Taking over a production codebase from another agency
Taking over a production codebase from another agency runs in 5 steps: an audit, access and handover, a Stabilization Sprint, a rebuild or completion, and a small senior team (a pod) for the work that continues. Access moves into your accounts during the audit, before anyone changes a line of code.
Brocoders takes over codebases from other teams, with its main engineering division in Estonia. Fourteen projects began on a codebase we did not write. The audit costs $5,000 and 5 business days for 1 application.
TL;DR: Audit the code and move the accounts into your name in the first 5 business days, before anyone quotes a rebuild. Then make releases safe in 30 to 90 days, rebuild or finish what the audit ranked highest, and keep a small senior team (a pod) on what continues.
How the previous agency left decides the first week
Who can still answer questions sets the order of the first 5 business days.
The contract ended and the agency is cooperating. The outgoing team still answers, so the first week goes on history. Ask why the data model looks the way it does, which integrations fail quietly, and which deploy step only 1 person knows.
The team stopped answering. With the previous agency silent, the audit reads the code without a guide. Access comes from wherever it sits today.
A stalled software project follows the same path, and the audit decides what is worth finishing.
The agency still ships, just too slowly. Switching development vendor on a live product means a short overlap: ownership moves first, and the new team runs 1 production deploy before it takes the roadmap.
Steps for taking over a production codebase from another agency
The order matches our project takeover service.
Audit the code before anyone quotes a rebuild
The code and architecture audit takes 5 business days for 1 application and 10 for a platform with multiple services. A new engineer builds and deploys the product from a fresh machine using only what is written down, and every gap becomes a line in the handover checklist below.
The audit also covers the companies the code depends on: payment providers, integration partners, hosting, and the previous team if they answer. Lake, a vacation rental marketplace, had worked with other teams before us:
"He was the only one of 150 vendors who asked to speak with the integration partner that we were working with."
David Ciccarelli, CEO and founder, Lake
The audit ends in a written keep, fix, or rebuild verdict for each part of the system. HeyPractice, a sales training platform with enterprise customers already live, inherited code with no automated tests, no setup notes, and business rules mixed into the request-handling code.
The database design was sound, so the tables and their change history (models and migrations) stayed. The application programming interface, the logic, and the frontend were rebuilt. The same reasoning decides whether to refactor, replatform, or rebuild each component.
Move access before code changes
The code repositories, the cloud hosting account, the passwords and keys, and the documentation move into accounts you own within 5 business days of kickoff. The checklist below names each one.
Rotate every password and key the previous agency could see, because old credentials left live keep the old vendor in production.
Stabilize releases in 30 to 90 days
The Stabilization Sprint gets the product building and deploying under monitoring before anyone changes its behavior. With no old team on call, a safe way to ship a change and roll it back comes before new features.
For Traders Alloy, a Swedish fintech, the previous vendor could not get an automated path from code to production running. That path is a continuous integration and continuous delivery (CI/CD) pipeline. A senior DevOps engineer built it on Jenkins across backend and frontend, then trained the client's team to manage, test, and deploy on their own.
Rebuild or finish in phases, then keep a senior pod
The audit's ranking sets the order. A stalled build gets finished, and a system that works but blocks the roadmap gets rebuilt one part at a time while the rest keeps running. Once the system is stable, the pod takes the ongoing work, billed monthly.
The codebase handover checklist to ask for by name
Ask the previous agency for these 6 areas by name. If it is gone, the audit reconstructs whatever is missing.
| Area | Ask for this by name |
|---|---|
| Access and ownership | Admin rights on the code repositories, cloud account, domain registrar, domain name system (DNS) settings, and app store accounts, held by your company |
| Build and run | The setup steps and the deploy command, written down and run once by someone new |
| Infrastructure and deploys | Every environment, how code reaches production, and how a release is rolled back |
| Data and migrations | The database schema, the migration history, where backups live, and the date of the last tested restore |
| Integrations and third parties | Every external service, who owns its key, its plan or contract, and a contact at the provider |
| History and decisions | Open incidents, known bugs, and the reasons behind unusual design choices |
Takeovers we ran and what each one proves
CoreHealth, a UK telehealth company, came to us with an outdated codebase left by the previous contractor and a fixed deadline. A team of 5 rewrote it and delivered in 6 weeks. What began as a minimum viable product grew into 3 separate telehealth products.
HeyPractice went from the audit to production in 5 months, with a pod of 8. After the Traders Alloy pipeline went in, the case study records 5x faster deployment and 66.6% more features released.
When we tell you to keep your current agency
Replacing an agency that takes weeks to ship each fix costs the audit plus 30 to 90 days of stabilization before new features move faster. Week 1 ships no features at all.
If your current team answers within days and the product builds from a clean machine, keep the current team and tighten the contract.
When a takeover does make sense, we need 2 things from you: the credentials you can reach today, and 1 person who can approve access the same day.
Book the audit before you pick the next team
The audit gives you a written verdict and a list of what is missing, whichever team does the work. Book a code and architecture audit: $5,000 and 5 business days for 1 application.
The audit is a standalone product. If the answer is that you should not rebuild, we will write that down, and you keep every artifact either way. Or talk to the engineer who would run your takeover.
Frequently Asked Questions
Ask how they will build the product from a clean machine, which third parties they will talk to, and what the audit costs. Then ask whether they will put a keep, fix, or rebuild verdict in writing before quoting any rebuild.
Access moves within 5 business days of kickoff, alongside an audit of 5 to 10 business days, and the Stabilization Sprint runs 30 to 90 days. CoreHealth's rewrite of a previous contractor's codebase shipped in 6 weeks.
Yes, as long as you control the accounts. The audit works from the repository and the running system without a guide. If the previous agency holds the repository, the hosting, or the domain in its own name, recovering them comes first.
We recommend a rebuild only for the parts the audit marks for rebuild, in writing, before any quote. On HeyPractice, that meant keeping the database and rebuilding the rest.
The Essential audit costs $5,000 for 5 business days and covers 1 application under 3 years old, or a stalled build. The Standard audit costs $9,900 for 10 business days and covers a production platform 3 to 10 years old. Both end in a written refactor-versus-rebuild recommendation.
The product stays live by default. Moving access and running the audit change nothing in production, and the new team's first release can be rolled back.