Software support and maintenance
Everyone relies on the app. Nobody looks after it.
Now we do.
We give you software support and maintenance from engineers who look after live systems every day.
We check what you’ve got first. Then we watch it, fix what breaks and make it safer every month.
You keep the code, the product and every decision.
Whoever built it: your own developers, an agency, a dev house or a funded AI programme.
Scroll
It works. That was the easy bit.
A business builds an app, or pays someone to build it. Often it’s an AI app that speeds up one part of the work. Soon, the business depends on it.
Nobody is formally on call for it. When it goes wrong at night, someone helps if they happen to see it. Three problems usually follow.
It breaks at 3am. A customer spots it first.
Software can fail at any hour. If nothing watches it, the first alert is a complaint from a customer or a colleague.
The security updates are piling up.
The cloud platform under the app gets security updates all the time. Somebody has to find the gaps that matter and get them fixed.
The one person who knows how it works is leaving.
When one person holds the knowledge, it leaves with them. We write it down and keep it in your accounts.
- Monitoring
- Tools that watch the software all the time and raise an alert when something goes wrong.
- Incident
- Our word for anything that stops the software working, or puts it or its data at risk.
- Patching
- Installing the security updates that a cloud provider releases. With Critical Support, we find and fix security gaps in the AWS or Azure platform under your app, not in the app itself.
- Backups
- Copies of your data that you can restore if the original is lost. A backup only counts once someone has tested that it restores.
In the UK government's Cyber Security Breaches Survey 2025/26, 25% of businesses and 19% of charities had a formal incident response plan.
An incident response plan says who does what, and in what order, when something goes wrong. Our support services follow a set process. Our engineers spot the problem, judge how serious it is and respond. If needed, they escalate. Then they get the software working again and review what happened.
Source: Department for Science, Innovation and Technology, Cyber Security Breaches Survey 2025/26.
First we look. Then we look after it.
Nobody can look after software safely without knowing what’s in it. The route is the same whoever built it. Only the first check changes.
Check it. Fix it. Look after it.
-
Step 1
Check what you’ve got: Launch Check or Cloud HealthScan
We start with a Launch Check. We check access, keys, backups, how changes go live and whether anyone hears when it breaks. If an outside team built it and handed it over, this shows you what they left behind. You get a verdict, a rated risk list and a plan.
If your own developers built it and it runs in AWS or Azure, we start with a Cloud HealthScan instead. It’s automated and read-only, so we change nothing. You get a scorecard and a list of fixes, ranked by impact and effort.
On the first call, we’ll tell you which check fits.
-
Step 2
Fix and finish: Engineering Drawdown or Critical Launch
We fix what the check found, worst first. If features are missing, we finish them and harden what’s there. You keep the code.
With Engineering Drawdown, you buy senior engineering hours in prepaid blocks. Our engineers work through a list you agree. You can always see the balance.
-
Step 3
Look after it: Critical Support or Critical Support Lite
Our engineers watch the app, fix what breaks and report to you each month in plain English.
If your own developers are still building it, they carry on. We look after the live app next to them.
However it started, it ends the same way: we look after it, and you keep every decision.
Software support and maintenance, every month.
- We watch the app and the cloud platform under it.
- When something goes wrong, our engineers respond and fix it.
- After a serious problem, we tell you what happened and what we changed.
- Each month, our engineers find and fix weak spots in reliability, security, cost and governance.
- With Critical Support, this includes vulnerability management for the AWS or Azure platform. That means finding its security gaps and getting them fixed.
- Each month, we report what went wrong, the work we did and what comes next.
- You keep admin control. A person approves every change to the live system.
Critical Support answers 24 hours a day, every day. SEV-1 and SEV-2 incidents, the two most serious levels, get a contractual 15-minute response. Critical Support Lite covers the hours you choose, with a contractual 15-minute response for SEV-1. You can add 24-hour cover to Lite.
Critical Cloud reduces mean time to resolve incidents by 40 to 60 per cent. Mean time to resolve is the average time from when something breaks to when it’s fixed.
Some of these apps hold customer data, and some get audited. We operate and evidence the runtime controls that support your compliance obligations.
Their work isn’t software. The software still has to work.
An example from our case studies, with the customer’s name removed.
An intensive care research organisation
Its researchers needed one platform for heavy statistical work on sensitive NHS data. We built it on Azure, defined in code, and handed over a full set of runbooks.
Our engineers now look after it 24x7. When something breaks out of hours, they fix it overnight. When a weekend upgrade caused a problem, our engineers fixed it and researchers got straight back to work.
Sector detail is on our industries pages.
Other problems we fix.
People are paying for the app. Nobody’s checked it’s safe.
We check the keys, logins and backups in apps made with Lovable, Replit or Claude Code. Then we get them ready for real customers.
Critical Launch →
A developer has been on call since launch.
Our engineers take the nights and weekends and get things working again. Every month, they also fix the causes.
How we take on-call →
The auditors want proof it was working.
We operate and evidence the runtime controls that support your compliance obligations. After a serious problem, you get a written record of what happened and when.
Industries we support →
FAQ
Do we need technical staff to work with you?+
No. We explain every step and every report in plain English. You make the decisions, and you don’t need to know how the software works.
The developer who built it has left. Can you take over?+
Yes, once a check shows the software is safe to support. We start with a Launch Check or a Cloud HealthScan. Then our engineers look after it through Critical Support or Critical Support Lite. We write runbooks: step-by-step notes on how to run and fix the software. They stay in your accounts, so the knowledge doesn’t walk out with one person.
Where do you start?+
We start with a Launch Check. We check the app, the code, the backups and how it runs. If an outside team built it and handed it over, this shows you what they left behind. If your own developers built it and it runs in AWS or Azure, we start with a Cloud HealthScan of that account instead. On the first call, we’ll tell you which check fits.
Who picks up when it breaks at night?+
With Critical Support, our engineers do, 24 hours a day, every day. Critical Support Lite covers the hours you choose. You can add 24-hour cover to Lite.
Can you finish features that are missing?+
Yes. We finish missing features and fix weak spots through Engineering Drawdown or Critical Launch. You keep the code, the product and every decision. When the work’s done, we look after the software through Critical Support or Critical Support Lite.
Where does the software need to run?+
Where it runs today. Critical Support covers AWS and Azure environments. Critical Support Lite covers a single AWS or Azure environment, or an app on Vercel, Netlify and Supabase.
What can you show our auditors?+
We operate and evidence the runtime controls that support your compliance obligations. After a serious problem, you get a written record of what happened and when. Your business stays responsible for compliance. Critical Cloud holds ISO 27001 and Cyber Essentials Plus certification.
You keep the product. We take the calls.
Tell us what the app does, who built it and where it runs. We’ll name the right first step, or tell you plainly if we’re not the right fit.
