Pricing
Fixed fees, agreed before any work starts.
One-off reviews
A fixed-fee report on an app or a deal. Read-only, nothing changed.
Rescue audit
£950fixed fee
- Best for
- Founders and owners of an app that is fragile, inherited or built with AI tools. Also acquisitions under £250K.
- Turnaround
- Seven working days from access
- Review of code, hosting, data and payments
- Every finding ranked by severity, with hours to fix
- A clear fix-or-rebuild verdict
- One-hour walkthrough call
Founding clients: the first three audits are £650 in return for a short testimonial.
Deal review
£2,500–£3,500fixed, quoted after a call
- Best for
- Buyers, sellers and advisors on acquisitions from £250K to about £2m.
- Turnaround
- Ten working days from access
- Everything in the rescue audit, on a larger codebase
- One-page deal summary for buyers and advisors
- Checklist of every account and asset that must transfer
- What to fix before completion, and what can wait
Ongoing support
Monthly retainers, after an audit or a completed purchase.
Caretaker
£750a month
- Best for
- Businesses that depend on an app nobody is actively maintaining, including new owners after a purchase.
- Term
- Three-month minimum, then monthly
- Security and dependency patching
- Backup checks, restore tests and uptime monitoring
- Up to four hours of fixes a month
- A short monthly health note
Fractional engineering
£2,500a month
- Best for
- Apps with solid foundations that need new features or architecture work.
- Term
- Monthly, limited availability
- 20 to 30 hours a month of senior engineering
- Features, architecture and code review on your roadmap
- Everything in Caretaker
Work is asynchronous, with replies by the next business day. No on-call or same-day support.
Holdfast takes no referral fees from either side of a deal, so reports say what they find.
Prices exclude VAT where applicable. Audits are invoiced on delivery of the report.
Questions
Is anything changed during an audit?
No. Audits are read-only. Fixes start only after the report, and only if you want them.
Can you sign an NDA?
Yes, before seeing anything. Holdfast can also provide a short mutual NDA.
Which tech stacks are covered?
JavaScript and TypeScript (React, Next.js, Node), Supabase, Firebase, Postgres, MySQL, Python, PHP (Laravel), Ruby on Rails and the JVM (Java, Scala, Kotlin), on Vercel, Netlify, Render, Railway, AWS or GCP. That includes apps built with Lovable, Bolt, Replit, v0 or Cursor.
Who owns the code and the report?
You do, once paid.
Do you work with financial-services firms?
No. Holdfast doesn't take on clients in banking, trading or other regulated financial services.
Not sure what state your app is in?
A free 15-minute call is enough to tell whether an audit is worth it.
Or email rob@holdfastapps.com