Intervention, modernization and migration for public sector applications

Problems we solve

We do not start from technology. We start from the situation the institution is actually in — and most of the time it is one of these.

Services available

Each service has a defined object, deliverables, a timeframe and terms of provision, so it can be assessed, budgeted and contracted without a lengthy discovery phase.

Deliverables are adapted after the initial assessment. We do not recommend Kubernetes for every application — we propose an architecture proportional to the actual need.

From incident to stable operations

Most suppliers cover one step: hosting, web development, maintenance, a vulnerability scan or consultancy. We cover the whole path, and each step ends with something the institution can act on.

1. 01

   Incident or vulnerability

   We take controlled ownership of the infrastructure and make an initial backup, so the data is preserved before anything is changed.

2. 02

   Stabilization

   We isolate affected components, apply immediate fixes and bring the service back into operation.

3. 03

   Audit

   We inventory the code, dependencies, database and integrations, then classify what is migrated, modernized, rebuilt or retired.

4. 04

   Modernization

   We rewrite or replace the components that can no longer be operated safely, while preserving the content and the public archive.

5. 05

   Infrastructure

   We build the infrastructure with Terraform: separated environments, managed secrets, backup and observability.

6. 06

   Migration

   We migrate data and traffic under control, with testing and a rollback plan agreed in advance.

7. 07

   Operations

   We monitor, update, test the restore procedure and respond to incidents on agreed terms.

8. 08

   Handover

   Documentation, operating procedures and knowledge transfer, so the institution is not locked into a single supplier.

Frequently asked questions

Can you intervene if we have already received a vulnerability report or notification?

Yes. We start by taking controlled ownership of the infrastructure and making an initial backup, so the data is preserved before anything changes. We then assess the critical vulnerabilities, isolate the affected components and set out a remediation plan. We commit to rapid mobilization and assessment — not to a fixed resolution deadline decided before the analysis.

How long until we receive an offer?

We reply within the same business day with a preliminary assessment, the recommended service and the steps required for procurement. The technical and financial offer follows once we understand the access available and the actual state of the application.

What if the original supplier no longer responds, or the source code is incomplete?

This is one of the most common situations. We start from what actually exists: the running application, the database, the server configuration. We rebuild the technical inventory, document the dependencies and establish what can be recovered, what has to be rebuilt and what can be retired.

Can the application be moved directly into government infrastructure?

Rarely directly. An application with outdated components, dependencies that cannot be updated, or no automated deployment can be rejected on entry into the new infrastructure. The migration readiness audit establishes exactly what has to be modernized before the move.

Do we need Kubernetes?

Not for every application. For simple sites and portals we recommend an architecture proportional to the requirement. Kubernetes is justified when availability, scaling and operational complexity genuinely call for it.

We have backups. Is that enough?

An untested backup is not a recovery strategy. We test the actual restore, measure how long it takes and document the procedure, so the institution knows the real recovery time before an incident rather than during one.

Can these services be contracted through direct acquisition?

The services are defined with an object, deliverables, a timeframe and terms of provision, so they can be acquired directly under Law no. 98/2016. The decision on the procedure belongs to the contracting authority, based on the estimated value of the entire requirement.

Can you publish the service in the SEAP electronic catalogue?

Yes. On request we send the technical datasheet, the matching CPV code and the item in the SEAP electronic catalogue, together with the technical and financial offer.

Can the content and history of the current website be preserved?

Yes. Taking over and structuring the content, together with migrating the public archive, are part of the modernization package. Preserving the public archive is usually a requirement, not an option.

What happens after the migration?

We can take over operations as a monthly subscription or annual contract: monitoring, updates, backup, restore testing, certificate management, security reviews, reporting and incident management.