS applies to, because it handles card data or can reach systems that do.
- PEP (politically exposed person) Someone who holds or held a prominent public role, or a family member or close associate of one, treated as higher risk for corruption.
- Reconciliation Checking that two records of the same money agree, such as your ledger and the bank or provider's statement, and explaining every difference.
- Sanctions screening Checking customers, counterparties and payments against government sanctions lists before letting money move.
- SAQ (self-assessment questionnaire) The PCI DSS form that eligible merchants and service providers use to document the results of their own assessment.
- Settlement (payments) The point when money for a payment actually moves into the receiver's account, after the payment was approved and cleared.
- Strong customer authentication (SCA) The EU rule under PSD2 that online payments and account access must be confirmed with two independent factors from different categories.
- Tokenization (payments) Replacing a card number or other sensitive value with a stand-in token that cannot be turned back into the original without the token service.
- Travel rule A rule that requires details of the sender and the recipient to travel with certain transfers of money or crypto-assets between financial institutions.
System design
How the parts of a product are split, connected and kept in step.
- API gateway A single entry point that sits in front of a system's APIs and handles routing, auth and limits for every request.
- Connection pooling Keeping a set of open database connections and sharing them across requests, instead of opening a new connection for each one.
- Data warehouse A database built for analysis and reporting, where cleaned data from many systems is kept together in one place.
- ETL (extract, transform, load) A data pipeline that pulls data out of source systems, cleans and reshapes it, and loads it into a destination such as a data warehouse.
- Event-driven architecture A way of designing software where parts of the system publish events about what happened, and other parts react to them on their own.
- Headless commerce An e-commerce setup where the shop front (the head) is built separately from the commerce engine that handles products, carts and orders, linked by APIs.
- Idempotency The property of an operation that has the same effect whether it runs once or several times, so it is safe to retry.
- Message queue A buffer that holds messages, such as tasks or events, until a worker is ready to process them, so the sender does not have to wait.
- Microservices A way of building an application as many small services, each owning one job and its own data, deployed independently.
- Multi-tenancy One running copy of a software product serving many customers, called tenants, with each tenant's data kept apart.
- Offline-first A way of building apps so they work fully without a network connection, saving changes on the device and syncing them when a connection returns.
- PWA (progressive web app) A web app built with standard web technology that can be installed on a device and work offline, giving an experience close to a native app.
- Rate limiting Capping how many requests a user, API key or address can make in a given time, to protect a system and share capacity fairly.
- Read replica A read-only copy of a database that is kept in sync with the main database and takes read queries off it.
- Sharding Splitting one large dataset across several databases, called shards, by a key such as customer ID, so each shard holds only part of the data.
- Webhook An HTTP request one system sends to a URL you choose as soon as an event happens, so you do not have to keep asking.
Hosting and delivery
Where software runs, how it ships and how you watch it.
- A/B test An experiment that shows two versions of something to random groups of users and measures which one does better on a chosen metric.
- APM (application performance monitoring) Tools that measure how fast and how reliably an application handles requests, and show which part of the code or which call is slow.
- Autoscaling Automatically adding or removing computing capacity, such as servers or containers, as the load on a system goes up or down.
- Blue-green deployment A release method that runs two identical production environments and switches all traffic from the old one to the new one in one step.
- Canary release A release method that sends a small share of users to a new version first, watches for problems, and widens the rollout step by step.
- CDN (content delivery network) A network of servers around the world that keeps copies of your files close to users, so pages and media load faster.
- CI/CD (continuous integration and delivery) An automated pipeline that builds and tests every code change (CI) and then releases it to users in a repeatable way (CD).
- Cold start The extra delay when a serverless function or a new server instance has to start up before it can handle a request.
- Container (software) A package that holds an application and everything it needs to run, isolated from other software on the same machine.
- Edge function A small piece of server code that runs on a CDN's servers around the world, close to the user, instead of in one central region.
- Egress (data transfer out) Data that leaves a cloud provider's network, such as files sent to users, which many providers bill per gigabyte.
- Feature flag A switch in the code that turns a feature on or off for chosen users at runtime, without deploying new code.
- IaaS (infrastructure as a service) Renting raw computing, storage and networking from a cloud provider, while you manage everything that runs on it.
- Infrastructure as code (IaC) Defining servers, networks, databases and other cloud resources in code files that are versioned and applied automatically, instead of setting them up by hand.
- Kubernetes (K8s) An open source platform that runs and manages containers across a group of machines: starting them, restarting them, scaling them and routing traffic to them.
- Load balancer A service that spreads incoming traffic across several servers, and stops sending traffic to any that fail their health checks.
- Object storage A way of storing files as objects in buckets, each with an ID and metadata, reached over HTTP and built to scale to huge amounts of data cheaply.
- Observability How well you can understand what a running system is doing, and why, from the data it gives off: logs, metrics and traces.
- Serverless A cloud model where the provider runs your code on demand and manages the servers, and you pay for what you use rather than for idle machines.
Identity and security
Logins, permissions and the checks that keep data safe.
- Audit log A record of who did what in a system, when and from where, kept so actions can be traced later.
- OAuth 2.0 A standard that lets an app get limited access to a user's account on another service, without ever seeing their password.
- Penetration test (pen test) An authorised, simulated attack on a system by security testers, to find weaknesses that a real attacker could use.
- RBAC (role-based access control) An access model where permissions are attached to roles, and people get access by being given a role.
- SAML (Security Assertion Markup Language) An open XML standard, SAML 2.0 from OASIS, that lets a company's identity provider vouch for a user when they log in to another app.
- SSO (single sign-on) One login, managed by an identity provider, that gives a person access to many separate apps.
Health software
Records, standards and rules behind clinical software.
- EHR (electronic health record) A digital record of a patient's health and care that is built to be shared with other providers, so it can follow the patient.
- EMR (electronic medical record) The digital version of a clinician's paper chart: a patient's medical and treatment history kept within one practice.
- FHIR (Fast Healthcare Interoperability Resources) A standard from HL7 for exchanging health data through modern web APIs, built from small, defined pieces called resources.
- HL7 (Health Level Seven) The standards body behind major health data standards, and the common name for its Version 2 messages that hospital systems use to exchange data.
- SaMD (software as a medical device) Software meant for one or more medical purposes that does that job on its own, without being part of a hardware medical device.
Accessibility
Standards and reports for software everyone can use.
- Accessibility audit A structured review of a website or app against an accessibility standard, usually WCAG, to find what blocks disabled people from using it.
- VPAT (Voluntary Product Accessibility Template) A free template from the Information Technology Industry Council (ITI) for reporting how well a product meets accessibility standards.
- WCAG 2.2 The version of the W3C Web Content Accessibility Guidelines published as a Recommendation on 5 October 2023, with nine new success criteria.
A to Z
Every term, alphabetically.
A
B
C
D
E
- Edge function
- Egress (data transfer out)
- EHR (electronic health record)
- Electronic signature (e-signature)
- Embedding (vector embedding)
- EMR (electronic medical record)
- Encryption at rest
- Encryption in transit
- ePHI (electronic protected health information)
- ETL (extract, transform, load)
- Event-driven architecture
H
I
M
P
R
S
- SaaS (software as a service)
- SaMD (software as a medical device)
- SAML (Security Assertion Markup Language)
- Sanctions screening
- SAQ (self-assessment questionnaire)
- Scope creep
- Serverless
- Settlement (payments)
- Sharding
- SLA (service level agreement)
- SLO (service level objective)
- SOC 2 Type II
- Source code escrow
- Sprint
- SSO (single sign-on)
- Statement of work (SOW)
- Strong customer authentication (SCA)
- Structured output
T
Questions
Answers and comparisons.
Longer answers that use these terms.
- Who owns the code when you hire a software agency?Question
- How do I reduce LLM API costs?Question
- Does my app need to be HIPAA compliant?Question
- Is my AI system high-risk under the EU AI Act?Question
- Should I pay fixed price or hourly for software?Question
- How long does it take to build an app?Question
- How much does an MVP cost?Question
- How much does a fintech app cost?Question
- How much does a telehealth app cost?Question
- How much does a marketplace app cost?Question
- What does software maintenance cost?Question
- Who pays for hosting after launch?Question
- How do I avoid vendor lock-in?Question
- How do I choose a software agency?Question
- How do I write a software RFP?Question
- What goes in a statement of work?Question
- What is a clickable prototype for?Question
- How do I handle technical debt?Question
- Should I build native or cross-platform?Question
- Should I build or buy software?Question
- How many developers do I need?Question
- How do I hand over a software project?Question
- How do I migrate off no-code?Question
- How do I plan a discovery phase?Question
- How do I price a SaaS product?Question
- What is a reasonable SLA?Question
- Does prompt caching save money?Question
- How do I estimate LLM costs?Question
- Which LLM API is cheapest?Question
- How much does an AI agent cost?Question
- How do I measure AI ROI?Question
- Should I use RAG or fine-tuning?Question
- Can I send PHI to an LLM?Question
- What is a BAA?Question
- Do I need SOC 2?Question
- Does GDPR apply to US companies?Question
- Does the European Accessibility Act apply to me?Question
- What is WCAG 2.2 AA?Question
- When do the EU AI Act rules apply?Question
- When do I need PCI DSS?Question
- What is the difference between KYC and KYB?Question
- What does ISO 27001 involve?Question
- What is DORA for fintech?Question
- AI agent vs workflow automationComparison
- RAG vs fine-tuningComparison
Tools
