Work with us
[CORE_SERVICE_V2]

Managed Software Custody

Your team built it with AI. We adopt it, harden it, and keep it running — patched, monitored, backed up, and ready for your auditor.

[CUSTODY_LIFECYCLE] Continuous

  1. Assess

    Once · 10 days

    Inventory and risk-score every app. Report, register, go/no-go.

    • Secrets
    • Auth
    • CVEs
    • Backups
    • EU AI Act

  2. Stabilize

    Once · 2–6 weeks

    Repo, CI, secrets in a vault, tests, and a restore we have proven.

    • Hardened
    • Documented
    • Migrated

  3. Custody

    Ongoing

    Patching, monitoring, incident response and audit evidence.

    • 24/7
    • Patched
    • Audit-ready

Assess and stabilize happen once. Custody does not stop.

Adopted, Hardened, Kept Running

Your people built the tools they always wanted — in Cursor, Claude Code, Lovable, Replit, or a weekend of focused work. The tools are genuinely useful. Nobody owns them. Secrets sit in source control, dependencies drift, there is no restore you have ever tested, and the person who wrote it has changed teams. Then an auditor asks who is responsible. Managed Software Custody is the answer to that question. We assess what you have, stabilize what is worth keeping, and then take operational custody — patching, monitoring, backups, incident response, and a small change budget each month so the tool keeps up with the team using it. This is not a cleanup invoice; it is an operator of record. TESARK has shipped software since 2013 across 240+ projects for 130+ clients in 25+ countries, and operates an audited quality management system (ISO 9001:2015) and information security management system (ISO 27001:2022).

Core Capabilities

  • Custody Assessment — from $4,500: Ten business days. Per-app risk scoring across secrets in source control, auth, data exposure, dependency CVEs, backups, IP and licence position, and EU AI Act classification. You get a register, a report, and a straight go/no-go on every app.
  • Stabilization — fixed price, per app: Two to six weeks. Repo and CI, secrets into a managed store, auth hardened, tests on the paths that matter, infrastructure as code, monitoring, and a restore we have actually proven. Ends with a runbook, not a verbal handover.
  • Watch — baseline custody: Uptime and monitoring, dependency and security patching, backups with a quarterly restore test, next-business-day incident response, and a quarterly report that says what changed and what broke.
  • Operate — custody with a change budget: Everything in Watch plus 16–24 engineering hours a month for real changes, a four-hour response during business hours, a named engineer who knows your stack, and a monthly review.
  • Govern — custody your auditor accepts: Everything in Operate plus a maintained application register, periodic access reviews, evidence mapped to ISO 27001 controls for your own audits and vendor questionnaires, EU AI Act classification upkeep, and a one-hour P1 response.
  • One Runtime, Not Ten Snowflakes: Every app we adopt moves onto a single reference stack — one hosting target, one CI template, one monitoring stack, one secrets manager. That is what makes custody affordable and on-call possible. Apps that cannot move are declined or priced as an exception. We say which, up front.

Frequently Asked Questions

Can you take over an app we built with Lovable, Cursor, Replit or Claude Code?
Yes — that is the core of this service. The tool it was built with matters far less than where it runs, what data it touches, and whether anyone can deploy it safely today. The Custody Assessment establishes all three before we quote anything.
Is this the same as vibe coding cleanup?
Cleanup is a project: someone refactors your code, invoices, and leaves. Custody is ongoing operational responsibility — we are the operator of record, on call, patching and reporting, month after month. Stabilization is one step of ours and looks like a cleanup; the difference is what happens the following month.
What does it cost?
The Custody Assessment starts at $4,500 for up to five apps. Stabilization is fixed-price per app, typically $8,000–$35,000 depending on what the assessment finds. Managed Custody runs from around $1,500/month for Watch, $4,000/month for Operate, and $9,000/month for Govern across a portfolio. If you are looking for a $20/month plan, this is not it — real custody means an engineer who answers the phone.
Why does the assessment have to be paid?
Because we are agreeing to run software we did not write. The assessment is how we find out what we would be taking on, and how you find out which of your apps are worth keeping. We decline custody of some apps we assess, and say so plainly — a free audit would quietly push us to say yes to everything.
Who owns the code and the data?
You do, throughout. Custody is operational responsibility, not ownership. Repositories, cloud accounts and data stay yours or transfer to you on request, and every engagement ends with current runbooks so another team could take over.
What if we want to stop?
Custody runs on a three-month minimum and then month-to-month, with a discount for annual commitments. On exit you keep the hardened repository, the infrastructure as code, the runbooks and the register. No lock-in through ignorance is the point of the documentation.
Is TESARK certified?
Yes. TESARK holds ISO 9001:2015 for quality management (certificate IN/52127327/8579) and ISO 27001:2022 for information security management (certificate IN/78428431/5964), both issued by ICV Assessments Pvt. Ltd. and valid through 2029. Certificate details are published in full at /certifications so you can verify them with the certifying body directly.
How fast can custody start?
The assessment takes ten business days from kickoff. Stabilization follows in two to six weeks per app depending on findings. Apps already in reasonable shape can enter Watch-tier custody immediately after assessment, without a stabilization project.

Related Case Studies

B2B / Enterprise AI

Enterprise AI Platforms Integration

Read Case Study → ERP / Renewable Energy

Solar O&M Management Platform

Read Case Study →
Get a Technical Consultation
ENGINEERING_STACK
GitHub Actions
Terraform
Docker
PostgreSQL
AWS / GCP / Azure
Cloudflare
Grafana / Prometheus
Sentry
Vault / Secrets Manager

Strategic Use Cases

Ownership Decay: The Builder Left

Scenario: An operations lead built a quoting tool that three regions now depend on. They moved to another team nine months ago. It holds live customer data, has no repository anyone can find, and no one knows where it is hosted.

Outcome: Assessment locates and documents the app, scores its exposure, and recovers the source. Stabilization moves it into a governed repo with CI, rotates every credential, and proves a restore. Custody then carries it, with a named engineer on record.

Audit Pressure On Internally Built Tools

Scenario: A mid-market company passes its own ISO surveillance audit, then gets asked to account for fourteen internal apps staff built with AI assistance. There is no register, no access review, and no patching evidence for any of them.

Outcome: A register is produced and maintained in Atlas, each app classified by data sensitivity and reach. Govern-tier custody supplies the patching, access review and control evidence the auditor asks for, on a schedule rather than in a panic.

Useful Prototype, Unshippable Footing

Scenario: A team's internal dashboard became the way a department works. It runs on one person's cloud account, authenticates with a shared password, has API keys in the repository, and has never been backed up.

Outcome: Stabilization replaces shared credentials with real authentication, moves secrets into a managed store, adds tests on the critical paths, and migrates it onto the reference runtime. It then enters Operate with a monthly change budget so the department keeps getting improvements.