Pricing
Fixed fees, agreed before any work starts.
One-off reviews
A fixed-fee review of an app or a deal. Read-only while reviewing. Audits end with the first fixes.
Rescue audit
£950fixed fee
- Best for
- Founders and owners of an app that is fragile, inherited or built with AI tools. Also acquisitions under £250K.
- Turnaround
- Seven working days from access
- Review of code, hosting, data and payments
- Every finding ranked by severity, with hours to fix
- A clear fix-or-rebuild verdict
- One-hour walkthrough call
- Up to four hours fixing the most serious findings
- First Caretaker month at half price if you start within 30 days
Founding clients: the first three audits are £650 in return for a short testimonial.
Deal review
£2,500–£3,500fixed, quoted after a call
- Best for
- Buyers, sellers and advisors on acquisitions from £250K to about £2m.
- Turnaround
- Ten working days from access
- Everything in the rescue audit, on a larger codebase
- One-page deal summary for buyers and advisors
- Checklist of every account and asset that must transfer
- What to fix before completion, and what can wait
Ongoing support
Monthly retainers, after an audit or a completed purchase.
Caretaker
£750a month
- Best for
- Businesses that depend on an app nobody is actively maintaining, including new owners after a purchase.
- Term
- Three-month minimum, then monthly
- Security and dependency patching
- Backup checks, restore tests and uptime monitoring
- Up to four hours of fixes a month
- A short monthly health note
Fractional engineering
£2,500a month
- Best for
- Apps with solid foundations that need new features or architecture work.
- Term
- Monthly, limited availability
- 20 to 30 hours a month of senior engineering
- Features, architecture and code review on your roadmap
- Everything in Caretaker
Work is asynchronous, with replies by the next business day. No on-call or same-day support.
Holdfast takes no referral fees from either side of a deal, so reports say what they find.
Prices exclude VAT where applicable. One-off reviews are invoiced 50% when you sign and 50% on delivery of the report.
Questions
Is anything changed during an audit?
Not during the review, which is read-only. After the report, a rescue audit includes up to four hours fixing the most serious findings, made as changes you review and approve before they go live. Deal reviews stay read-only throughout, so the report stays independent.
Can you sign an NDA?
Yes, before seeing anything. Holdfast can also provide a short mutual NDA.
Which tech stacks are covered?
JavaScript and TypeScript (React, Next.js, Node), Supabase, Firebase, Postgres, MySQL, Python, PHP (Laravel), Ruby on Rails and the JVM (Java, Scala, Kotlin), on Vercel, Netlify, Render, Railway, AWS or GCP. That includes apps built with Lovable, Bolt, Replit, v0 or Cursor.
Who owns the code and the report?
You do, once paid.
Do you work with financial-services firms?
No. Holdfast doesn't take on clients in banking, trading or other regulated financial services.
Not sure what state your app is in?
A free 15-minute call is enough to tell whether an audit is worth it.
Or email rob@holdfastapps.com