Is the scope clearly described?
Then a fixed price suits you: an agreed result at an agreed price, for example for a review, a small migration or a single feature.
Engagement models and entry products at a fixed price
You describe what you need, and we tell you openly whether and how we can help. Then you choose the model that suits your project. We state fixed prices for the entry products only. For everything else you receive a quote after an intro call.
- Reply within one working day
- Code, access and documentation stay with you
Two questions decide which model suits you
If neither applies because the scope is still open, we work on a time and materials basis.
-
-
Is the need ongoing but uneven?
Then a monthly retainer suits you: a block of hours each month with an agreed response time.
What you get with each of the three models
| Criterion | Fixed price | Time and materials | Monthly retainer |
|---|---|---|---|
| What you get | A defined result, often a written report, at a price confirmed in writing beforehand. | Work on the agreed task by a senior engineer, organised by us, plus a weekly report and a warning before the agreed limit is reached. | A block of hours per month, an agreed response time, a fixed contact and a monthly report. |
| Typical example | The 48-hour emergency assessment when the person who knew the system is no longer there. | Further development of an application whose requirements become clear as the work progresses. | Ongoing care of an application and its server, with updates and small changes. |
Entry products with a fixed scope and a fixed price
48-hour emergency assessment
For companies whose developer or service provider has suddenly left and whose system has to keep running regardless.
- Inventory: versions, dependencies, access, backups, scheduled tasks, data sources and outgoing email
- List of the risks that need attention immediately
- Stabilisation plan for the first 5 days and for the first 30 days
- Short meeting to go through the results
The result is with you 48 hours after we have access to the system. Changes to the production system and any further work happen only with your approval.
What the result contains
A written report on the state of the system, the immediate risks and the stabilisation plan. The report is yours.
Website first aid after an attack
For companies whose website has been hacked: Google warns visitors about it, visitors end up on unknown sites, spam appears in the search results, or the hosting provider has suspended the website.
- Isolate the website and preserve its current state before anything is deleted
- Find the point of entry: plugin, credentials, server or code
- Close the vulnerability or shield it temporarily
- Clean the website, from a backup taken before the attack where possible
- Renew passwords, keys and access credentials
- Request a review from Google if the website is flagged as dangerous
The 24 hours run from access, weekends included. Whether data has been taken cannot always be established with certainty; what we find is in the report. When Google removes the warning is up to Google. Further work after the first 24 hours starts only with your approval.
What the result contains
Within 24 hours of access, a contained and cleaned website and a written report on what happened technically, with the next steps to secure the website. The report is yours.
from €1,500 excl. VAT
Request website first aidLegacy review
For companies with a system that nobody knows well any more: before an update, before a migration or when changing service provider.
- Inventory of versions and dependencies
- Map of application, database, server and email
- Risk register covering security, support and knowledge
- Assessment of backups and restores
- Recommendation “stay, upgrade or migrate” with an options matrix that also covers “move into a container” and “expose as an API”
- Effort estimate in days
The price covers one system, meaning one application with its database and its server. We price further systems individually.
What the result contains
A written report with inventory, risk register, recommendation and effort estimate. The report is yours.
ColdFusion check
For companies with an application on Adobe ColdFusion or Lucee that want to know whether their installation is still supported and run securely.
- Version and patch level (Adobe ColdFusion 9 to 2025, Lucee 5 to 7)
- Reachability of the Administrator and RDS
- JVM, Tomcat and TLS
- Backups, scheduled tasks, data sources and outgoing email via cfmail
- Options for the platform: stay on current patches, upgrade the version or migrate to Lucee
The check does not cover application logic or code. That is what the legacy review is for.
What the result contains
A written list of findings in order of priority, with the options and a recommendation. The list is yours.
Pre-pentest review
For companies facing a penetration test because a client, an auditor or a tender requires it, and who want to know beforehand where their application and server are open to attack.
- Application: input handling, login and sessions, permissions, file uploads, outdated libraries
- Server: open services, administration access, TLS, security headers, updates
- Configuration: error messages, debug output, accounts with default passwords
- List of findings by risk, with the effort for each finding
- Quick fixes before the test date, to the extent we agree with you after the review
We review one application with its servers. On the production system we change what you commission. The review does not replace a penetration test: it makes sure the test examines the difficult questions, not the obvious ones.
What the result contains
A written list of findings by risk with specific fixes, the status of the fixes already made and a plan up to the test date. The list is yours. After the test, we fix the findings from the report on request.
CMS check: WordPress and Craft CMS
For companies with a business-critical WordPress or Craft CMS website and no agency or maintainer any more: before a takeover, before a major update or after a security incident.
- Versions of CMS, PHP, database and server, and their support status
- Plugins and themes: what is maintained, what is abandoned and what should be replaced
- Updates: what is missing and how risky it is to catch up
- Backups: what is backed up and whether a restore has been tested
- Security: admin access, two-factor login, user permissions and known vulnerabilities
- Licences for the CMS and commercial plugins: which ones exist and in whose name they are registered
At this stage we change nothing on the website. We check custom themes and plugins for maintenance status and known vulnerabilities, not line by line. The check covers one website; we price further websites individually.
What the result contains
A written report with the risks in order of priority and a plan for takeover, updates and ongoing support. The report is yours.
Typically 2 working days
Request a CMS checkDatabase check: MySQL and MariaDB
For companies whose application depends on a MySQL or MariaDB database and who want to know what happens in a failure and whether yesterday's data can really be restored.
- Backups: what is backed up, how often and where the copies are kept
- A restore test on a separate system, with the time it takes measured
- Replication and resilience: what exists and what is missing
- The slowest queries and missing indexes
- Version, support status and configuration
- Recommendation: backup, replication or cluster, depending on your needs
A cluster such as MariaDB Galera protects against the failure of a server, not against deleted data. That takes tested backups, which is why we start with the restore test. We agree with you on the system it runs on. We change nothing on your production database.
What the result contains
A written report with the result of the restore test, the risks in order of priority and a recommendation with the effort involved. The report is yours. If you wish, we then set up the solution, including a Galera cluster.
What the price depends on
What a project costs depends on these points:
- Scope and type of collaboration
- Urgency, for example an immediate start
- Number of systems involved
- State of the documentation and access
- Confidentiality requirements and audit evidence
We do not publish hourly rates. After an intro call you receive a quote, and you do not need to bring a budget. For the entry products we confirm the price in writing before we start and do not change it afterwards. All prices are in euros, excluding VAT.
These rules apply in every model
- One working day
- That is how quickly you receive our first reply to your enquiry.
- As commissioned
- On the production system we change what you commission.
- With you
- Code, credentials and documentation stay in your hands, and the repository is normally yours.
- In writing
- Every entry product ends with a report that belongs to you.
Engineers work on your code, AI only if you ask for it
Conventional engineering is our default, especially for legacy systems: we read, change, test and document the code ourselves. No AI tool sees your code, your data or your documents.
At your request we build new components with AI assistance, for example a new service alongside your existing system. We then agree the tools and the environment with you. A senior engineer is responsible for every change; review, tests and acceptance stay the same. You can rule AI out again at any time.
In-house employee, freelancer, agency, Prownex: what suits what
| Criterion | In-house employee | Freelancer | Agency | Prownex |
|---|---|---|---|---|
| Typical use | A lasting need with a broad range of tasks. | A clearly defined task, started at short notice. | New development, concept and design. | Takeover, maintenance and modernisation of long-running systems, including their database, server and email. |
| Knowledge and cover | The knowledge sits with the person, and you organise the handover. | The knowledge sits with the person, and cover has to be agreed. | The knowledge is spread across several people, depending on the project. | Documentation and cover on request. The repository is normally yours. |
| Responsibility | You manage the employee and are responsible for the result. | It depends on the arrangement: for the task, or only for the working time. | The agency is responsible for the agreed project result. | We are responsible for the agreed result. |
| What to look out for | How knowledge is passed on when the person leaves. | Who covers in case of absence and who documents. | Whether looking after legacy systems is part of the offer. | At the intro call we tell you whether our capacity fits your project. |
From the intro call to the first five days in the system
-
Intro call
We reply to your enquiry within one working day. In the call (about 20 minutes) you describe the goal and the current state. We ask about the technology, who is involved and any constraints.
-
First assessment
We note in writing which step makes sense and, where it fits, propose an entry product. We also say so when a project is not worth doing, such as an unnecessary rewrite.
-
Access
Then we receive access to the system.
-
Entry product
We work through the agreed scope at the confirmed price. You receive a written report, even if you continue without us afterwards.
-
The first five days
In a takeover we secure credentials and backups, test that a restore works and rank the risks.
-
Agreement
Based on the findings, we agree the model, scope and process for the work that follows.
What happens if someone on our side is unavailable?
With legacy systems, knowledge often depends on one person, so the question is a fair one. Our answer:
- We write the documentation on request.
- The repository is normally with you, so the code stays in your hands.
- We arrange cover on request.
More about us is on the About page. The Experience page describes the systems our engineers have worked on.
Questions about working together
What is your hourly rate?
It depends on scope, engagement model and urgency. Describe your situation briefly and, after a conversation, we will send you an offer. You do not need a budget for that. We quote fixed prices for the entry products.
When can you start?
You will receive a first reply within one working day. When we begin work depends on our current workload and on the scope. We give you a binding answer in the intro call. If it is urgent, the 48-hour emergency assessment starts as soon as we have access to the system.
Do we have to stay with you after the legacy review?
No. The legacy review is a separate engagement with a fixed scope and price. The report is yours, even if you continue on your own afterwards or commission another provider. We discuss whether ongoing support follows once the findings are in.
Do you work with Jira, Git and SVN?
Yes, with Git and with SVN. We manage tasks in Jira or in the tool you already use. The code lives in your own repository and therefore stays in your hands.
Can we hand over only part of the project, for example the backend?
Yes. The boundary is the interface: we describe it together with your team before the first line of code is written, and we provide a test environment with sample data from the start, so that the frontend can be built in parallel. We also agree in writing who deploys and who runs the part after the launch. In the same way we take over a single module, an interface to a partner's system or a new frontend for an existing backend.
Do you work on your own hardware, or do we need to provide a laptop?
We work on our own hardware. We set up access to your systems through a VPN, SSH or a remote desktop. We need a device from you only if you prefer that.
Do you cover weekend duty from time to time?
Yes. Support and emergencies are covered around the clock (24/7), weekends included. For other enquiries we are available Monday to Friday, 9:00 to 17:00 Central European Time, and we reply within one working day.
Do you use AI tools when developing?
By default, no. People work on your code. We use AI tools there only where you want us to. You can exclude them again at any time.
How good is your German?
Perfect: we speak German natively and fluently. Our engineers have worked with German-speaking clients for years. Meetings, quotes and documentation are written in German; more on the page German-speaking IT partner.
How good is your Polish?
Perfect: we speak Polish natively and fluently. Our engineers have worked with Polish-speaking clients for years. Between German and Polish teams we interpret in both directions, see the language bridge.
Describe your situation and we will reply within one working day
A few sentences are enough to start.
Phone (German, Polish, English)
+48 501 250 220
Email
Email
Reachable: Monday to Friday, 9:00 to 17:00 Central European Time; support and emergencies around the clock (24/7)