What do you do when the company that built your system disappears?
First, establish what you own. Source code, database schema, deployment access and domain control are four separate things, most firms routinely discover they have at least two of these. Once you know what you hold, the system can almost always be taken over. Someone will need to read it properly and document what it does and how it does it and can then get building again from a repository control.
What to secure today
- Export every source-code repository, including its full history.
- Confirm owner-controlled access to hosting, cloud accounts, domains, DNS, certificates, email, app stores and deployment services.
- Take fresh database and file backups, then verify that they can be restored.
- Secure build instructions, deployment files, environment configuration, package feeds and licence keys.
- Inventory integrations, scheduled jobs and external service providers.
- Rotate vendor-held credentials once your own access has been confirmed.
- Preserve contracts and invoices, and ask your legal adviser to confirm your intellectual-property and licensing position.
We have the source code is not the same as we can build it
The gap between a repository and running deployment is where most of these engagements start.
Having the repository is only the start. A system may still depend on packages held in a private feed, settings stored on a developer's machine, undocumented database changes or a deployment process known to one person. Our first milestone is a reproducible build from an owner-controlled repository, followed by a documented deployment and rollback path.
Reconstructing documentation from a system nobody understands
What can be recovered from the code, the database and the logs, and what genuinly cannot.
Getting to a supportive position
Not "rewritten", supportable, this builds reproducibly, it has a test path and someone can safely change it.
Regulation anchor
The Privacy Act 2020, when a vendor disappears, personal information does not. Firms often cannot say where a customers data is hosted, who retains a copy, or whether an offshore sub-processor still holds it. That is a live obligation, not a housekeeping matterm and it becomes urgent precisely when there is nobody to ask.
Frequently Asked Questions
Our development company has gone into liquidation. what do we do first? The first thing you need to do is secure copies of everything you can reach, the source code, database schema, credentials to the hosting domain and certificates. Then establish what you own, do you have the source code? Can you build it? do you have domain and DNS access? Once you know what you hold the system can be taken over. Try to do this in the first day or two after liquidation whilst the accounts are still live.
We have the source code, but cannot build it? Is it still recoverable?Almost always. What may be missing are the undocumented dependencies, configuration and secrets that only ever lived in the original developers machine. Reconstructing a reproducible build is a defined piece of work and itis the first thing we would doto get you into a supportable position.
Who owns the intellectual property with bespoke software?
That would depend on the contract. Unless the contract explicitly defines the IP to you it is more than likely that the development company owns it. Look for an assignment of intellectual property clause in the contract. If you are only given a license to use the software that is not the same as owning it. We are not lawyers we are developers, and would strongly advise you to discuss this with your own legal team as soon as possible.
Can you take over support for a system you did not write? Absolutely and this is one of our specialties. We don't need the original team and we don't need to rewrite it. We would like as much documentation as you can fine on the system and we would need access to the source code and database. From there we can install it onto a repository that you will own and be able to support you and your system moving forward.
How do we find out exactly where our customer data sits?We can trace this from the system. The configuration, the database, and the logs can all show where the data is stored and how it is accessed. We would need read-only access to the system for one of our team to be able to get you this information.
Related reading: The Hidden Cost of Making Do with Broken Data Systems