Your developer has resigned or already left, and the system has to keep running. We review the system and give you a written report 48 hours after access: its state, the immediate risks and a plan for the first 30 days.
Maintenance, modernisation and operations for your applications
Seven services for applications that have to keep running: takeover and maintenance, migration, security, development, Linux operations, email deliverability and AI integration. Choose by situation or by the job. To get started, there are entry products at a fixed price.
Choose by your situation
-
-
According to Adobe, ColdFusion 2021 has received no security patches since 10 November 2025. We compare four routes: stay and harden, update, move to Lucee or replace the system step by step, with dates and risks (As of 2026-10).
-
Security updates for PHP 8.2 end on 31 December 2026, and for PHP 8.1 and older they have already ended (As of 2026-10). We move long-running PHP applications, including those with Smarty templates and jQuery front ends, to PHP 8.4 or 8.5 and test every stage.
-
You want contracts, quotes and forms generated as PDF from your system's data, but their text depends on the individual case. We build a dedicated service with variables and text variants, which your system calls through an interface, without rebuilding the core of your software.
From the application and its database to the server and email
-
Take over existing systems, document them and look after them continuously, with a backup test and a 30- and 90-day plan.
-
Version updates, Windows to Linux, Adobe ColdFusion to Lucee, database migrations and the path into containers, in stages and with a fallback plan.
-
Application and server reviewed before the pentest, findings from the report fixed, help within 24 hours after an attack, Craft CMS and WordPress hardened.
-
New functions, interfaces (REST, SOAP), a new frontend and standalone services alongside existing systems, with a clear scope and result.
-
Looking after Linux servers at any hosting provider: updates, backups with tests, virtualisation, security architecture with WAF and VPN, monitoring.
-
Find and fix the cause when invoices and one-time passwords land in spam: SPF, DKIM, DMARC, reputation, Postfix and Dovecot in operation.
-
Connect assistants and automation to existing systems, on request with locally operated models. Pilot with a fixed scope.
How to find the service that fits your situation
You can commission the services individually or together. This list helps you choose:
- The developer has left, or nobody knows the system: Takeover and maintenance
- A version is reaching end of support, a server has to move, or a legacy system has to stay usable: Migration and modernisation
- A penetration test is coming up, a report lists vulnerabilities, or your website has been hacked: Web application and website security
- A feature, an interface or a document service is needed alongside the existing system: Development and integration
- Servers, virtualisation, WAF or logs need someone to look after them on an ongoing basis: Linux operations and infrastructure
- Invoices or one-time passwords end up in spam: Email deliverability
- You want to use AI on your own data: AI integration
If several of these apply, we begin with the most urgent. The legacy review, one of the entry products below, helps you set the order. It looks at application, database, server and email together and records the risks in writing, by priority.
If you are not sure which of these applies, describe your situation at the intro call. We tell you whether and how we can help, and we advise against a project that is not worth doing. How we work together is described on the How we work page.
The first step with a fixed price and a written result
48-hour emergency assessment
For companies whose developer or service provider has suddenly left and whose system has to keep running regardless.
- Inventory: versions, dependencies, access, backups, scheduled tasks, data sources and outgoing email
- List of the risks that need attention immediately
- Stabilisation plan for the first 5 days and for the first 30 days
- Short meeting to go through the results
The result is with you 48 hours after we have access to the system. Changes to the production system and any further work happen only with your approval.
What the result contains
A written report on the state of the system, the immediate risks and the stabilisation plan. The report is yours.
Website first aid after an attack
For companies whose website has been hacked: Google warns visitors about it, visitors end up on unknown sites, spam appears in the search results, or the hosting provider has suspended the website.
- Isolate the website and preserve its current state before anything is deleted
- Find the point of entry: plugin, credentials, server or code
- Close the vulnerability or shield it temporarily
- Clean the website, from a backup taken before the attack where possible
- Renew passwords, keys and access credentials
- Request a review from Google if the website is flagged as dangerous
The 24 hours run from access, weekends included. Whether data has been taken cannot always be established with certainty; what we find is in the report. When Google removes the warning is up to Google. Further work after the first 24 hours starts only with your approval.
What the result contains
Within 24 hours of access, a contained and cleaned website and a written report on what happened technically, with the next steps to secure the website. The report is yours.
from €1,500 excl. VAT
Request website first aidLegacy review
For companies with a system that nobody knows well any more: before an update, before a migration or when changing service provider.
- Inventory of versions and dependencies
- Map of application, database, server and email
- Risk register covering security, support and knowledge
- Assessment of backups and restores
- Recommendation “stay, upgrade or migrate” with an options matrix that also covers “move into a container” and “expose as an API”
- Effort estimate in days
The price covers one system, meaning one application with its database and its server. We price further systems individually.
What the result contains
A written report with inventory, risk register, recommendation and effort estimate. The report is yours.
ColdFusion check
For companies with an application on Adobe ColdFusion or Lucee that want to know whether their installation is still supported and run securely.
- Version and patch level (Adobe ColdFusion 9 to 2025, Lucee 5 to 7)
- Reachability of the Administrator and RDS
- JVM, Tomcat and TLS
- Backups, scheduled tasks, data sources and outgoing email via cfmail
- Options for the platform: stay on current patches, upgrade the version or migrate to Lucee
The check does not cover application logic or code. That is what the legacy review is for.
What the result contains
A written list of findings in order of priority, with the options and a recommendation. The list is yours.
Pre-pentest review
For companies facing a penetration test because a client, an auditor or a tender requires it, and who want to know beforehand where their application and server are open to attack.
- Application: input handling, login and sessions, permissions, file uploads, outdated libraries
- Server: open services, administration access, TLS, security headers, updates
- Configuration: error messages, debug output, accounts with default passwords
- List of findings by risk, with the effort for each finding
- Quick fixes before the test date, to the extent we agree with you after the review
We review one application with its servers. On the production system we change what you commission. The review does not replace a penetration test: it makes sure the test examines the difficult questions, not the obvious ones.
What the result contains
A written list of findings by risk with specific fixes, the status of the fixes already made and a plan up to the test date. The list is yours. After the test, we fix the findings from the report on request.
CMS check: WordPress and Craft CMS
For companies with a business-critical WordPress or Craft CMS website and no agency or maintainer any more: before a takeover, before a major update or after a security incident.
- Versions of CMS, PHP, database and server, and their support status
- Plugins and themes: what is maintained, what is abandoned and what should be replaced
- Updates: what is missing and how risky it is to catch up
- Backups: what is backed up and whether a restore has been tested
- Security: admin access, two-factor login, user permissions and known vulnerabilities
- Licences for the CMS and commercial plugins: which ones exist and in whose name they are registered
At this stage we change nothing on the website. We check custom themes and plugins for maintenance status and known vulnerabilities, not line by line. The check covers one website; we price further websites individually.
What the result contains
A written report with the risks in order of priority and a plan for takeover, updates and ongoing support. The report is yours.
Typically 2 working days
Request a CMS checkDatabase check: MySQL and MariaDB
For companies whose application depends on a MySQL or MariaDB database and who want to know what happens in a failure and whether yesterday's data can really be restored.
- Backups: what is backed up, how often and where the copies are kept
- A restore test on a separate system, with the time it takes measured
- Replication and resilience: what exists and what is missing
- The slowest queries and missing indexes
- Version, support status and configuration
- Recommendation: backup, replication or cluster, depending on your needs
A cluster such as MariaDB Galera protects against the failure of a server, not against deleted data. That takes tested backups, which is why we start with the restore test. We agree with you on the system it runs on. We change nothing on your production database.
What the result contains
A written report with the result of the restore test, the risks in order of priority and a recommendation with the effort involved. The report is yours. If you wish, we then set up the solution, including a Galera cluster.
Questions before you commission work
Do you do frontend and backend, or backend only?
Both. Our engineers have worked as full-stack developers since 2012. Typical tasks are a new frontend for an existing backend and the maintenance of jQuery frontends that have grown over the years. For new projects we recommend a front end on Node.js, for example with Next.js and React. We discuss in the intro call whether that suits your system.
Which projects have you already delivered?
Our engineers have worked on these types of system:
- Loan processing platforms, including work directly for banks
- Platforms for mortgage financing
- Leasing platforms
- Systems that generate documents and contracts
- Video portals with streaming and automated video conversion
- High-traffic news and classifieds portals
- Web services of companies that work for the public sector, including cultural institutions
Selected projects are described in detail on the projects page, among them ColdFusion in production and under load, email deliverability, a shop flooded by bots and SQL indexes in a shop database.
What is your hourly rate?
It depends on scope, engagement model and urgency. Describe your situation briefly and, after a conversation, we will send you an offer. You do not need a budget for that. We quote fixed prices for the entry products.
When can you start?
You will receive a first reply within one working day. When we begin work depends on our current workload and on the scope. We give you a binding answer in the intro call. If it is urgent, the 48-hour emergency assessment starts as soon as we have access to the system.
In 20 minutes we work out which first step fits your system
You tell us the goal and the current state, and we say openly whether and how we can help. Reply within one working day, no obligation.
Phone (German, Polish, English)
+48 501 250 220
Email
Email
Reachable: Monday to Friday, 9:00 to 17:00 Central European Time; support and emergencies around the clock (24/7)