Build. Protect. Grow.

Both, depending on how much is uncertain. A written, stable scope — a site, a redesign, a defined integration — goes fixed price: one amount, a list of deliverables and payments against milestones. A product that will change while it is being built goes time and materials, per person-day, with a monthly cap agreed in advance. When the need is not yet clear we start with a short discovery phase, billed separately, that produces a firm quote. Quotes are in dirhams, excluding VAT, and set out what is not included as clearly as what is.

It depends on the scope, and we do not give a date before discovery. As an indication: a structured brochure site is counted in weeks, a line-of-business application or a client portal in months, split into batches delivered one after another rather than as a single final handover. The plan is revised at each batch. What most often moves a date is not the engineering: it is content awaiting sign-off and access still to be obtained (DNS, hosting, existing data). That is why we ask for them on day one.

Delivery includes a warranty period during which defects against the contractual scope are corrected at no charge. After that, a monthly maintenance contract covers security updates, backups and their restore tests, availability monitoring and a volume of hours for changes, rolling over or not depending on the plan. That contract is optional: the deployment documentation, the credentials and the repositories are handed over in every case, so that you can take over or hand the work to someone else.

You decide, and it is written into the contract: the hosting country, how long backups are kept and the list of people who have access. By default we deploy with European hosts, and in Morocco when that is a requirement on your side. If the project processes personal data, law 09-08 applies and a declaration to the CNDP may be required: we write the technical description of the processing, but the declaration stays in the name of the data controller, which is you.

You do. The assignment of rights over the code, the designs and the content produced for the project is written into the contract and takes effect on final payment — it is not left implied. You receive the Git repositories with their history, the hosting credentials and the operating documentation. We retain only the right to reuse our own generic internal building blocks, the ones that existed before your project. We put no proprietary lock and no usage licence on what we deliver to you.

It starts with written authorisation: exact scope, test windows, emergency contacts, what to do in case of an incident. Without that document we test nothing. Then comes passive reconnaissance — exposed surface, DNS, headers, certificates — followed by active testing on the authorised scope only: authentication, access control, injection, configuration, dependencies. You receive a report in which every finding carries its reproduction proof, its impact, its priority and the proposed fix, followed by a verbal debrief and a verification of the corrections. An audit describes the state of a system on a given date; it does not prove the absence of vulnerabilities.