The beautiful tip of the iceberg
Most of what we build you'll never see. This is the part you can.
- Below the surfaceSaaS platforms, cloud systems and the engineering businesses run on.
- Above itA small glimpse of our UI/UX craft — ten real product interfaces.
- Home
- Services
- Software Audits
- Supplier Transition
Can we take over software developed by another company without rebuilding it?
In many cases, yes. A software supplier transition assessment establishes what you control, what only your current supplier knows, and what it would take for another team to build, deploy and support the application safely.
Synthetic example. Your audit is scoped to your question.
What is a Software Supplier Transition Assessment?
A software supplier transition assessment checks whether an application can move from its current developer to another engineering team. It verifies access to source code, infrastructure and operational accounts, tests whether the system can be built and deployed independently, and identifies the knowledge that needs capturing before the outgoing supplier leaves.
It is part of Assemblysoft's software audit and technical due diligence practice and can run on its own or as part of a comprehensive audit.
Situations where this review pays for itself
Your supplier is winding down
A development partner is closing, being acquired, retiring the product or no longer keeping pace.
The relationship is not working
Costs, responsiveness or quality have drifted and you want options before you serve notice.
The original developer has gone
A freelancer or key developer is no longer available and knowledge left with them.
A contract is up for renewal
You want to know what switching would really involve before you negotiate.
Six areas, each rated for impact and urgency
Source code access
Which repositories exist, who administers them, whether the history is complete and whether the code you can see is what is running.
Infrastructure & accounts
Hosting, Azure tenants and subscriptions, domains, DNS, certificates, app store and third-party service accounts: who controls each.
Build & deployment
Whether the application can be built from source and deployed by someone other than the original team.
Documentation & knowledge
What is written down, what lives in people's heads, and the questions to ask while the outgoing team is still available.
Integrations & credentials
API keys, service accounts and third-party contracts tied to the supplier rather than to you.
Contractual questions to raise
Technical observations that your legal advisors should check against the agreements, such as IP assignment or escrow.
From scoping to a prioritised plan
Scope, access and timescales are agreed before work begins. Anything that could affect a live environment is agreed separately and controlled.
Inventory of assets
We list every repository, environment, account and integration and record who currently controls each.
Independent build
Where authorised, we build and deploy to an isolated environment without the supplier's help.
Knowledge capture plan
Targeted questions and sessions for the outgoing team, focused on the gaps that matter most.
Transition roadmap
A sequenced plan for moving control, knowledge and support, with risks and dependencies.
Clear findings, honest boundaries
Deliverables
- Asset and control register: code, infrastructure, accounts, integrations
- Build and deployment reproducibility findings
- Knowledge-risk assessment and questions for the outgoing supplier
- Technical dependencies that could complicate the transition
- List of contractual questions for your legal advisors
- Sequenced transition roadmap
See how findings are presented in our anonymised sample report.
What this review does not do
- Confirming legal ownership and IP rights requires your legal advisors.
- Build validation needs the supplier's or your authorisation.
- Where the outgoing supplier will not cooperate, we state what could not be verified.
Aligned with recognised guidance
| Area | Supporting authority | How it shapes the audit |
|---|---|---|
| Secure development practices and software acquisition | Secure Software Development Framework (SSDF), NIST SP 800-218US National Institute of Standards and Technology | Gives a vendor-neutral vocabulary for judging whether software was produced with secure development practices, and explicitly supports using those practices when acquiring software. |
| Data protection during mergers and acquisitions | Data sharing code of practice: due diligence following mergers and acquisitionsUK Information Commissioner's Office | Identifies where personal data, its lawful basis and its security arrangements need attention when systems change hands. Legal conclusions remain with your advisors. |
These references support the audit methodology and its boundaries. They describe what a properly scoped audit can assess; they are not a claim that any particular client's systems have already been verified, and alignment with a framework is not a certification.
Your code, credentials and data, handled with care
An audit means trusting an outside team with source code, infrastructure and sometimes personal data. Here is how access and evidence are controlled. Certification describes how we run our own business; it does not, on its own, guarantee the security of a client's application.
NDA before detail
We sign your NDA or provide ours before receiving anything confidential, including the identity of an acquisition target.
Due-diligence questionsRead-only by default
Repository and cloud access at the least privilege needed, time-limited and revoked at the end. Anything that could affect a live system is agreed separately.
Information securityEvidence handled deliberately
Working copies are held only as long as the engagement needs, production data is avoided wherever possible, and evidence is returned or deleted on completion.
Data residencyCyber Essentials Plus
Assemblysoft holds Cyber Essentials Plus, independently audited. Our policies, insurance and certificates are published in the Trust Centre.
Visit the Trust CentreWhere personal data is in scope, a UK GDPR Article 28 Data Processing Agreement applies. Reports are confidential to you and shared only with the people you name, such as your advisors or board.
Supplier Transition, answered
What if our current supplier will not cooperate?
We work from whatever you can access directly, such as repositories, cloud subscriptions in your name and production behaviour, and the report clearly separates what was verified from what remains uncertain. The gaps themselves are useful evidence for your commercial and legal discussions.
Our application runs in the supplier's Azure tenant. Is that a problem?
It is common and fixable, but it means you do not yet have practical control. The assessment maps exactly what would need to move, in what order, and what the supplier would need to provide.
Do we need source code escrow?
Escrow can help, but only if what is deposited can actually be built and deployed. We can test that. Whether escrow is appropriate contractually is a question for your legal advisors.
Can Assemblysoft take over support afterwards?
Yes, through development partner transition and managed support. There is no obligation: the assessment is equally useful if you appoint another supplier or bring the work in-house.
Related questions from our software audit FAQ
- Can we take over software developed by another company without rebuilding it?
- How do we know whether we actually own the software and its source code?
- What happens if the original developer or software company is no longer available?
- How do we know whether another development team can maintain the software?
Explore the audit family
One evidence-based method, applied to the decision in front of you. Each specialist assessment can run on its own or as part of a comprehensive audit.
Software Supplier Transition Assessment
Can another team take over your software without rebuilding it? Control, knowledge and handover risks, assessed.
Change supplier without losing control
Tell us who built the system, where it runs and what is prompting the change. Confidentiality arrangements are welcome from the first conversation.
Discuss Your Requirements All Software Audit ServicesCyber Essentials Plus certified · NDA as standard · UK-based team · Microsoft Partner · No obligation to appoint us for remediation
Start a meaningful conversation with us today.
Assemblysoft are Your Safe Pair of Hands
Azure
Azure DevOps
