We built it with AI tools. Are you going to tell us to throw it away?

Usually not. AI-generated code is often a reasonable starting point with predictable gaps — security, error handling, tests and data integrity. We build with agents ourselves; the difference is a senior engineer reading every line. We keep what earns its place.

How bad does a codebase have to be before you refuse it?

We rarely refuse, but we do occasionally recommend a rewrite instead of a rescue. That recommendation comes with the reasoning and the numbers, so it is your call rather than ours.

Why is the audit paid?

A real audit means reading the code, running it, and probing the security and data handling — days of senior work. It is credited against the build if you continue with us.

Can you work with our existing developer?

Yes, and it is often the cheapest path. We handle architecture and the hard parts while your developer keeps context and picks up the routine work.

We don't have documentation or the original team. Now what?

Standard. The audit reconstructs how the system actually behaves from the code, the database and the deployment — no original authors required.

How long before we can show something to customers?

Most rescues reach a demonstrable, deployed state within the first two weeks, because security and reliability work is sequenced ahead of new features.

Our AI feature works in the demo and falls over in production. Is that this?

That is the most common rescue we run. The fix is almost never a better prompt — it's evaluation, retrieval quality, error handling and cost control, which is unglamorous work that nobody did the first time.

What if the previous team left security holes?

Expect it — leaked keys, missing authorisation checks and unvalidated input are the usual findings. They are flagged in the audit and fixed first.

← ALL SERVICES

BUILD 03

3–6 weeks

Demo to Production

For products built fast — with Lovable, Cursor, Claude Code, a freelancer or a hackathon team — that impressed everyone and now need security, reliability and evals before real customers arrive.

Start with an audit →€8k – €40k+typically €12k – €24k

ai-built apps
security
evals
hardening
typescript
python

WHO THIS IS FOR

Built for you if…

01
Founders who built an MVP with AI coding tools and are about to put paying customers, or their data, on it.
02
Teams with an AI feature that impressed everyone in the demo and falls over with real users.
03
Companies that spent money with freelancers or another agency and now have something that doesn't work reliably.
04
Anyone whose codebase works, but nobody is quite sure why — or whether it's secure.

WHAT YOU GET

Everything included.

Production readiness audit

Codebase, architecture, dependencies, data model, security posture, and deployment reviewed by someone who has shipped this before. AI-generated code has its own habits — leaked keys, missing authorisation, duplicated logic — and we know where to look. Written up in plain language.

A clear written plan

What stays, what gets rewritten, what gets cut, and what it costs — with the reasoning attached so you can challenge it.

Production hardening

Authentication and authorisation fixed, secrets moved out of the repo, input validation, sane error handling, backups, migrations, logging and monitoring.

The critical missing pieces

The features standing between the current state and a product real users can pay for. Scoped tightly and built first.

An honest assessment of the AI parts

If there's a model in the system, we measure it before defending it: does the retrieval return the right thing, is quality tracked, is anyone watching cost. Demo-grade AI usually fails on evaluation and observability rather than on the model itself.

Deployment + handover

A reproducible deploy, environment configuration, CI, and documentation so releases stop being an event.

Post-launch support window

A short window after ship where we fix what production surfaces.

WHAT IT LOOKS LIKE

Some of what you get back.

AUDIT FINDINGS — TYPICAL FIRST WEEKwritten up, plain language

CRITAPI keys committed to the repository, still valid
CRITNo authorisation check on the admin endpoints
HIGHDunning job silently dead since a deploy in March
HIGHNo backups verified — restore never tested
MEDProration implemented twice, the two disagree

You get this document whether or not you continue with us. It is useful on its own.

COST & LATENCY — ENFORCED IN CODElast 24h

cost / run€0.11
ceiling €0.50
p50 latency740ms
budget 2s
daily spend€38
cap €80 → queues
escalation rate6.2%
tuned weekly

Budgets are code, not a monthly surprise. Crossing the per-run ceiling switches to a cheaper path; crossing the daily cap queues and alerts.

HOW IT WORKS

The process.

01
01
Audit
3–5 days
Paid technical audit if the codebase is large; included in discovery if it is small. Either way you leave with a written assessment you can use with or without us.
02
02
Rescue plan + scope agreement
2–3 days
Keep / rewrite / cut decisions, sequenced by what unblocks shipping. Fixed quote against agreed scope.
03
03
Focused rebuild / hardening sprints
Weeks 2–5
Security and reliability first, then the missing features. Weekly deployable state, so progress is visible rather than reported.
04
04
Ship and hand over
Final week
Production deploy, monitoring live, documentation, and a walkthrough with whoever maintains it next.

TIMELINE & PRICING

What it costs.

DURATION

3–6 weeks depending on current state

BUDGET RANGE

€8k – €40k+

Typically €12k – €24k

PAYMENT

Audit billed separately · then 40% to start · 40% at midpoint · 20% on delivery.

WHERE IN THE RANGE YOU LAND

·Audit first: €2,000 – €4,000 depending on codebase size, credited in full against the build if you proceed.
·€8k–12k: hardening, evals and the missing pieces, where the existing architecture is sound.
·€12k–24k: where most land — rebuilding the parts that cannot be saved, or serious security and data remediation.
·€24k–40k+: large or long-neglected systems, multiple services, or data that needs remediation before anything else can happen.
·The band is wide because the honest answer comes from the audit rather than from a discovery call. You get a fixed quote before any build work starts.

WHEN IT'S A REBUILD

Sometimes the audit's honest answer is that the thing cannot be saved. A ground-up rebuild of a system already carrying real users and real data is €60k – €250k+, and we will say so plainly rather than selling you a rescue that quietly becomes one.

STACK

What we build it with.

Your existing stack
TypeScript
Python
Postgres
Docker
CI/CD
Observability

NOT INCLUDED

Where the line is.

×Defending or continuing an architecture we consider unsafe — we will tell you plainly and propose an alternative.
×Legal disputes with your previous vendor.
×Full rewrites disguised as rescues — if that is the honest answer, we say so before you spend.
×Feature expansion beyond what is required to ship.
×Ongoing maintenance beyond the support window (that is Agent Care).

Contracts, ownership & handover →Security & data handling →

FAQ

Questions we get.

We built it with AI tools. Are you going to tell us to throw it away?: Usually not. AI-generated code is often a reasonable starting point with predictable gaps — security, error handling, tests and data integrity. We build with agents ourselves; the difference is a senior engineer reading every line. We keep what earns its place.
How bad does a codebase have to be before you refuse it?: We rarely refuse, but we do occasionally recommend a rewrite instead of a rescue. That recommendation comes with the reasoning and the numbers, so it is your call rather than ours.
Why is the audit paid?: A real audit means reading the code, running it, and probing the security and data handling — days of senior work. It is credited against the build if you continue with us.
Can you work with our existing developer?: Yes, and it is often the cheapest path. We handle architecture and the hard parts while your developer keeps context and picks up the routine work.
We don't have documentation or the original team. Now what?: Standard. The audit reconstructs how the system actually behaves from the code, the database and the deployment — no original authors required.
How long before we can show something to customers?: Most rescues reach a demonstrable, deployed state within the first two weeks, because security and reliability work is sequenced ahead of new features.
Our AI feature works in the demo and falls over in production. Is that this?: That is the most common rescue we run. The fix is almost never a better prompt — it's evaluation, retrieval quality, error handling and cost control, which is unglamorous work that nobody did the first time.
What if the previous team left security holes?: Expect it — leaked keys, missing authorisation checks and unvalidated input are the usual findings. They are flagged in the audit and fixed first.

BUDGET · €8k – €40k+

Got a demo that needs to become a product?

Tell us how it was built and what still needs to happen. We'll tell you honestly whether it is hardening or a rebuild.

Start with an audit →