Nobody knows how it works
The developers who built it moved on. Changes are made nervously, or not at all.
Service 14 / 14
Maintenance & Support
Software decays whether or not you touch it. Dependencies age, certificates expire, traffic changes. We keep systems healthy and answer the phone when they aren't.
- Typical duration
- Ongoing · 3-month minimum
- Engagement
- Retainer · Response-time SLA
- Right for you if
- Companies whose original developers are no longer available
- Teams without in-house capacity to cover their own systems
- Businesses where downtime has a direct revenue cost
- Anyone running software with unpatched known vulnerabilities
Problems
You're probably here because of one of these.
If more than one sounds familiar, that's normal — they usually share a root cause.
Dependencies have rotted
Years of unpatched packages, some with known exploits. Every month makes the upgrade harder.
Outages are unbounded
No monitoring, no on-call, no SLA. Recovery time depends entirely on who happens to be free.
Small changes take forever
A text change waits weeks because there's no one who can safely deploy it.
Approach
How the work actually runs.
From first conversation to running in production. Typical end-to-end duration for maintenance & support is Ongoing · 3-month minimum.
- 01
Takeover audit
1–2 weeksWe learn the system properly before taking responsibility for it. No blind commitments.
- Architecture and dependency mapping
- Security and vulnerability assessment
- Infrastructure, access and credential inventory
- Risk report with prioritized remediation
- 02
Stabilize
2–4 weeksWe fix what's actively dangerous and make the system observable before routine work starts.
- Critical security patches applied
- Monitoring, alerting and error tracking installed
- Backup verification and restore rehearsal
- Runbooks for the most likely failure modes
- 03
Establish support
1 weekClear severity levels, response commitments and a channel where requests don't get lost.
- Severity definitions and response-time SLAs
- Shared ticketing and a direct support channel
- On-call rotation and escalation path
- Named engineers who know your system
- 04
Maintain
OngoingScheduled upkeep so problems get found in a maintenance window rather than at 2am.
- Monthly dependency and security patching
- Performance monitoring and proactive tuning
- Certificate, domain and license renewal tracking
- Monthly report on health, incidents and spend
- 05
Improve
OngoingRetainers include development capacity, so the system keeps moving forward rather than just not breaking.
- Agreed monthly development hours
- Quarterly technical-debt review and paydown
- Roadmap planning with your team
- Architecture review as usage grows
Included
What you get, spelled out.
Every item here is part of the engagement, not an upsell discovered halfway through.
Response-time SLA
Defined severity levels with committed response times, in the contract.
Named engineers
The same people every time. They learn your system instead of re-reading it each ticket.
Proactive monitoring
Uptime, errors and performance watched continuously, with alerting we act on.
Security patching
Monthly dependency updates with vulnerability scanning and prioritized remediation.
Verified backups
Restores tested on a schedule, so recovery is a known quantity.
Included development hours
Retainers cover improvements, not just firefighting.
Monthly reporting
Uptime, incidents, work completed and infrastructure spend, in writing.
Documented knowledge
Everything we learn is written down, so you're never dependent on one person's memory.
Stack
What we typically build this with.
A default, not a rule. If your team already runs something else and it fits the requirement, we work in your stack.
Docker
The same image in dev, CI and production. 'Works on my machine' ends here.
Nginx
Reverse proxy, TLS termination and load balancing. What makes a self-hosted deployment behave like a managed one.
AWS
Widest service coverage and the compliance posture enterprises expect.
Self-hosted
Your own servers, your own datacentre, or a VPS you control. Same containers, same pipeline, no cloud lock-in.
PostgreSQL
Our default. Transactional integrity, JSON, full-text search and row-level security in one engine.
Node.js
One language across client and server. Shared validation, shared types, one hiring profile.
TypeScript
Types across the whole stack. Most integration bugs stop being possible.
Terraform
Infrastructure in version control, reviewable and reproducible from an empty account.
Why Devsock
The difference is in how the work is run.
Ten dimensions where engagements usually go wrong, and what we do instead. Every claim in the right-hand column is something you can verify in the first two weeks.
DimensionTypical agencyDevsock
Estimates
TypicalAn hourly rate and a range that grows once work starts.
DevsockFixed scope and fixed price after a paid discovery. Changes are quoted before they enter a sprint.
Communication
TypicalA weekly status email written by an account manager.
DevsockDirect access to the engineers building it, a shared board you can read any time, and a demo every second week.
Code ownership
TypicalDelivered at the end, sometimes with a proprietary framework attached.
DevsockYour repository, your cloud account, from commit one. No proprietary layer, no licensing.
Testing
TypicalManual clicking before launch, if the timeline allows.
DevsockAutomated suites in CI, load testing at projected peak, and a WCAG 2.2 AA audit before release.
Architecture
TypicalWhatever the available developer knows best.
DevsockA written architecture decision record explaining what we chose, what we rejected, and why.
Security
TypicalAddressed if the client raises it.
DevsockDependency scanning in CI, least-privilege access, secrets management and a pre-launch review as standard.
Accessibility
TypicalOut of scope unless legally forced.
DevsockWCAG 2.2 AA designed in and audited. Keyboard and screen-reader tested, not assumed.
Handover
TypicalA zip file and a phone number that stops answering.
DevsockDocumented architecture, runbooks, and a paid handover period so your team can genuinely take over.
After launch
TypicalA new quote for every bug.
DevsockDefect fixes covered for 90 days. Support retainers carry response-time SLAs in the contract.
Saying no
TypicalEvery request becomes a line item.
DevsockWe'll tell you when a feature isn't worth building, or when the answer isn't software at all.
Work
What we've built, and what it changed.
Live products you can open and use. Each one names the constraint, the approach and what shipped.
- Next.js
- TypeScript
- React Native
- PostgreSQL
- Redis
- Stripe
- AWS
Multi-tenant SaaS platform and driver apps for dumpster rental operators
Challenge
Dumpster rental operators run bookings, fleet position, driver assignments and invoicing across spreadsheets, whiteboards and phone calls. Nobody knows where a container actually is, proof of service arrives days after the job, and billing gets reconstructed from memory at month end.
Solution
A multi-tenant SaaS platform with self-serve signup, subscription billing and tiered plans, paired with native driver apps on iOS and Android. Operators get real-time container status, driver scheduling with route optimisation, customer and contract management, and automated invoicing. Drivers receive job assignments and upload proof of service from the field.
What shipped
- Native driver apps published to both the App Store and Google Play
- Multi-tenant architecture with per-operator data isolation
- Self-serve onboarding with a 15-day trial and three subscription tiers
- Real-time inventory and container status tracking
- Driver scheduling with route optimisation
- Automated invoicing and payment processing
- Next.js
- TypeScript
- Tailwind CSS
- Vercel
Corporate platform for an independent renewable-energy consultancy
Challenge
An independent monitoring and evaluation consultancy for renewable energy projects needed to establish credibility with government, industrial and hospital buyers — a sector where procurement turns on verifiable regulatory standing and a demonstrable track record, not on marketing copy.
Solution
A structured corporate platform built around proof rather than persuasion: service definitions for independent oversight and technical training, a credentials section surfacing regulatory compliance across SECP, FBR, PRA and PEC, team profiles establishing sector experience, and a documented track record of verified installations. Enquiries route directly to the consultancy team.
What shipped
- Structured service architecture across oversight and training lines
- Regulatory credentials surfaced as the primary trust signal
- Track record documented across government, industrial and public-health installations
- Team credibility profiles with sector experience
- Enquiry capture routed to the consultancy team
- Server-rendered and fully indexable
- Next.js
- TypeScript
- PostgreSQL
- Tailwind CSS
- AWS
Training platform with multi-country scheduling and certificate verification
Challenge
A QHSE training provider delivering internationally accredited certifications across Saudi Arabia, the UAE and Pakistan needed to publish a constantly moving multi-city schedule, take registrations online, and let employers independently verify that a certificate is genuine — the last of which is what makes an accreditation worth anything.
Solution
A training platform combining a published course schedule across multiple countries with online registration, a separate corporate training enquiry path, and a public certificate verification tool employers can use to authenticate credentials. Accreditation bodies and trainer profiles are presented as structured, checkable content rather than a logo wall.
What shipped
- Public certificate verification for employers
- Multi-country training schedule with online registration
- Separate paths for open-enrolment and corporate training
- Course catalogue spanning ISO, OSHA, IOSH, NVQ and Lean Six Sigma
- Accreditation bodies and trainer credentials as structured content
- Server-rendered and fully indexable
Further work sits behind NDAs. We can walk you through the architecture and measured outcomes of those engagements under mutual NDA.
Request a walkthroughFAQ
Maintenance & Support — common questions.
Specific to this service. The general questions about pricing, ownership and process are answered on the home page.
Still unsure? hello@devsock.com
Yes — most of our support work is inherited systems. We start with a paid audit so we understand what we're committing to, and we'll tell you honestly if something is beyond safe support in its current state.
Related
Usually paired with.
Most engagements combine two or three of these. We'll tell you which ones you actually need.
Next step
Let's scope your maintenance & support project.
Bring us the problem rather than a specification. Thirty minutes with an engineer will tell you whether this is the right service, what it would take, and roughly what it would cost.
30 minutes
No slide deck, no sales team
An engineer
You speak to someone who builds
A straight answer
Including when it's don't build it