Can you take over a system built by someone else?

What should you collect first?

• Access: hosting or server, domain and DNS, database, content management system, email sending and other external services.
• Source code: the complete, current version of the code, ideally in version control (for example GitLab or GitHub).
• Documentation: if there is any. If not, that is no obstacle, the assessment just takes longer.
• Contracts and licences: whose name the paid services, plugins and certificates are registered under.

If the previous developer is not reachable, access can also be recovered from the hosting provider and the domain registrar, as long as the services are registered to your company.

How does the assessment work?

We check what technology the system is built with, how up to date the framework and libraries are, whether there are known security vulnerabilities, how the code is structured and how the server runs. The result is a short, clear summary: the state of the system, the risks and what we recommend.

What can the outcome be?

• Can be taken over: the system is in good shape; we make an operations proposal and take it over.
• Can be taken over after fixes: urgent security updates and bugs have to be fixed first, then regular operations can start.
• Rewrite recommended: if the technology is outdated, the code hard to maintain, and fixing it would cost more than a new system. In that case we say so honestly and show the steps of the transition.

One of our clients had a system that the previous developer had not updated for years. After the assessment we first carried out the security updates, the system became stable, and we have been developing it ever since.

How to avoid ending up here again?

State in the contract that the code, the access and the data are yours, keep the code in version control, and make sure there is documentation. The maintenance contract should also say what you receive at the end of the contract.