--- title: "Software Maintenance Services for Existing Codebases | Cyan Orbit" description: "We take over inherited codebases with a code audit first, patch security issues, upgrade dependencies and keep production running under a defined SLA." url: https://cyanorbit.com/services/software-maintenance --- 1. [Home](https://cyanorbit.com/) 2. [Services](https://cyanorbit.com/services) 3. Software Maintenance & Support Lifecycle # Software Maintenance Services for Existing Codebases We take over inherited codebases, patch security issues, upgrade dependencies and keep production running under a defined support SLA. [Get a project estimate](https://cyanorbit.com/get-a-quote?service=software-maintenance) [Talk to a developer](https://cyanorbit.com/contact) NDA on request · Free, no-obligation estimate · Reply within one business day NDA before discovery You own the code and IP on payment Code in your repository from day one A working demo every two weeks Senior engineers do the work [How we work](https://cyanorbit.com/process) A codebase doesn't need a rewrite just because the person who built it is gone. It needs someone to read it carefully, understand what it actually does, and take responsibility for keeping it running and current. We start every maintenance engagement with a code audit, not a patch, because the fastest way to introduce a new bug is to change code nobody has actually read yet. From there, the work is steady rather than dramatic: known vulnerabilities get remediated, dependencies and frameworks get upgraded in stages so a jump of several major versions doesn't happen all at once, and a support SLA defines exactly how fast a production issue gets a response. Small enhancement requests get handled inside that same relationship, so a minor feature doesn't require re-litigating scope every time. This covers taking over and sustaining a system that already exists. For a system that needs a substantial rebuild or a new major capability, that's closer to custom software development or one of the specific service pages, like backend development or cloud DevOps. ## Problems we are usually brought in to solve - The developer who built our app left and nobody else understands the codebase. - We're three major versions behind on our framework and afraid to touch the upgrade. - A dependency with a known vulnerability has been sitting in our project for months. - Our app goes down and we have no support contract telling us who responds or how fast. - Small feature requests take weeks because nobody wants to touch code they didn't write. - We inherited a codebase from an agency that no longer exists and don't know what's actually in it. What we deliver ## Software Maintenance & Support services - ### Codebase Audit for Inherited Projects A structured read-through of an unfamiliar codebase before any change is made: architecture, dependencies, known issues and the parts that are riskier than they look. - ### Security Patching and Vulnerability Remediation Known vulnerabilities in dependencies and application code identified and fixed, prioritized by actual exposure rather than a generic severity score alone. - ### Dependency and Framework Upgrades Multi-version upgrades staged incrementally with testing at each step, so a framework several versions behind doesn't require one large, risky jump. - ### Support SLAs Defined response and resolution times based on issue severity, so a production outage has a known escalation path instead of an uncertain wait. - ### Production Monitoring Monitoring and alerting set up or reviewed so issues surface before a customer reports them, with clear ownership for who responds to an alert. - ### Small Enhancements and Bug Fixes Ongoing feature requests and bug fixes handled inside the same relationship, without treating every small change as a new project to scope from scratch. - ### Documentation of Undocumented Systems Architecture, data flow and operational knowledge written down as it's discovered during the audit and ongoing work, so the next person doesn't start from zero. You receive ## Deliverables - A written codebase audit report - Patched dependencies with known vulnerabilities remediated - Upgraded framework and dependency versions - A defined support SLA with an escalation path - Monitoring and alerting configuration - Documentation of system architecture as it's discovered How we work ## Our software maintenance & support process 1. ### Codebase and Dependency Audit We read through the codebase and its dependency tree before touching anything, documenting what it does, how it's structured and where the real risk sits. 2. ### Prioritize Security and Stability Risks Findings from the audit are ranked by actual exposure and business impact, so the first fixes address the risks that matter most, not just the easiest ones. 3. ### Patch and Upgrade in Stages Vulnerabilities and outdated dependencies are addressed incrementally, with testing between each stage rather than one large batch of changes at once. 4. ### Establish Monitoring and SLA Monitoring is set up or reviewed, and a support SLA is agreed on covering response time by severity, so ongoing support has a defined shape. 5. ### Ongoing Support and Enhancements Bug fixes and small feature requests are handled under the same engagement, with the audit's documentation making each change faster than the last. 6. ### Quarterly Health Review A periodic check on dependency freshness, open vulnerabilities and system performance, so maintenance stays proactive rather than reactive to the next incident. ## What an Inherited Codebase Audit Actually Finds Most audits surface a similar pattern: a handful of genuinely risky areas (an unpatched dependency, an authentication flow with a subtle gap, a piece of business logic nobody fully understands) surrounded by a much larger amount of code that's simply unfamiliar rather than actually broken. The audit's job is telling those two categories apart before any change gets made. We document findings by severity and by how confident we are in the assessment, since some risks are clear from reading the code and others need a test in a safe environment to confirm. That distinction matters for prioritizing what gets fixed first. ## Upgrading a Framework Three Major Versions Behind Jumping several major versions at once tends to surface every breaking change simultaneously, which makes it hard to isolate what broke and why. We upgrade one major version at a time, running the existing test suite (or writing a minimal one first, if none exists) between each step, so a regression is traceable to a specific version jump instead of buried in a pile of changes. This takes longer than a single leap in theory, but it's the difference between a controlled, testable upgrade and a weekend spent guessing which of a dozen simultaneous changes broke production. - One major version upgraded at a time, not several at once - Test suite run (or built first) between each upgrade step - Breaking changes isolated to a specific, traceable version jump ## Setting an SLA That Matches What's Actually at Stake A support SLA is only useful if its severity tiers reflect what a real incident actually costs you. A production outage during business hours and a minor display bug in an admin screen shouldn't have the same response time commitment, and an SLA that treats them the same either overcommits on the trivial cases or undercommits on the ones that matter. We set tiers based on your actual usage patterns and business impact, not a generic template, and review them periodically as the system and its usage change. Technology ## Technologies we use - [Node.js](https://cyanorbit.com/technologies/nodejs) - [Python](https://cyanorbit.com/technologies/python) - [Java & Spring Boot](https://cyanorbit.com/technologies/java) - [.NET](https://cyanorbit.com/technologies/dotnet) - [Laravel](https://cyanorbit.com/technologies/laravel) - [WordPress](https://cyanorbit.com/technologies/wordpress) Industries ## Software Maintenance & Support by industry - [LegalMatter management, document automation and conflict checking with privilege, retention rules and trust accounting designed in from the start.](https://cyanorbit.com/industries/legal) - [HealthcareClinical and patient-facing software built to HIPAA technical safeguards, wired into the EHR your care teams already use.](https://cyanorbit.com/industries/healthcare) - [Fintech & BankingLedger-accurate financial software with KYC/AML checks and PCI DSS-aligned payment flows built in from the schema up.](https://cyanorbit.com/industries/fintech) - [EducationLearning platforms and student portals built on real rostering data, wired into Canvas, Google Classroom and your SIS through LTI 1.3.](https://cyanorbit.com/industries/education) - [NonprofitDonor CRM, recurring giving and grant reporting software built for a team that has to do more with a smaller budget than a for-profit peer.](https://cyanorbit.com/industries/nonprofit) Solutions ## Systems we build with this service - [Legacy Software ModernizationWe replace an aging system piece by piece behind a stable interface, so the business keeps running while the software underneath it changes.](https://cyanorbit.com/solutions/legacy-modernization) - [Cloud MigrationMoving existing workloads to the cloud in planned waves, with a migration strategy chosen per workload rather than applied uniformly across everything.](https://cyanorbit.com/solutions/cloud-migration) - [Internal Tools & Admin DashboardsBack-office software that lets your team look up, edit, and act on production data safely, replacing the spreadsheet or the direct database query.](https://cyanorbit.com/solutions/internal-tools) - [System IntegrationConnecting the CRM, ERP, billing, and internal systems you already run, so data moves between them without a person copying it by hand.](https://cyanorbit.com/solutions/system-integration) Budget ## What drives cost and timeline - ### Codebase size and how outdated it is A small application a few versions behind costs less to audit and stabilize than a large one on a framework version several years out of date. - ### Number of known vulnerabilities to remediate A handful of low-severity dependency issues is a smaller project than a codebase with multiple high-severity vulnerabilities across its dependency tree. - ### SLA response time required A same-business-day response commitment costs less to staff for than a round-the-clock, sub-hour response requirement. - ### Volume of small enhancement requests expected An engagement scoped for occasional bug fixes is different from one expected to absorb a steady stream of small feature requests each month. - ### Whether documentation exists at all A codebase with reasonable existing documentation takes less time to audit than one where every piece of institutional knowledge has to be reconstructed from the code itself. [Get a project estimate](https://cyanorbit.com/get-a-quote?service=software-maintenance&src=pricing%5Fblock) [See engagement models](https://cyanorbit.com/pricing) Compliance ## Standards we design and build to None of these is a certification or attestation held by this agency. They are the standards we design and build client systems to, so your own audit or assessment starts from a sound base. - ### GDPR / UK GDPR Personal data handled on a lawful basis, with data minimisation and a documented retention policy. - ### HIPAA safeguards Administrative, physical and technical safeguards applied where a system touches protected health information. - ### PCI DSS scope reduction Card payment flows tokenised through a certified processor so cardholder data never touches your systems. - ### SOC 2 readiness Access control, change management and audit logging built in from day one, ready for a client's own SOC 2 audit. - ### WCAG 2.2 AA Keyboard navigation, colour contrast and screen-reader labelling checked against the AA success criteria. - ### OWASP ASVS Authentication, session handling and input validation reviewed against the Application Security Verification Standard. We list certifications only when they are real and current. [See our security practices →](https://cyanorbit.com/security) FAQ ## Software Maintenance & Support FAQs Can you take over a codebase built by a developer or agency we no longer work with? Yes, and this is one of the most common ways a maintenance engagement starts. We begin with a code audit before making any change, so we understand what the system actually does and where the real risks are before touching production. How do you audit a codebase you didn't build? We read through the architecture, dependency tree and core business logic systematically, documenting what each part does and flagging anything that looks risky, outdated or unclear. Where the code's intent isn't obvious from reading it, we test in a safe environment rather than guess. What's included in a software maintenance SLA? A defined response time and resolution time by issue severity, an escalation path for production incidents, and a scope covering what counts as a bug fix versus a new feature request. Tiers are set based on your actual business impact rather than a generic template applied to every client. Can you patch a known vulnerability without upgrading the entire framework at once? Often yes. Many vulnerabilities can be patched at the dependency level without a full framework upgrade, and we prioritize that path when it's available. Where the fix genuinely requires a framework upgrade, we stage it incrementally rather than combining it with unrelated changes. How long does it take to get comfortable with an inherited codebase before making changes? A structured audit typically takes from a few days to a couple of weeks depending on the codebase's size and how much documentation already exists. We can start on urgent fixes, like an active vulnerability, in parallel with the broader audit rather than waiting for it to fully complete. Do you handle small feature requests or only bug fixes and patching? Both, under the same ongoing engagement. Small enhancements are scoped and delivered alongside bug fixes and patching rather than requiring a separate project each time, which is usually faster once the initial codebase audit is done. Related ## Related services - [Backend DevelopmentWe build the server-side systems underneath your product: data models, business logic, queues and the infrastructure that keeps them fast under load.](https://cyanorbit.com/services/backend-development) - [Cloud & DevOpsWe design cloud infrastructure as code, build CI/CD pipelines, and get your team ready for incidents before they happen.](https://cyanorbit.com/services/cloud-devops) - [API DevelopmentWe design, build, document and version REST and GraphQL APIs that partners can integrate against without calling your engineers first.](https://cyanorbit.com/services/api-development) - [Custom Software DevelopmentWe build software around the processes your business already runs on, so operations stop depending on spreadsheets, workarounds and tools that were never built for your workflow.](https://cyanorbit.com/services/custom-software-development) - [Frontend DevelopmentWe build and maintain the browser layer of your product: component systems, performance, accessibility and migrations off frameworks you've outgrown.](https://cyanorbit.com/services/frontend-development) Insights ## Guides for planning this work - [8 min readHow Much Does Custom Software Development Cost?Custom software development cost ranges from $15,000 for a simple internal tool to $500,000 or more for enterprise platforms. Here is what drives the number.](https://cyanorbit.com/blog/custom-software-development-cost) - [7 min readChoosing Between Fixed Price and Time and MaterialsFixed price vs time and materials changes who carries scope risk, how change requests work, and what a software project actually costs. Here is how to choose.](https://cyanorbit.com/blog/fixed-price-vs-time-and-materials) - [7 min readA Practical Guide to Software Development Project PlanningSoftware development project planning determines whether a build stays on schedule. This guide covers scope, methodology, risk and the documents that matter.](https://cyanorbit.com/blog/software-development-project-planning) ## Get an estimate for your software maintenance & support project Share a few details about your project. A senior engineer reviews every request and replies with next steps, questions, and a rough budget range. [Get a project estimate](https://cyanorbit.com/get-a-quote?service=software-maintenance) [Talk to a developer](https://cyanorbit.com/contact)