Application Maintenance & Support

Our retainers include continuous uptime and performance monitoring, incident response within the agreed SLA, monthly security dependency audits and patching, quarterly performance reviews, backup verification, and a fixed number of development hours for bug fixes and minor improvements. We scope the retainer to your application size and SLA requirements — there is no one-size-fits-all plan.

We offer P1 response (site down or data loss in progress) within 15 minutes, P2 (major feature broken) within 1 hour, and P3 (degraded performance or minor feature broken) within 4 business hours. SLAs are agreed at retainer start and measured monthly. We use PagerDuty for escalation and track mean time to acknowledge and mean time to resolve for every incident.

We run automated dependency audits using npm audit, Dependabot, or Snyk on a weekly basis. Critical CVEs (CVSS score ≥ 9.0) are patched within 24 hours. High severity (7.0–8.9) within 72 hours. Medium and low severity are batched into a monthly patch release. All patches are tested in staging before deploying to production, with rollback available for 24 hours post-deploy.

We monitor at four levels: uptime (synthetic checks from multiple regions every 30 seconds), infrastructure (CPU, memory, disk, network), application (error rate, latency percentiles, request rate), and business (key user actions like sign-ups, purchases, and logins). Alerts fire at multiple thresholds — a warning when metrics are trending bad and a critical alert when SLOs are breached.

When an alert fires, the on-call engineer acknowledges it within the SLA, follows the relevant runbook, and posts status updates every 15 minutes in a shared Slack channel. After resolution we complete a blameless post-mortem covering timeline, root cause, impact, and corrective actions. The post-mortem is delivered within 48 hours and reviewed with your team.

Yes. We start with a 2-week onboarding sprint: reading the codebase, reviewing the infrastructure, documenting what we find (including technical debt and risks), and setting up our monitoring and alerting stack. After onboarding we can respond to incidents and handle ongoing maintenance just as effectively as for applications we built ourselves.

We schedule maintenance windows for changes that require brief downtime — database index rebuilds, major version upgrades, certificate rotations — and notify stakeholders in advance. Where downtime is avoidable, we use zero-downtime techniques (rolling deploys, online index creation). Major framework upgrades (e.g. Next.js major version) are scoped as a project, not a maintenance task, and included in the retainer hours or billed separately.

A blameless post-mortem focuses on system failures rather than individual mistakes. We document what happened, when, and why — without assigning personal blame. The outcome is a list of corrective actions: monitoring gaps to close, runbooks to add, code paths to harden. Blameless culture makes engineers more likely to surface problems early, which results in faster incident response and fewer repeated failures.

Yes. Having a backup is not the same as having a working backup. We run a full restore drill monthly — restoring to a test environment and verifying data integrity and application functionality. We document the restore time so you know your actual RTO, not a theoretical one. Many clients discover their backups are incomplete or their restore process is broken only during this exercise.

Retainer plans range from 10 to 40 development hours per month depending on your application complexity and change rate. Hours cover bug fixes, minor feature improvements, dependency upgrades, and infrastructure changes. Hours do not roll over — unused time reflects a well-running application. If you consistently need more hours, we reassess the retainer scope.

Yes. We offer surge capacity on top of the base retainer for product launches, seasonal traffic peaks, or large feature releases. Surge blocks are pre-booked at least 2 weeks in advance. We also staff up monitoring during launch windows — more frequent check-ins, shorter alert thresholds, and engineers standing by — so we catch issues within minutes rather than the standard SLA window.

Our standard notice period is 30 days. During the notice period we work with you to transfer knowledge, documentation, and monitoring configuration to your team or a new provider. We do not hold infrastructure or access hostage — a smooth handover is part of how we work, regardless of why you are transitioning.