Maintenance and hosting of your business-critical software
Your developer has left, nobody dares to run an update, or a client asks for proof that your software is secure. Wabber takes over the management: hosting in the Netherlands, updates, monitoring and recovery, with clear agreements in an SLA.
Sound familiar?
- Your developer or supplier has left and nobody knows the code anymore
- Updates get postponed because nobody knows what will break
- A client or insurer asks for proof that your software is secure
- Your system runs on a server nobody looks after anymore
Every change goes through fixed security checks before it goes live. See how →
The System Check
Before we take anything into management, we take an honest look at the state of your system. Even if you don't continue with us, you have a report to move forward with.
€1,950 fixed, for one application, report within one week. If you then take management from us, we deduct this amount.
Schedule a System CheckWhat you get
- The state of code, hosting and dependencies: what is outdated and what is still supported
- Security risks, in order of urgency
- What is needed to take the system into management safely
- A proposal with a fixed monthly fee
- 1
System Check
We assess code, hosting, dependencies and security.
- 2
Choice
Take it over as is, with support and guarantees, or first fix what is needed.
- 3
Management
Clear agreements in an SLA, and further development if you want.
What you get every month
Management consists of three layers, each for a fixed monthly fee. You choose what you need.
Example with fictitious data.
Hosting and maintenance
Your system runs, stays current and can be restored.
- Hosting in the Netherlands: on our servers, at an enterprise hosting provider, or on-premise at your site
- Security updates right away, operating system and platform kept current
- Continuous, automated monitoring of availability and core processes
- Daily encrypted back-ups, kept for 30 days, within the Netherlands
- A recovery test at least once a year
SLA
Agreements you can hold us to.
- A monthly availability target, for example 99.5% for CROS
- Response times as agreed: for one client this week is fine, for another it has to be now. Faster costs more per month
- Service hours of your choice: office hours, 06:00 to 22:00 every day, or 24/7. Planned maintenance announced in advance
- Half-yearly review and an overview of availability and incidents
- More than one team member knows your system
Software maintenance and development
Your application itself stays current and grows with you.
- Framework and dependency updates following a maintenance roadmap
- Fixing defects in your application
- Cleaning up old code before it becomes a risk
- Further development on a fixed monthly budget, prioritised together
- One team that knows your application
No vulnerable package or leaked password goes live. And you can prove it.
Every change to your software goes through the same checks before it goes live, set out in our software development policy. Whatever a scan or a production error finds, we track until it is resolved.
Example with fictitious data.
Vulnerable components
All packages in use are checked for known vulnerabilities. With a critical or high finding, nothing goes live.
No passwords in the code
A secret scan looks for passwords, keys and tokens that accidentally end up in the code.
Code analysis with a quality gate
Static analysis with SonarQube for security, defects and maintainability, with test coverage and a quality gate.
Review before release
Every change is reviewed, including by an AI review on our own server. With a critical finding, a colleague has to approve before the change goes live.
Only through the fixed route
Our development policy requires every change to come in through a merge request, on protected branches and traceable to a task. The pipeline checks this and reports deviations.
No production data in test
Test data is checked. We only use production data in a test environment when it is anonymised.
Outdated software in view
We flag six months ahead when a PHP or Node version stops receiving security updates, and warn about a missed security patch.
Findings tracked and resolved
Scan results and production errors go into our tracking system and are resolved through the same checked route, not hidden.
Incident runbook per system
Our development policy requires an incident runbook per application: what we check first, how we test safely and who gets called. The pipeline checks that it exists and reports it when it is missing.
Also: licence checks of packages in use, load tests on a test environment and never on production, and a reporting point for security vulnerabilities (security.txt).
Proof for your client, insurer or auditor
Does a client ask you to show that your software is secure, for example because of NIS2? This is standard in the production environment.
Firewall on all traffic
A web application firewall on incoming traffic and a TLS configuration at A+ level.
Intrusion detection
Monitoring for intrusion attempts and for file changes that don't belong there.
Logging
Logins, access and administrative actions are recorded and kept for at least three months.
Encrypted back-ups
Daily, encrypted and stored offsite, within the Netherlands.
Tested recovery
At least once a year we restore a back-up to prove that recovery works.
Set up along ISO 27001
Policy, procedures and risk assessment following ISO 27001. Certification expected in Q4 2026.
Does your problem fit none of these? We also build new, from €10,000, always with management afterwards. Custom software →
Frequently asked questions
Can you take over software built by another party?
Yes. We always start with the System Check. Then we take it over as is, or first fix what is needed.
Where does my software run?
In the Netherlands: on our own servers, at an enterprise hosting provider, or on-premise in your own server room.
What does the SLA cover?
Service hours (office hours, 06:00 to 22:00 every day or 24/7), response and recovery times, a monthly availability target, planned maintenance, back-ups and recovery, logging and reporting. How fast we respond and when we are reachable is agreed per client. Faster or wider costs more per month.
Can we keep building ourselves, with Wabber as a backstop?
No. What we manage, we also build and develop further ourselves. That is the only way to meet the agreements in the SLA.
What does maintenance cost?
The System Check costs €1,950 fixed per application; if you then take management from us, we deduct that amount. Management is a fixed monthly fee, depending on the size of the system and the agreements in the SLA. That fee is in the proposal after the check.
Want to know the state of your system?
Schedule a System Check. Within one week you know the state of your system and what it needs.