AI Engineering · Assessment, then scoped
It works. That’s not the same as being safe to depend on.
You built something with AI. It does the job, people started using it, and now real work runs through it. Somewhere in the back of your mind you know nobody has ever checked the architecture, the data, or where it actually runs. That check is a bounded piece of work, and it is much cheaper than finding out the hard way.
Sound familiar
Six ways this shows up.
If two or three of these are true, you are in the normal position for a company that used AI well. Nothing here means you did it wrong — it means it worked, and it outgrew how it started.
- It started as a demo and now somebody’s job depends on it.
- It is running on a free tier, or a trial account, or your laptop.
- Nobody has ever looked at whether customer data is exposed.
- You are the only person who knows how it fits together.
- You are afraid to change it because you don’t know what will break.
- It works — but you would not want a client to ask where it runs.
The assessment
Four things get read properly.
Not a scan and a score. Someone who has run production systems against regulated data since 2018 reads what you built and writes down what they found.
Architecture and data model
Whether the structure holds at ten times the volume, and which decisions you are about to be stuck with. This is the expensive category, because it is the one that gets more costly to fix every week it stays.
Security and data exposure
Who can actually reach your data, not who is supposed to. AI-generated code can look correct and still leave a table readable to anyone who asks. If you have compliance obligations, they get read against what the code actually does.
Hosting and reliability
Where it runs, what happens when it stops, whether it is backed up, and whether anyone finds out before your customers do.
Maintainability
Whether you can keep changing it safely — which is the whole reason you built it yourself instead of buying something. Software you are afraid to touch has already stopped being an asset.
You keep the written assessment either way. If you take it to somebody cheaper, it still tells them what to fix.
How an engagement runs
Assessment first, always.
Nobody should sign an open-ended engagement for work whose size is not yet known — including us. So the first step is small, fixed, and separately priced.
- 01
Assessment
Fixed fee, agreed before we start. We read what you built and give you a written account of what is sound, what is urgent, and what it will cost to fix — ranked, with the reasoning. It is yours whether or not you hire us for the rest.
- 02
You decide how far to go
Sometimes the answer is two weeks of remediation. Sometimes it is a rebuild of one layer while the rest stays. Occasionally it is that you are fine and should spend the money elsewhere — we have said that before and will again.
- 03
Remediation
We do the work: restructure what needs restructuring, close what is open, and keep the behaviour your users already rely on. Scoped from the assessment, so the number does not move once you have agreed to it.
- 04
Production hosting
Somewhere it can be depended on, with backups, monitoring, and a way to deploy changes safely. Set up in accounts you own.
- 05
A relationship, not a handover
You will keep changing it — that is the point of owning it. We review as it grows and we are there when something breaks, because a support queue is not much use at nine on a Friday night.
One promise
We are not going to tell you to start over.
What you built encodes something valuable — how your business actually works, put there by the person who knows. A firm whose first instinct is to rebuild it their way is charging you to delete that. We keep what works, fix what is genuinely dangerous, and tell you plainly which is which.
Tell us what you built.
What it does, roughly how it was made, and where it runs today. That is usually enough for us to tell you whether the assessment is worth doing at all.