09 — Security & maintenance
Software does not stay finished
The day a project launches is the day it starts ageing. Dependencies get security advisories, platforms change their rules, certificates expire, and traffic finds the edge cases your tests did not. Maintenance is what keeps a working product working.
The problem
What usually goes wrong
The agency finished, invoiced and moved on. Eighteen months later nobody knows how to deploy it, and the person who did has left.
The libraries your app is built on publish security fixes constantly. Skip them for a year and updating becomes a project in itself rather than a routine task.
With no monitoring, your customers are the alerting system. You hear about the outage from the person who could not check out.
A backup you have not tested is a belief, not a safeguard. The time to discover it does not restore is not during an incident.
How we solve it
Our approach
- 01Updates on a schedule, not in a panic
Dependencies and platform SDKs updated regularly and in small steps, so nothing accumulates into a rewrite.
- 02Monitoring that tells us before it tells you
Uptime and error monitoring on the things that matter — the site loading, the checkout completing, the job running — with alerts to us.
- 03Backups that get restored on purpose
Automated backups, and a restore we actually perform periodically to prove it works.
- 04Sensible security hygiene
HTTPS and modern headers, dependency advisories tracked, secrets kept out of the code, least-privilege access. Not a certification programme — the basics, done consistently.
Every project runs through the same five steps — investigation, understanding the problem, development, testing, then launch and automation. See how we work.
What you get
Delivered at the end of the week
- Regular dependency and platform updates
- Uptime and error monitoring with alerts
- Tested backups
- A short monthly note on what changed and what needed attention
Scope is agreed in writing before we start. If the work will not fit in a week, we say so before you pay anything.
Questions
Frequently asked
Do you maintain software you did not build?
Often, yes. We start with a short review of the codebase and tell you honestly what shape it is in before agreeing anything ongoing.
What does maintenance cost?
It depends on what is running and how critical it is. It is quoted monthly and separately from build work, and you can stop it whenever you like.
Is this a security audit?
No. This is ongoing hygiene: updates, monitoring, backups and sane configuration. A formal penetration test is a different, specialist engagement.
Contact
Tell us what you are trying to fix
Describe the process you want to improve and we will tell you what fits a week. We reply from info@nileapps.co.uk, usually within one business day.