Your developer has resigned or already left, and the system has to keep running. We review the system and give you a written report 48 hours after access: its state, the immediate risks and a plan for the first 30 days.
Maintenance and modernisation of long-running web applications
Our German-speaking senior team takes over, maintains and modernises business-critical applications together with their database, server and email. It is aimed at IT managers and development teams as well as at companies without an in-house IT department.
- We have looked after production ColdFusion and Lucee applications since 2015
- Meetings, quotes and documentation in German, Polish or English
- Reply within one working day
Which of these situations applies to you?
-
-
Your team is at capacity, a specific skill is missing, or you need a second opinion before an important decision? We take over a defined part: a module, the backend for your frontend, an interface, a migration or a code review. We work in your repository and ticket system, and the code and the knowledge stay with you.
-
According to Adobe, ColdFusion 2021 has received no security patches since 10 November 2025. We compare four routes: stay and harden, update, move to Lucee or replace the system step by step, with dates and risks (As of 2026-10).
-
Security updates for PHP 8.2 end on 31 December 2026, and for PHP 8.1 and older they have already ended (As of 2026-10). We move long-running PHP applications, including those with Smarty templates and jQuery front ends, to PHP 8.4 or 8.5 and test every stage.
-
Is your data being copied by hand between two systems today, or does a partner require an API? We connect existing applications via REST or SOAP, synchronise data between them and send transactional emails and notifications from your workflows.
-
Support for Debian 11 ended on 31 August 2026, and for CentOS 7 on 30 June 2024 (As of 2026-10). We will upgrade your server, or plan and carry out the move to Debian. We also work with Proxmox VE 8 and with physical servers that we move to Proxmox.
-
Google warns visitors about your website, visitors end up on unknown sites, or the hosting provider has suspended the account? We isolate the website, close the vulnerability and clean the website within 24 hours of access, weekends included. Afterwards you receive a written report.
Focus on ColdFusion and Lucee, plus PHP, Linux, JavaScript and Python
Where we can help you
-
Take over existing systems, document them and look after them continuously, with a backup test and a 30- and 90-day plan.
-
Version updates, Windows to Linux, Adobe ColdFusion to Lucee, database migrations and the path into containers, in stages and with a fallback plan.
-
Application and server reviewed before the pentest, findings from the report fixed, help within 24 hours after an attack, Craft CMS and WordPress hardened.
-
New functions, interfaces (REST, SOAP), a new frontend and standalone services alongside existing systems, with a clear scope and result.
-
Looking after Linux servers at any hosting provider: updates, backups with tests, virtualisation, security architecture with WAF and VPN, monitoring.
-
Find and fix the cause when invoices and one-time passwords land in spam: SPF, DKIM, DMARC, reputation, Postfix and Dovecot in operation.
-
Connect assistants and automation to existing systems, on request with locally operated models. Pilot with a fixed scope.
-
Meetings, quotes and documentation in German, plus the language bridge: interpreting and translation in IT projects.
From our projects
-
A shop flooded by bots that looked like customers
A WooCommerce shop with 52 products loaded slowly or not at all. The cause was a paid network of bots sending tens of thousands of requests an hour, each from a different home address, and every single bot behaved perfectly. Our engineers stopped the traffic at the edge of the network, and when the bots changed tactics a month later, the second rule took the load off within two minutes.
-
ColdFusion under load: diagnosing and fixing the JVM heap space error
An Adobe ColdFusion application ran without complaint at low traffic and returned errors and slowed down at peak hours. We reproduced the problem on a real database, measured the exact point at which the JVM heap runs out, and fixed the memory configuration, with the same load test before and after as the proof.
-
Email deliverability for four company domains
A mail server for four company domains signed nothing, published no DMARC policy and was rejected by Microsoft. Our engineers audited it, piloted the change on one domain and rolled it out in batches. The result: all three checks pass at Gmail, the Microsoft block was lifted, and the users noticed nothing.
Industries and systems our engineers have worked on
Among other things, our engineers have worked on business-critical platforms that have grown over many years, and on high-traffic portals:
- Loan platforms with several processes and sales channels, including work directly for banks
- Platforms for mortgage financing and leasing
- Systems that generate documents and contracts
- Video portals with streaming and automated video conversion
- High-traffic news and classifieds portals
- Web services of companies that work for the public sector, including cultural institutions
From intro call to first result
-
Intro call
You describe the goal and the state of the system, and we tell you openly whether and how we can help. You receive a first reply within one working day.
-
First assessment
We set out in writing which step makes sense and, where it fits, propose an entry product at a fixed price.
-
Entry product
We receive access to the system. You receive a written result that belongs to you.
-
Agreement and start
On that basis we agree the scope and how we work together. Code, access and documentation stay with you.
Who is behind Prownex
Prownex IT Services Sp. z o. o. is an IT services company based in Poland, in the European Union, founded in 2023. Its German-speaking senior team takes over, maintains, modernises and operates business-critical web applications for companies in Germany, Austria and Switzerland, with a focus on ColdFusion and Lucee alongside PHP, Linux, JavaScript and Python, including containerisation of existing applications, API development and application-specific WAF rules.
Our team speaks German, Polish and English fluently.
The first step, at a fixed price and with a written result
48-hour emergency assessment
For companies whose developer or service provider has suddenly left and whose system has to keep running regardless.
- Inventory: versions, dependencies, access, backups, scheduled tasks, data sources and outgoing email
- List of the risks that need attention immediately
- Stabilisation plan for the first 5 days and for the first 30 days
- Short meeting to go through the results
The result is with you 48 hours after we have access to the system. Changes to the production system and any further work happen only with your approval.
What the result contains
A written report on the state of the system, the immediate risks and the stabilisation plan. The report is yours.
Website first aid after an attack
For companies whose website has been hacked: Google warns visitors about it, visitors end up on unknown sites, spam appears in the search results, or the hosting provider has suspended the website.
- Isolate the website and preserve its current state before anything is deleted
- Find the point of entry: plugin, credentials, server or code
- Close the vulnerability or shield it temporarily
- Clean the website, from a backup taken before the attack where possible
- Renew passwords, keys and access credentials
- Request a review from Google if the website is flagged as dangerous
The 24 hours run from access, weekends included. Whether data has been taken cannot always be established with certainty; what we find is in the report. When Google removes the warning is up to Google. Further work after the first 24 hours starts only with your approval.
What the result contains
Within 24 hours of access, a contained and cleaned website and a written report on what happened technically, with the next steps to secure the website. The report is yours.
from €1,500 excl. VAT
Request website first aidLegacy review
For companies with a system that nobody knows well any more: before an update, before a migration or when changing service provider.
- Inventory of versions and dependencies
- Map of application, database, server and email
- Risk register covering security, support and knowledge
- Assessment of backups and restores
- Recommendation “stay, upgrade or migrate” with an options matrix that also covers “move into a container” and “expose as an API”
- Effort estimate in days
The price covers one system, meaning one application with its database and its server. We price further systems individually.
What the result contains
A written report with inventory, risk register, recommendation and effort estimate. The report is yours.
ColdFusion check
For companies with an application on Adobe ColdFusion or Lucee that want to know whether their installation is still supported and run securely.
- Version and patch level (Adobe ColdFusion 9 to 2025, Lucee 5 to 7)
- Reachability of the Administrator and RDS
- JVM, Tomcat and TLS
- Backups, scheduled tasks, data sources and outgoing email via cfmail
- Options for the platform: stay on current patches, upgrade the version or migrate to Lucee
The check does not cover application logic or code. That is what the legacy review is for.
What the result contains
A written list of findings in order of priority, with the options and a recommendation. The list is yours.
Questions clients ask us
When can you start?
You will receive a first reply within one working day. When we begin work depends on our current workload and on the scope. We give you a binding answer in the intro call. If it is urgent, the 48-hour emergency assessment starts as soon as we have access to the system.
What is your hourly rate?
It depends on scope, engagement model and urgency. Describe your situation briefly and, after a conversation, we will send you an offer. You do not need a budget for that. We quote fixed prices for the entry products.
Do you work with Jira, Git and SVN?
Yes, with Git and with SVN. We manage tasks in Jira or in the tool you already use. The code lives in your own repository and therefore stays in your hands.
Do we have to rewrite our system to use a new stack?
No. If the old system is running, we expose its logic as an API and close known security gaps as a one-off step. Its behaviour is meant to stay unchanged, and comparison tests check that. We then build the new part alongside it in the new stack, and it uses that API.
A rewrite is rarely worthwhile. It becomes an option when the framework is no longer maintained, there are no tests and the business rules can be written down. The legacy review clarifies whether that applies to you.
Do you cover weekend duty from time to time?
Yes. Support and emergencies are covered around the clock (24/7), weekends included. For other enquiries we are available Monday to Friday, 9:00 to 17:00 Central European Time, and we reply within one working day.
Describe your situation and we will reply within one working day
A few sentences are enough to start.
Phone (German, Polish, English)
+48 501 250 220
Email
Email
Reachable: Monday to Friday, 9:00 to 17:00 Central European Time; support and emergencies around the clock (24/7)