Support & Maintenance
Live systems kept current, secure and improving — including ones we did not build.
A live website or application does not stay safe on its own. When the team that built it has left, updates stop, and nobody can say what is running or who answers for it.
Every agreement starts with a technical audit of the code, dependencies, hosting, access and backups, including systems another team built. The agreement then covers the system as it actually runs, not as its documentation describes it.
What the data says
Most breaches now start with software that was not updated. Support is how a live system stays updated.
of breaches now start with a software vulnerability. It has overtaken stolen passwords as the most common way attackers get in
Verizon DBIR, 2026of US critical-infrastructure organisations in CISA's vulnerability scanning in fiscal years 2024 and 2025 ran unsupported software. That software was linked to over half of known exploited vulnerabilities
CISA, 2026of respondents to the OWASP Top 10 2025 community survey ranked software supply chain failures as the top risk. The category covers vulnerable, unsupported and out-of-date components
OWASP Top 10, 2025Independent data. Each figure links to its original source.
Who it is for
Organisations with a yearly support budget
Institutions, companies and public bodies that plan support as an annual budget line. One contractor keeps a business-critical system working and reports on it.
Teams with an inherited system
The team that built the system has left. It is audited and taken over safely before anyone decides whether to rebuild it.
Webiland clients after launch
The team that built the system keeps it current and improves it within an agreed scope.
What's Included
Takeover of existing systems
Websites, web platforms and applications built by another team are taken over after an audit. Access is transferred and documented, and monitoring is connected.
Technical audit
Code, dependencies, hosting, access and backups are reviewed first. You get a written list of what was found and what must be fixed before support starts.
Monitoring and alerting
Uptime, errors and certificate expiry are monitored, with alerts sent to the team on duty.
Updates and security fixes
Framework, CMS, runtime and dependency updates are tested before release, not applied directly on the live server. Components that no longer get security updates are named in the report.
Backups and recovery
The backup schedule is checked, and a restore test is run at every takeover, not only written down.
Fixes, improvements and reporting
Bug fixes and small improvements are delivered within the agreed scope. Each report states what was done, what was found and what needs attention next.
Technologies
The tools we use on this work. Every stack is chosen per project, in the written scope.
- Sentry
- Grafana
- Prometheus
- Datadog
- GitHub Actions
- GitLab CI
- Docker
- Cloudflare
Our Process
Technical Audit
Code, dependencies, hosting, access and backups are reviewed first. Anything that blocks safe support is named before the agreement is signed.
Written Agreement
Coverage, response terms per severity, reporting and term are written down. The agreement runs monthly or for a year.
Takeover
Access is transferred and documented, monitoring is connected, and the blocking issues found in the audit are resolved.
Ongoing Support
Updates, security fixes, bug fixes and small improvements are delivered within the agreed scope, through a tested release process.
Periodic Review
Each review covers what was done and what the system needs next. A larger change becomes its own project, with its own scope.
Frequently Asked Questions
Ready to get started?
Tell us about your project. We research before we quote, and you receive a written scope and an itemized estimate — no guesswork, no invoice for the thinking.
- Scope agreed in writing
- Full IP ownership
- Reply within one business day