Security, data ownership and what happens if we part ways

Cost tracks scope, not seats. A focused CRM or a single-department system starts materially lower than a multi-module ERP with a double-entry ledger and multi-branch reporting. After a 30-minute scoping call we send a written fixed price range with the module breakdown behind it, and that range does not move unless the scope moves.

We will also tell you when off-the-shelf software is the cheaper answer. Recommending a custom build that should not exist is the most expensive mistake in this category, and it is ours to avoid rather than yours to discover.

You get working software you can log into early, not at the end. Discovery and design usually take one to two weeks, after which delivery runs module by module so each piece can be tested and accepted as it lands.

A focused system is typically live in six to twelve weeks. A full multi-module ERP runs three to nine months to complete, but the first usable modules arrive long before that. There is no six-week silence where you wonder what is happening.

Usually not, and we have no incentive to say otherwise. The first step is an architecture and code review that tells you whether what you have can carry another two years of growth, what the security exposure is, and what the previous vendor left undocumented.

You get a written risk register with costs attached to each option: fix, replace or retain. Where the existing system is worth keeping, we say so and quote for the remediation instead of the rebuild.

Yes, entirely, from day one. Source code, database, hosting credentials, brand vector files and documentation are handed over as a matter of course, not negotiated at the end.

There are no hostage licences, no per-seat fees on your own system, and nothing held back to create leverage at renewal. If you want to move the system to another provider, everything needed to do that is already in your possession.

Support is a defined agreement rather than goodwill. It covers monitoring, backups that are verified by actually performing a restore, response-time targets, and a named engineer who already knows your stack.

We also run quarterly reviews to look at what the system is doing in practice versus what it was designed to do, because usage patterns after twelve months are rarely the ones assumed at design time.

Least-privilege roles, server-side input validation, complete audit trails on financial and administrative writes, and backups tested by restore rather than assumed to work. These are built in during development, not sold afterwards as a hardening phase.

Your data stays on infrastructure you control and own. We can work within your existing hosting, compliance requirements and data-residency constraints, and we will document exactly who has access to what.

Regularly. That arrangement works best when the boundary is explicit: we take specific modules or the architecture, your team takes the rest, and the API contract between them is agreed and written down before either side starts building.

We document to the standard of someone else maintaining the code, because in this arrangement someone else does.

Three structural answers rather than a reassurance. First, each stage has a written exit condition, so a project cannot drift quietly for months. Second, you hold the code, credentials and documentation throughout, so another team could pick it up. Third, every system ships with an ERD, a permission matrix and a runbook written for an engineer who has never seen it.

We also run systems of our own in production, which means we are not a project shop that can quietly stop answering the phone.