The problem
For owners, operations directors and heads of digital who are responsible for a system they did not build, or no longer trust.
The system falls over, and nobody knows why until a customer calls.
A supplier left a project half finished, or disappeared.
The platform is growing faster than its foundations.
A customer, insurer or tender asks security questions you cannot answer.
Personal data is in more places than it should be, and UK GDPR work is overdue.
What HAE delivers
Clear findings, ranked by risk.
Then fixes done as fixed-scope work, with checks that stop the problem quietly coming back.
- Health checks
of code, hosting, security, data handling and how changes are released.
- Rescues
of stalled or failing projects, including taking over from another supplier.
- Security work.
Access control, secrets handling, dependency updates, security headers, backups and recovery, logging and alerts.
- UK GDPR work.
A data map, records of processing, retention rules, privacy notices and the technical measures behind them.
- Checks that stay.
Automated tests and monitoring that keep running after we have gone.
What a health check covers
Code and structure.
Can it be understood, changed and tested safely?
Hosting and infrastructure.
Where it runs, what it costs, and what happens when a part fails.
Security.
Who can access what, how secrets are kept, known weaknesses in dependencies, and the settings that protect users.
Backups and recovery.
Whether backups exist, whether they have been tested, and how long recovery takes.
Data.
What personal data is held, where, who can see it, and how long it is kept.
Reliability.
Monitoring, alerts, and the ways the system has failed before.
Delivery.
How changes are tested and released, and how often that goes wrong.
Ownership.
Whether the accounts, domains, licences and code are in your name.
How an engagement runs
Scope.
We agree what worries you, what is in scope and what access we need. Read-only wherever possible.
Review.
We read the code, inspect the infrastructure, test the system and talk to the people who run it.
Report.
You get findings ranked by risk, each with evidence, a recommended fix and a rough size.
Fix.
Fixes are agreed as fixed-scope work and done in reviewed, tested steps.
Prove.
Checks are put in place so the problem cannot return without someone being told.
What you get
- A written report with findings ranked by risk.
- Evidence, a recommended fix and a rough size for each finding.
- A plain-English summary for owners and boards.
- The agreed fixes, done in reviewed and tested steps.
- Automated checks and monitoring that stay in place.
- Tested backups and written recovery steps.
- Where UK GDPR is in scope, a data map and the records to support it.
- Updated documentation, with the accounts and code in your name.
FAQs
What is a software health check?
A fixed-scope review of a system’s code, hosting, security, data handling and delivery process. It ends with a written report that ranks the findings by risk and recommends a fix for each one. You can act on the report yourself or ask us to do the fixes.
Can you take over a project another supplier built?
Yes. We start with a health check, so everyone understands the state of the system before any promises are made. Then we agree what to stabilise first. We work from the code and the live system, so we do not depend on the previous supplier.
Do you need access to our live systems?
For a review, read-only access is usually enough, and we ask for the minimum. For fixes, we agree access in writing, use separate accounts, and remove them when the work ends.
Is the UK GDPR work legal advice?
No. We are engineers, not solicitors. We do the technical and practical work: finding where personal data is, mapping it, setting retention, and building the measures that protect it. Where you need legal advice, we work alongside your legal adviser.
What security standards do you work to?
We follow recognised UK security guidance for small and mid-sized organisations, and we can help you prepare for Cyber Essentials. Every finding in a report is backed by evidence, so you can check it yourself.
How long does a health check take?
It is fixed scope and fixed price, agreed before we start. The length depends on the size of the system. Fixes are scoped separately once you have the report.
Find out what state it is really in.
Book a call about a health check, or tell us what is failing. We reply within one working day.