The beautiful tip of the iceberg
Most of what we build you'll never see. This is the part you can.
- Below the surfaceSaaS platforms, cloud systems and the engineering businesses run on.
- Above itA small glimpse of our UI/UX craft — ten real product interfaces.
Keep your .NET applications supported, secure, and moving forward.
Windows Server 2012 reached end of life in 2023. SQL Server 2014 followed in 2024. If your business-critical ASP.NET application still runs on them, every new vulnerability stays unpatched — and the clock is ticking on compliance, insurance, and browser trust. The good news: your application almost certainly doesn't need a rewrite. It needs a carefully planned move to a supported platform — and that is a discipline we practise.
Is your stack still supported?
Many established .NET applications run beautifully — on platforms Microsoft no longer patches. Here's where the common legacy stack stands today.
Security exposure
Out-of-support servers receive no security patches. Every newly discovered vulnerability stays open indefinitely — and public-facing sites on unpatched infrastructure are actively targeted.
Compliance & insurance
Unsupported infrastructure can conflict with cyber-insurance conditions, PCI-DSS, and the "appropriate technical measures" expectation under UK GDPR — a commercial risk beyond the technical one.
Modern web compatibility
Ageing servers often lack modern TLS configurations. Over time that degrades browser trust, SEO standing, and compatibility with third-party services that retire legacy protocols.
No rewrite required
The .NET Framework 4.x family is backwards-compatible by design. An application compiled for .NET 4.0 or 4.5 runs on the 4.8 / 4.8.1 runtime without recompilation — and that runtime ships as a built-in component of Windows Server 2022 and 2025. In many cases your application is already running on a newer runtime than it was built for, without you ever noticing.
Your code moves as-is
The work is careful planning, dependency auditing, and validation — not risky code change. Configuration is adjusted for the new environment; the application itself stays intact.
Your database comes too
Databases from SQL Server 2008 onwards restore directly to SQL Server 2022 at a compatible level. We audit stored procedures and functions for anything the newer engine treats differently — before cutover, on staging.
A decade of runway
Windows Server 2025 is supported into the 2030s, with .NET Framework 4.8.1 built in. One well-executed move takes the support question off your desk for the best part of a decade.
Our golden rule
Nothing about your live environment is modified or decommissioned until its replacement has been fully proven and you have signed it off. The old server stays untouched throughout — reverting is a single DNS change, so your application is never without a working home.
A five-phase, review-first migration
Understand everything before anything moves. Prove everything before anyone notices.
Discovery & technical review
A structured review of the application, configuration, IIS setup, database, dependencies, DNS, certificates, and integrations. Output: a written migration plan, cutover runbook, rollback strategy — and a fixed quotation.
Environment build
The new server is provisioned and configured: IIS sites and application pools, .NET runtime validation, TLS certificates and hardening, database platform, and a repeatable deployment route your team inherits.
Staged testing
Your application and a copy of its data are deployed to a private staging address. Every form, email send, database operation, upload, and integration is tested — with your team validating alongside us.
Controlled cutover
DNS time-to-live lowered days in advance; final data sync inside the window; DNS switched at an agreed quiet time. Downtime is typically minutes — and the old environment stands ready as an instant rollback.
Hypercare & handover
Thirty days of watchful support: monitoring, issue resolution, and a documentation pack covering the environment, deployment process, and support routing — then coordinated decommissioning of the old platform.
Everything a safe migration demands
Delivered by senior engineers, documented at every step, and governed to the standard that due-diligence-minded organisations rightly expect.
Dependency & compatibility audit
Third-party components, COM dependencies, classic ASP, custom IIS configuration, hard-coded paths — surfaced before they can surprise anyone.
Database migration & SP audit
Backup/restore with integrity checks, plus manual review and staging validation of stored procedures and functions against the modern SQL Server engine.
Security & TLS hardening
Modern TLS configuration, security headers, least-privilege database access, and an external verification scan before go-live.
DNS, email & cutover planning
TTL management, SPF/DKIM/DMARC updates, deliverability test-sends, content-freeze coordination, and a rehearsed runbook for the switch itself.
System design analysis
A written report on the application's architecture: issues, security vulnerabilities, best practices, and a prioritised remediation roadmap that informs the hypercare period.
Governance & compliance
Secure credential handling, documented GDPR data-handling, audit-ready records, and approval gates at each phase — insurance-backed, procurement-friendly delivery.
Hosting provider liaison
We work with the hosting provider of your choice — engineer-to-engineer — from server specification through provisioning to a formal technical handover. Your contract stays in your name.
Documentation & handover
Server configuration, deployment procedure, credentials register, backup and restore steps, and support routing — written so your internal team is fully self-sufficient.
From "we were told we couldn't move" to a decade of runway
A UK membership organisation's business-critical website
Their ASP.NET site — targeting .NET Framework 4.5, backed by SQL Server 2014 with hundreds of stored procedures — had been running for years on Windows Server 2012 R2, because they'd been advised that operating system was required for their version of .NET. With every layer of the stack now out of Microsoft support, and thousands of member records under GDPR, the risk had become a board-level concern.
Our technical review established that the constraint never existed: the site was already running on the .NET 4.8 runtime. We planned a staged migration to Windows Server 2025 and SQL Server 2022, audited every stored procedure against the modern engine on staging, and cut over at a quiet traffic window with the old environment held as instant rollback.
Downtime at cutover: minutes. Application code changes required: none. Support runway: into the 2030s.
Server 2012 R2 · SQL 2014 · .NET 4.5 target — all out of support
Server 2025 · SQL 2022 · .NET 4.8.1 runtime — supported into the 2030s
Minutes — DNS switch with pre-lowered TTL
None — configuration changes only
Quality of life, at your pace
Once you're on a supported platform, the urgency is gone — and every next step becomes a considered choice rather than a forced one. The same team that migrated you can take you further, whenever you're ready.
Near term
Retarget to .NET Framework 4.8.1, bring the source under modern version control, and establish a repeatable deployment pipeline — small steps, big quality-of-life gains.
Medium term
Incremental improvements inside the existing application: performance, accessibility, security headers, and dependency updates — delivered alongside your team's normal development.
Longer term
A planned move to modern .NET and the cloud — opening cross-platform hosting, lower running costs, and long-term framework support. See our Modernisation & Transformation service.
Considering full modernisation — or a greenfield build?
We also deliver complete modernisation and transformation: re-platforming legacy applications to modern .NET, Blazor, and Microsoft Azure — and building brand-new, cloud-native solutions from the ground up. If your ambitions go beyond migration, that's our core business too.
Due diligence, already answered
A migration means trusting a partner with your source code, credentials, and data. We make that easy to verify: our policies, certifications, and evidence are published openly in our Trust Centre — ready for your IT questionnaire before you even send it.
Trust Centre
Our complete policy set, certifications — including Cyber Essentials — insurance, and company information, in one place.
Visit the Trust CentreInformation Security
How we protect your code, credentials, and data during an engagement — secure secrets handling, encrypted transfers, least privilege.
Read the policyIncident Response
How a security incident would be handled — containment, investigation, and prompt affected-customer notification.
See how we respondHosting & Data Residency
Where your data lives during and after a migration, and how UK residency is maintained when that's what your obligations require.
Check data residencyEngagements are governed by our Master Services Agreement, with a UK GDPR Article 28 Data Processing Agreement wherever personal data is involved — and we're happy to sign a mutual NDA before any access is granted. Common due-diligence questions, answered →
Answers before you ask
We were told our old Windows Server was required for our version of .NET. Is that true?
Almost certainly not. The .NET Framework 4.x family is backwards-compatible: applications targeting 4.0–4.7 run on the 4.8/4.8.1 runtime without recompilation, and that runtime is built into Windows Server 2022 and 2025. This is the single most common misconception we encounter — and correcting it usually removes the biggest perceived blocker to migrating.
Will our application need code changes?
Typically no — configuration changes only. If discovery surfaces something genuinely code-level (a hard-coded path, a legacy dependency), we have the development capability to fix it as part of the engagement rather than handing the problem back to you.
How much downtime should we expect?
Minutes, typically — and in many cases effectively none. The old site keeps serving visitors until DNS completes its switch to the fully proven new environment, and DNS time-to-live is lowered days in advance so propagation is fast.
What happens to our database?
It moves to a supported SQL Server release via backup and restore at a compatible level — no forced schema changes. We audit stored procedures and functions against the modern engine on staging first, because that's where migrations get caught out.
Do we have to change hosting provider — or use one you choose?
Neither. We're hosting-provider agnostic: we'll validate the specification of whichever provider you prefer, liaise with their technical team engineer-to-engineer, and the hosting contract stays in your name throughout. Our only interest is that the migration succeeds.
What if something goes wrong on the day?
The old environment is left fully intact until you sign off the new one — so rollback is a single DNS change back to a platform that was working yesterday. It's a migration where the safety net is structural, not aspirational.
How long does it take?
A typical single-application migration runs three to five weeks from kick-off to completed cutover, followed by 30 days of hypercare. The technical review in week one confirms a firm timeline and converts our estimate into a fixed quotation.
We're on Windows Server 2016 or 2019 — still supported, so should we wait?
The clock is running: Windows Server 2016 reaches end of extended support in January 2027, and 2019 in January 2029. Planning ahead means you migrate once, calmly, to Server 2025 — with support into the 2030s — rather than under deadline pressure alongside everyone else who waited. A technical review now gives you the plan and the price; you choose the timing.
Our SQL Server is approaching end of support too — can it move at the same time?
Yes — and it usually should. SQL Server 2014 is already out of extended support and SQL Server 2016 reached end of support in July 2026, so many estates have two clocks running at once. One planned migration brings the operating system and the database onto supported versions together, with a single testing cycle and a single cutover.
Do we have to move to modern .NET (.NET 8/10)?
No. .NET Framework 4.8.1 is a component of Windows itself and is supported for the lifetime of the operating system it ships with — so a migrated application has a genuinely long, supported future without a rewrite. Moving to modern .NET is a separate, optional choice with real benefits, and one you can make later, from a position of safety rather than urgency.
The developers who built our application have moved on — is that a problem?
It's one of the most common situations we walk into, and it's exactly what the review-first method is for. We work from the deployed application, its configuration, and the database — mapping dependencies and behaviour before anything moves — and we document everything as we go, so the knowledge ends up written down rather than in one person's head again.
We have Classic ASP pages or an Access database in the mix. Can they come too?
Yes. IIS on Windows Server 2025 still runs Classic ASP, and file-based databases can either move as they are or — often the better moment — be migrated to SQL Server as part of the same engagement. Mixed-era estates are normal for long-lived applications; discovery maps every piece before the plan is written.
Ready to get back under Microsoft support?
It starts with a fixed-fee technical review: a written migration plan, cutover runbook, rollback strategy, and a fixed quotation — yours to act on with us, jointly with your team, or entirely in-house.
Book a Technical Review Explore All ServicesCyber Essentials certified · UK/EEA data residency · Policies, certifications & evidence at our Trust Centre
Start a meaningful conversation with us today.
Assemblysoft are Your Safe Pair of Hands
Azure
Azure DevOps
