# What Is a Backend? Meaning, Components, and Examples

> A backend is the server-side part of an app that handles data, business logic, and security. Learn frontend vs backend, components, how it works, and examples.

**URL:** https://www.ciptadusa.com/blog/backend-adalah  
**Type:** blog  
**Author:** PT Cipta Dua Saudara  
**Category:** Engineering  
**Published:** 2026-10-25  
**Cover:** https://www.ciptadusa.com/media/uploads/blog/2026-10/1792895167252-backend-adalah-20261025.webp  

## Article

The backend is the part of an application that runs on the server and stays out of the user's sight. It stores and processes data, runs business rules, checks who is allowed to access what, and sends the results to the screen the user sees. AWS puts it this way: the frontend is what your users see, while the backend is the data and infrastructure that make your application work ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).

A simple example: when a customer taps "Order" in an app, the backend receives that request, checks stock in the database, calculates the total, saves the order, and replies "order placed" to the customer's screen. This article covers what a backend is, how it differs from the frontend, its components and how it works, its functions, the languages and frameworks used, security, the backend developer role, and what a business should prepare before building one.

## What Is a Backend?

The backend is also called the server side. AWS explains that when users interact with the frontend, the interaction sends a request to the backend in HTTP format, and the backend processes the request and returns a response ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).

MDN, Mozilla's web documentation, notes that most of the code supporting a dynamic website must run on the server, and that writing this code is known as server-side programming or back-end scripting. According to MDN, server-side code handles tasks like validating submitted data and requests, using databases to store and retrieve data, and sending the correct data to the client ([source](https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Server-side/First_steps/Introduction)).

One nuance is worth knowing. Cloudflare distinguishes "server side" as the location where processes run, while "backend" refers to the kinds of processes that run there ([source](https://www.cloudflare.com/learning/serverless/glossary/client-side-vs-server-side/)). In everyday conversation the two terms are used interchangeably, and this article uses them the same way.

### Which Part of a Website Is the Backend?

On a website, the backend is everything working behind the page: application code on the server, the database, and the services connected to it. The pages, buttons, and forms you see in the browser belong to the frontend. When you log in, search for a product, or fill in a contact form, the frontend sends data to the backend, and the backend decides what response to send back.

MDN separates static and dynamic sites. A static site returns the same hard-coded content whenever a page is requested. A dynamic site generates some of its content only when needed, for example by inserting data from a database into HTML templates ([source](https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Server-side/First_steps/Introduction)). The more dynamic a website or app is, the bigger the role its backend plays.

## Frontend vs Backend

AWS compares the frontend to a car's exterior and the backend to the machinery inside: a beautifully designed car only runs well if its internal machinery works properly ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)). A summary of the differences:

| Aspect | Frontend | Backend |
| --- | --- | --- |
| Where it runs | The browser or app on the user's device | The server |
| Focus | Look, interaction, user experience | Data, business logic, security, system performance |
| Technology | HTML, CSS, JavaScript, frontend frameworks | Programming languages such as Java, Python, Ruby, PHP, plus APIs and database management systems |
| Concurrency | Each user has their own copy of the app | Handles many requests from many users at the same time |
| Security | Input validation and authentication flows on the user's side | Authentication, access control, session security, protection of data at rest and in transit |

The table is summarized from the AWS comparison ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)). For the interface and user experience side, see [what UI UX is](/en/blog/ui-ux-adalah).

A developer who works on both sides is called a full-stack developer. AWS defines this as a developer with skills in both frontend and backend development ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).

## Backend Components

A backend is not a single program. It is made of several parts working together:

- **Application code on the server.** Where business rules live, such as how discounts are calculated, who can approve an order, or when a notification goes out.
- **Database.** Permanent storage for data such as customers, products, transactions, and history. AWS notes that the backend works with database servers to retrieve or modify relevant data ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).
- **API.** The interface the frontend, a mobile app, or another system uses to talk to the backend. AWS defines an API as a mechanism that enables two software components to communicate with each other using a set of definitions and protocols ([source](https://aws.amazon.com/what-is/api/)).
- **Authentication and authorization.** Authentication confirms who the user is; authorization confirms what that user is allowed to do.
- **Third-party services.** Payment gateways, email delivery, WhatsApp APIs, or file storage. AWS notes that the backend can also call third-party APIs and microservices to complete part of a task ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).
- **Cache.** Temporary copies of data that is requested repeatedly, such as database query results or API responses, to reduce server load ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).
- **Servers and infrastructure.** The machines, containers, or cloud platforms where everything above runs, including the release pipeline and monitoring covered in [what DevOps is](/en/blog/devops-adalah).

## How a Backend Works

MDN describes the basic flow: the browser sends an HTTP request to the server. The request includes a URL identifying the resource, a method that defines the action (for example GET or POST), and may carry extra information in URL parameters, POST data, or cookies. The server processes the request and replies with an HTTP response containing a status line, such as "200 OK" on success ([source](https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Server-side/First_steps/Introduction)).

An illustrative order flow in a distributor's app (an example to explain the concept, not data from a real project):

1. A sales rep taps "Submit Order" in the app. The frontend sends a POST request with the customer ID, item list, and quantities to the backend API.
2. The backend checks the rep's login token and confirms the rep is allowed to place orders for that customer.
3. The backend validates the data: the items exist, the quantities make sense, and the customer is within their credit limit.
4. The backend reads stock and prices from the database, calculates the total, and saves the order in a single transaction so data is never half-saved.
5. The backend calls other services, for example notifying the warehouse or creating a draft invoice in the accounting system.
6. The backend returns a response to the app with the order number and status. The frontend shows it to the rep.

Steps 2 to 5 are invisible to the user, yet that is where the company's business rules run. If the order also needs to reach an ERP or CRM, the connection patterns are covered in [what system integration is](/en/blog/integrasi-sistem-adalah).

## What a Backend Does

MDN lists several uses of server-side programming ([source](https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Server-side/First_steps/Introduction)):

- **Efficient storage and delivery of information.** Data is stored in a database and assembled into pages or returned as JSON/XML for the frontend to render. Because the data lives in a database, it can also be shared with other business systems more easily, for example inventory updated whether a product sells online or in a shop.
- **Customized user experience.** The server can store user preferences and use them to show relevant content.
- **Controlled access to content.** Only authorized users can see or change certain data. MDN gives the example of banks that only let authorized users view accounts and make transactions.
- **Session and state information.** The server knows a user has logged in and can show their order history.
- **Notifications and communication.** The server sends email, SMS, instant messages, or alerts to administrators.
- **Data analysis.** User behavior data is processed to refine future responses.

In a business setting, these functions show up as features such as staff login, multi-level approvals, daily reports, stock sync, and automatic customer reminders. Systems like [CRM](/en/blog/crm-adalah), [ERP](/en/blog/erp-adalah), and [SaaS applications](/en/blog/saas-adalah) all rely on a backend that stores and processes that data.

## Backend Programming Languages and Frameworks

MDN says server-side code can be written in many languages, giving PHP, Python, Ruby, C#, and JavaScript (Node.js) as examples. MDN also notes that developers would almost never write the server component of a web app without a framework, because frameworks provide common functionality such as sessions, user authentication, database access, and templating ([source](https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Server-side/First_steps/Introduction)). AWS names frameworks such as Django, Ruby on Rails, and Laravel, and adds that backend developers need to know how to design relational and nonrelational databases ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).

| Language | Example framework |
| --- | --- |
| PHP | Laravel |
| Python | Django |
| Ruby | Ruby on Rails |
| JavaScript/TypeScript | Node.js (runtime) with frameworks such as Express or Next.js |
| Go | The net/http standard library or a lightweight framework |

This table lists examples, not a ranking. The choice of language should weigh the skills of the team that will maintain the system, performance needs, the library ecosystem, and long-term hosting costs. At CDS the stack is chosen per project, and our services page lists Laravel + PHP, Node.js, Go, MySQL, SQLite / Cloudflare D1, Cloudflare Workers, and REST APIs and webhooks ([source](/en/services/software)).

## Backend Security

Because the backend holds the data and business rules, its security cannot be left to the frontend. MDN states that client-side validation should not be considered an exhaustive security measure: apps should always validate and security-check form data on the server side as well, because client-side validation is too easy to bypass ([source](https://developer.mozilla.org/en-US/docs/Learn_web_development/Extensions/Forms/Form_validation)).

AWS says backend security covers authentication, access control, session security, and protecting data at rest and in transit, with core practices including secure coding, encryption of sensitive data, and secure authentication and authorization systems ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).

For backends that expose an API, the OWASP API Security Top 10 2023 is a reference list of risks. Several are relevant to business applications ([source](https://owasp.org/API-Security/editions/2023/en/0x11-t10/)):

- **Broken Object Level Authorization.** An endpoint accepts a data ID from the user without checking whether that user is entitled to that data. For example, changing the ID number in a URL and seeing another customer's order.
- **Broken Authentication.** Login or token mechanisms implemented incorrectly, letting an attacker assume another user's identity.
- **Broken Function Level Authorization.** An unclear split between admin and regular functions, so a regular user can call admin functions.
- **Unrestricted Resource Consumption.** No usage limits, so excessive requests can cause denial of service or higher costs, including services paid per request such as SMS or email.
- **Security Misconfiguration.** Server and API configuration that does not follow security best practices.
- **Unsafe Consumption of APIs.** Data from third-party APIs is trusted without the same checks applied to user input.

A practical walkthrough for Next.js apps is in [Next.js security and deployment](/en/blog/nextjs-security-deployment).

## What Is a Backend Developer?

A backend developer builds and maintains the server-side operations of an application. AWS says their main goal is to create reliable architecture that performs application functions accurately and efficiently, while meeting user requirements along with security and cost considerations ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).

Backend developer tasks, summarized from the components and functions above:

- Designing the database structure and its data relationships.
- Writing business logic and the APIs used by the frontend and other systems.
- Implementing authentication, authorization, and server-side validation.
- Connecting the application to third-party services such as payments, email, or WhatsApp.
- Keeping performance in check through caching, efficient queries, and handling many requests at once.
- Writing tests and API documentation, and helping monitor the system after release.

The skills AWS lists for this role include coding, database management, an understanding of code security, and using application development tools, platforms, and frameworks ([source](https://aws.amazon.com/compare/the-difference-between-frontend-and-backend/)).

## What a Business Should Prepare Before Building a Backend

Business owners do not need to write backend code, but early decisions determine whether the system is easy to maintain. The checklist below is CDS internal guidance, not an official standard:

- **What data is stored and who owns it.** Define the core data (customers, products, transactions) and which system is its source of truth.
- **Written business rules.** Discounts, approvals, credit limits, and status flows should be documented before they become code.
- **Roles and permissions.** Who can view, change, and approve what.
- **Required integrations.** Accounting systems, marketplaces, payment gateways, WhatsApp, or legacy applications whose data needs to move.
- **Hosting and code ownership.** Where the backend runs, who holds server access, and whether the source code and documentation are handed over to you.
- **Maintenance plan.** A backend needs security updates, backups, and monitoring after release. The components are covered in [app maintenance costs](/en/blog/biaya-maintenance-aplikasi).

Budget estimates for building an application, including its backend, are covered in [web application development costs](/en/blog/biaya-pembuatan-aplikasi-berbasis-web). If you are still weighing off-the-shelf against custom software, read [when a business needs custom software](/en/blog/kapan-bisnis-butuh-software-custom-2026).

## Backends in CDS Projects

In our [custom software development service](/en/services/software), the backend is built together with web apps, mobile apps, e-commerce, and internal dashboards, including API integrations. Every release includes full source code, staging and production environments, technical and architecture documentation, and a CI/CD pipeline. Work runs in two-week sprints with a demo every Friday, and the Ship stage covers QA, data migration, production deployment, and monitoring after release ([source](/en/services/software)).

One backend we develop ourselves is [Zetta CRM](/en/incubating/zetta-crm), a CRM backend for AI agents. Zetta CRM is a Go-based MCP server that runs as a single binary, is self-hosted, uses MySQL, and is accessed through an API-key gated endpoint ([source](/en/incubating/zetta-crm)). You can see other client projects on our [works](/en/works) page.

If your current system architecture needs fixing before you add features, our [IT consulting](/en/services/consulting) team can help design the target architecture, module separation, integrations, security, and a phased migration path.

## Backend FAQ

### What is a backend in simple terms?

The backend is the part of an application on the server that users do not see. It stores data, runs business rules, checks access rights, and sends results to the app's interface.

### What is the difference between frontend and backend?

The frontend is the interface users see and use in a browser or app. The backend is the data and infrastructure on the server that make the application work. The frontend sends requests; the backend processes them and replies.

### Does a company profile website need a backend?

A static website whose content does not need to be changed through a system can run without a dedicated backend. Once the site needs logins, forms saved to a database, a CMS for editing content, or integration with other systems, it needs a backend.

### Which programming languages are used for the backend?

Examples include PHP, Python, Ruby, C#, JavaScript (Node.js), Java, and Go. The right choice depends on the team's skills, performance needs, and long-term maintenance costs.

### What is a backend developer?

A backend developer builds and maintains the server side of an application: the database, business logic, APIs, security, and performance.

### Is an API the same as a backend?

No. An API is the door the frontend or other systems use to communicate with the backend. The backend includes the API, but also the database, business logic, and infrastructure behind it.

## Need a Reliable Backend for Your Business App?

The backend determines whether your business data is secure, consistent, and able to connect with other systems. CDS helps design and build backends for web apps, mobile apps, internal dashboards, and API integrations, with source code and documentation handed over to your team. Discuss your needs through our [software services](/en/services/software) page, or explore [Zetta CRM](/en/incubating/zetta-crm) if you need a self-hosted CRM backend.


---

*Markdown version of https://www.ciptadusa.com/blog/backend-adalah — generated for AI agents and LLM crawlers.*