000 — MAINTENANCE & SLA
Software maintenance with an SLA a CTO would actually sign.
We keep running software at 100: monitoring, incident response, security updates and technical debt paid down every month while features keep shipping. For CTOs and product owners who want a senior team on call without hiring one. Care plans from €490 per month, Care Plus with a 99.9% availability target from €1,490. Onboarding takes about two weeks.
001 — Sound familiar?
Shipping is the easy part. Running it is the job.
- Dependencies are a year behind because every upgrade breaks something, and the security advisories keep coming.
- Incidents are handled by whoever happens to notice, with no runbook and no postmortem.
- The backlog is all features. Tech debt only gets discussed when it causes an outage.
- Backups exist. Nobody has ever tried restoring one.
- Your previous vendor promised "100% uptime" and delivered a shrug when production went down on a Friday night.
- The Cyber Resilience Act, the Accessibility Act and NIS2 are on your desk, and no one owns them.
002 — What's included
What a care plan covers
A care plan is a standing engagement with a fixed monthly scope. We operate your software the way we would operate our own: measured, documented and boring in the best way.
A credible SLA
99.9% monthly availability on systems we host or operate — roughly 43 minutes of downtime a month, excluding maintenance announced 48 hours ahead. Below target you get service credits: 10% of the monthly fee below 99.9%, 25% below 99.0%, 50% below 95.0%. We commit to response times, not fix times, because nobody honest can promise when an unknown bug is fixed. Uptime on third-party infrastructure inherits that provider's SLA.
Tech debt paid down while features ship
A fixed share of every month's hours is reserved for debt, written into the plan and reported. We replace fragile parts incrementally, strangler-fig style (Fowler), never with a big-bang rewrite that freezes your roadmap. Tech debt amounts to 20–40% of the value of a technology estate (McKinsey); left alone, it compounds.
DORA metrics, monthly
Deployment frequency, lead time for changes, change failure rate and time to restore — the four DORA keys — reported every month, so you can see delivery getting faster and safer, not just hear it.
Dependency and security updates
Automated dependency PRs reviewed and merged on a schedule, security advisories triaged within the response targets, framework upgrades planned instead of postponed.
Observability and on-call
Error tracking, structured logs, traces, uptime checks from outside, and alerts on the symptoms users feel. Incidents get a runbook, a timeline and a blameless postmortem.
Backups and restore drills
Automated, encrypted backups with defined retention — and a restore drill on a schedule, with the result documented. A backup you have never restored is a hope, not a backup.
EU compliance readiness
Cyber Resilience Act reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026, full obligations from 11 December 2027. We maintain the vulnerability-handling process, SBOMs and incident timelines you need. Plus WCAG 2.2 AA for the European Accessibility Act, a GDPR Article 28 DPA, and NIS2 readiness work for Slovak and Czech entities in scope.
Who hands us their running product
- CTOs of software companies who want senior operations and maintenance capacity without growing headcount.
- Product companies whose original developers or agency moved on, leaving a live system nobody fully owns.
- Teams that ship features fast and need someone to keep the platform, dependencies and debt under control.
- Companies selling to enterprises or regulated customers who need a written SLA and compliance answers.
- Founders after a rescue or a new build who want it kept at 100.
003 — How it works
How onboarding works
Takeover audit
Repository, infrastructure, dependencies, monitoring, backups and access. We find what would page someone at 3 a.m. and fix the worst of it first.
Week 1
Baseline and runbooks
Monitoring and alerts wired, a first restore drill done, runbooks written, DORA baseline measured. The SLA clock starts when the baseline is in place, not before.
Week 2
Operate
Incident response to the plan's targets, scheduled updates, monthly debt paydown and feature work from the same hour budget.
Ongoing
Monthly review
A written report: availability, incidents and postmortems, DORA metrics, debt paid down, security updates, and the plan for next month. A 30-minute call if you want one.
Monthly
004 — Pricing
Care plans
Monthly, cancellable, with no lock-in beyond the current month. The hour budget and scope are written into each plan; unused priority work rolls into debt paydown, not into thin air.
Care
from €490
per month
- Monitoring, uptime checks and error tracking
- Dependency and security updates
- Response targets in business hours (CET)
- Backups with quarterly restore drill
- Small fixes and improvements
- Monthly report
Care Plus
Most chosenfrom €1,490
per month
- 99.9% monthly availability with service credits
- P1 response within 1 business hour
- Fixed monthly share reserved for tech debt
- DORA metrics reported monthly
- Monthly restore drill and postmortems
- CRA, EAA, GDPR and NIS2 readiness support
Custom 24/7
On request
custom quote
- Out-of-hours on-call rotation
- Response targets around the clock
- Custom availability target and credits
- Dedicated capacity for feature work
Every plan is quoted and fixed before it starts, after a takeover audit. Leave anytime: you keep the code, infrastructure, runbooks and a handover pack.
005 — Definition of done
What we hold ourselves to
Stack
- GitHub Actions
- Renovate
- Sentry
- OpenTelemetry
- Grafana
- Better Stack
- Playwright
- Docker
- Terraform
- PostgreSQL
definition_of_done.md
Respond, then fix
We commit to response times by priority and report against them monthly. Fix times are estimated per incident and communicated honestly.
Every change through CI
No hotfix bypasses the pipeline. Type checks, tests, a build and a preview deploy run on every change — including at 3 a.m.
Tests grow with the system
Every incident and every bug fix leaves a test behind, so the same failure cannot ship twice.
Observability before features
If we cannot see it, we cannot operate it. New features ship with logs, metrics and alerts, or they do not ship.
Postmortems, not blame
Every P1 and P2 gets a written postmortem: timeline, root cause, what we changed so it does not repeat.
Docs, ADRs and runbooks
Every non-obvious decision gets a short architecture decision record. Every operational task — deploy, rollback, restore, rotate a secret — gets a runbook someone else can follow at 3 a.m.
Your repo and cloud from day one
Code lives in your GitHub organisation and runs in your cloud accounts from the first commit. Full IP transfers to you on payment. No hostage situations, ever.
006 — Compare the options
Response targets by priority
| Priority | What it means | Care | Care Plus |
|---|---|---|---|
| P1 — critical | Production down or data at risk for all or most users | Within 4 business hours | Within 1 business hour |
| P2 — high | Major feature broken, no workaround | Within 1 business day | Within 4 business hours |
| P3 — normal | Feature degraded, workaround exists | Within 2 business days | Within 1 business day |
| P4 — low | Cosmetic issue, question or improvement | Next monthly planning | Within 3 business days |
007 — Questions buyers ask
Questions buyers ask
What does software maintenance cost?
Care starts from €490 per month, Care Plus — with the 99.9% availability target, service credits and 1-business-hour P1 response — from €1,490. Custom 24/7 coverage is quoted on request. The exact plan is fixed after a takeover audit, based on the size and risk of your system.
Why not promise 100% uptime?
Because nobody can deliver it, and a vendor who promises it is either not measuring or not telling you. 99.9% monthly availability means roughly 43 minutes of downtime a month, excluding maintenance announced 48 hours ahead, with service credits if we miss. That is a number you can hold us to.
How do you handle tech debt without stopping feature work?
A fixed share of every month's hours goes to debt, written into the plan and reported in the monthly review. We pick the debt that slows features down most, and replace fragile parts incrementally behind stable interfaces. Your roadmap keeps moving; the codebase gets easier to change every month.
Can you take over a system someone else built?
Yes — that is most of our maintenance work. The takeover audit in week one maps the risks and access, and we fix the scariest items before the SLA clock starts. If the system turns out to be AI-built and fragile, we will tell you and propose a rescue first.
What timezone do you cover, and what about nights and weekends?
Care and Care Plus response targets run on business hours in CET, Monday to Friday. If your product needs response at night or on weekends, the Custom 24/7 plan adds an on-call rotation with round-the-clock targets.
What if you disappear, or we want to leave?
You are covered either way. Code, infrastructure and monitoring live in your accounts; runbooks and ADRs document everything we know. Plans are monthly with no lock-in, and leaving comes with a handover pack — a competent engineer can pick it up without calling us.
Are you SOC 2 or ISO 27001 certified?
No, and we will not pretend otherwise. We build and operate SOC 2 / ISO 27001-ready: audit logs, access control, encryption, backups and documented incident response — the evidence your auditor will ask for. We sign an NDA and a GDPR Article 28 DPA.
Does the Cyber Resilience Act affect us?
If you place software with digital elements on the EU market, likely yes. Reporting of actively exploited vulnerabilities and severe incidents applies from 11 September 2026; full obligations from 11 December 2027. On Care Plus we maintain the vulnerability-handling process and records that make reporting possible — your legal team still makes the final call on scope.
008 — Related services
- Backend systemsAPIs, integrations, data and infrastructure that stay up when your business scales.
- Vibecode rescueAI got you to 80%? We audit, harden and ship the last 20 — with an honest fix-or-rebuild verdict first.
- WebsitesFrom a sharp one-pager to a full e-commerce platform — fast, accessible, and built to convert.
100 — MAINTENANCE & SLA
Ready to hand over the pager?
Tell us what you run and what keeps you up at night. We will reply within one business day and propose a takeover audit and a fixed monthly plan.