Skip to main content
Sign in

Productised engagement · Platform Graduation

Graduate the platform.
Keep the business.

You built a real business on Lovable, Base44, Bolt or Replit. Customers pay, data accumulates, and someone has now asked for your backups, your security posture or your architecture. We move the platform onto a cloud account you own, on Azure or Google Cloud, with a stated recovery target and the evidence to prove it.

We are a forward-deployed engineering firm. Much of our work is in healthcare and other regulated settings, and we train your team while we build, so the platform stays yours after we leave.

Request a conversation

How the work moves

  1. 01

    Assess

    Five days. Architecture, risk register, cost model, fixed quote.

  2. 02

    Build

    Your cloud account, your repositories, your keys.

  3. 03

    Cut over

    Rehearsed migration with a rollback plan and a restore drill.

  4. 04

    Operate

    Optional managed platform with a named engineer.

Nothing is touched before the assessment, and nothing in the assessment needs write access to your systems.

Who it is for.

A business that has outgrown the builder it started on. The signs are the same across industries.

Revenue on rented ground
The app takes payments and holds customer records, and the database, storage, secrets and sign-in still live inside the builder's account rather than yours.
A customer asked
An enterprise buyer, an investor or a compliance reviewer has asked for an architecture document, a backup policy or a security questionnaire, and there is nothing to hand over.
Regulated data
Patient, clinician, financial or minors' data is in the system, and the next contract will come with a Business Associate Agreement or a SOC 2 question attached.
A team that still wants to ship
The founders want to keep building fast. The platform we hand back keeps the parts that worked and replaces the parts that will not scale, with a pipeline the team can run.

What we deliver.

A production platform the business owns, on its own Azure or Google Cloud account, with the evidence to show a customer, an investor or an auditor.

Architecture
Target architecture document, data model review, service boundaries and cost model, with a written decision for every component: keep, harden or rebuild.
Infrastructure
Infrastructure as code (Bicep or Terraform), separate development, staging and production environments, private networking, managed Postgres, object storage, a secrets manager, WAF and CDN.
Application
Code moved into your GitHub organisation, dependency and security hardening, authentication and authorisation corrected, payment webhooks and subscription state made correct and idempotent, structured logging and error handling.
Data
Migration of the database, storage files, users and OAuth providers from the builder or Supabase, with a rehearsed cutover and a rollback plan.
Resilience
Backups with a stated RPO (how much data can be lost) and RTO (how fast we restore), proven by an actual restore drill before go-live. Monitoring, alerting, uptime checks and an on-call runbook.
Delivery
Continuous integration with tests, type checks, build and security scans, and a release pipeline with rollback that your team runs without us.
Training
Your engineers, or the founder, work alongside ours through the build. The handover is a working session, not a document drop.

How an engagement starts.

The five-day Platform Assessment is the whole first step. It needs read access only, it ends in a fixed quote, and you can take the report anywhere.

  1. 01Request a conversation below. Twenty minutes with the founder to confirm the fit and agree what is in scope.
  2. 02The Platform Assessment: five business days, $4,500. Architecture review, risk register, cost model for your cloud, and a fixed quote for the build at the tier that matches your recovery target.
  3. 03You decide. If the build goes ahead, the assessment fee is credited to it. If it does not, the report is still yours.

Price.

Fixed prices, set in writing before work starts. The tier is decided by the recovery target the business needs, not by how hard the migration looks.

Platform Assessment
$4,500
Five business days. Credited to the build.
Graduation, Standard
$28,000
Single region, daily backups, documented restore. RPO 24 hours, RTO 8 hours. Three to four weeks.
Graduation, Business
$45,000
Point-in-time recovery, warm standby, monthly restore drill. RPO 1 hour, RTO 1 hour. Four to six weeks.
Graduation, Critical
from $75,000
Multi-zone, automated failover, quarterly drills, for regulated data. RPO 5 minutes, RTO 15 minutes. Six to ten weeks, quoted.
Managed Platform
$2,500 to $6,000 a month
Monitoring, patching, backups and drills, cloud cost management, one engineering change a month, a named engineer.
Audit readiness, SOC 2 Type I scope
$12,000
Alongside the build. Controls, policies and evidence prepared for an independent auditor.
Audit readiness, HIPAA
$15,000
Security Risk Analysis, safeguards, policies and evidence prepared against the HIPAA Security Rule.

Independent auditors perform SOC 2 and HIPAA audits. We prepare the platform and the evidence so that the audit can be passed; the audit itself is contracted with the auditor.

What you receive in writing.

Every engagement ends with documents you can hand to a customer, an investor or an auditor without us in the room.

  • The Platform Assessment report: architecture review, risk register, cost model and fixed quote.
  • The target architecture document and the keep, harden or rebuild decision record.
  • Infrastructure as code and the release pipeline, in your repositories.
  • The migration plan, the cutover record and the rollback plan.
  • The restore-drill record with the measured recovery point and recovery time.
  • Runbooks for operations, on-call and incident response.
  • A security posture summary written for questionnaires and due diligence.
  • A recorded handover session with your team.

Request a conversation.

Tell us what the app does, roughly what it earns, and what prompted the question. The founder replies within one business day.

Written by the founder, answered by the founder. Twenty minutes, no deck.

Or email sam.sweilem@lockedinlabs.ai

We use what you send here only to reply to you. It goes to the founder's inbox and nowhere else. See the privacy notice.