What do you do when the company that built your system disappears?
First, establish what you own. Source code, database schema, deployment access and domain control are four separate things; most firms discover they have at least two of them. Once you know what you hold, the system can almost always be taken over. Someone will need to read it properly, document what it does and how it works, and restore a build from an owner-controlled repository.
What to secure today
- Export every source-code repository, including its full history.
- Confirm owner-controlled access to hosting, cloud accounts, domains, DNS, certificates, email, app stores and deployment services.
- Take fresh database and file backups, then verify that they can be restored.
- Secure build instructions, deployment files, environment configuration, package feeds and licence keys.
- Inventory integrations, scheduled jobs and external service providers.
- Rotate vendor-held credentials once your own access has been confirmed.
- Preserve contracts and invoices, and ask your legal adviser to confirm your intellectual-property and licensing position.
“We have the source code” is not the same as “we can build it”
The gap between a repository and running deployment is where most of these engagements start.
Having the repository is only the start. A system may still depend on packages held in a private feed, settings stored on a developer's machine, undocumented database changes or a deployment process known to one person. Our first milestone is a reproducible build from an owner-controlled repository, followed by a documented deployment and rollback path.
Reconstructing documentation from a system nobody understands
What can be recovered from the code, the database and the logs, and what genuinely cannot.
Getting to a supportable position
The goal is not necessarily to rewrite the system, but to make it supportable: it builds reproducibly, has a test path and can be changed safely.
Regulation anchor
Under the Privacy Act 2020, when a vendor disappears, personal information does not. Firms often cannot say where customer data is hosted, who retains a copy or whether an offshore sub-processor still holds it. That is a live obligation, not a housekeeping matter, and it becomes urgent precisely when there is nobody to ask.
Frequently Asked Questions
Our development company has gone into liquidation. What do we do first?
The first thing you need to do is secure copies of everything you can reach: the source code, database schema, hosting credentials, domain access and certificates. Then establish what you own. Do you have the source code? Can you build it? Do you have domain and DNS access? Once you know what you hold, the system can be taken over. Try to do this within the first day or two after liquidation, while the accounts are still live.
We have the source code, but cannot build it. Is it still recoverable?
Almost always. What may be missing are the undocumented dependencies, configuration and secrets that lived only on the original developer's machine. Reconstructing a reproducible build is a defined piece of work, and it is the first thing we would do to get you into a supportable position.
Who owns the intellectual property with bespoke software?
That depends on the contract. Unless the contract explicitly assigns the IP to you, it is likely that the development company owns it. Look for an intellectual-property assignment clause in the contract. A licence to use the software is not the same as ownership. We are developers, not lawyers, and strongly advise you to discuss this with your legal team as soon as possible.
Can you take over support for a system you did not write?
Absolutely. This is one of our specialities. We do not need the original team and do not need to rewrite the system. We would like as much documentation as you can find, along with access to the source code and database. From there, we can place the source code in a repository that you own and support both you and your system going forward.
How do we find out exactly where our customer data sits?
We can trace this from the system. The configuration, the database, and the logs can all show where the data is stored and how it is accessed. We would need read-only access to the system for one of our team to be able to get you this information.
Related reading: The Hidden Cost of Making Do with Broken Data Systems