AI built the prototype. We ship the production system.

Building the first version is now cheap — that part is settled. What is not settled: production hardening, security review, accessibility, performance tuning, multi-tenancy, integration depth, test coverage, observability, regulatory compliance, and long-term maintainability. A prototype that handles 10 users with happy-path inputs is a different system than one that handles 10,000 users with edge cases, audits, and a five-year change history. The latter is what we build.

Often yes, and that is increasingly common. We audit the prototype, identify the gaps (usually authentication, error handling, security, test coverage, accessibility, and performance), and either harden in place or rewrite specific layers. Honest assessment up front: sometimes the prototype is good enough as a starting point, sometimes the underlying architecture has to be replaced. Either way you keep the validated requirements.

Three reasons that still hold in 2026: you own the IP and can extend it in directions generic SaaS will not support, you avoid per-seat or per-event fees that compound at scale, and you can integrate deeply with your specific operational systems. Custom software ROI typically beats SaaS economics within 18-36 months for businesses past a few dozen users. Below that threshold, SaaS is usually right — we will tell you which side of it you are on.

Change is expected and managed. We use a formal change request process: scope, timeline, and cost impact documented before the change is incorporated. Small changes are absorbed in sprint buffers; significant changes are surfaced early in a written assessment. We have never had a project derail from scope changes because we surface impact when it is still cheap to react.

You do — completely. All code, designs, documentation, and architectural artifacts transfer to your GitHub organization under your control. No licensing fees, no carve-outs, no vendor lock-in. The same applies to documentation and any internal tools built during the engagement.

Mutual NDA before any discovery session. Every team member is under a confidentiality agreement. Internal communications stay in dedicated channels per client. We do not reference specific client business logic in any external content without explicit written approval.

Three options: a 30-day hypercare period (included in every build engagement at no extra cost) for transition to your internal team, a monthly maintenance retainer for ongoing improvements and dependency patching, or full handover with runbooks for self-managed operation. Roughly 60% of build clients convert to a maintenance retainer; the rest go internal. Both are good outcomes.

Our published SLA is patch in under 2 hours for critical advisories on systems we maintain. We monitor the CVE database across every dependency and run a Node-advisory poller against the installed manifest every six hours. In May 2026 we patched the Next.js GHSA-26hh-7cqf-hhc6 advisory across 8 production deployments within 90 minutes of disclosure — see the response playbook on our blog for the full operational detail.