Safe to change,
ready to sell
What the architecture discovery found, what it means for the business, and the decisions we need from you.
Alexander · Tech Lead
The product works. The way we build it holds us back.
What works
A feature-rich ERP in daily use
Around 80 operator companies run sales, planning, driving and invoicing on it.
What holds us back
Slow, risky change
No automated safety net, gaps in basic protection, and knowledge held outside the company.
The fix is not a big rewrite. It is a gated programme: make change safe first, then move the platform piece by piece, with customers undisturbed.
11.6M NOK a year in IT, three quarters on one supplier
75%of IT spend goes to the offshore development team (via Gture)
53%of shipped tickets are fixes, not new value
~1MNOK a year on Google Maps, rising 18% over the year
~1.1MNOK a year on AWS, already reduced in April 2026
The biggest saving is efficiency, not cutting services. Fewer fixes means more of the 8.7M buys new value. Our own map service can also take over most Google Maps calls: about 83k NOK a year for every 10% we move.
Source: IT cost export Oct 2025 – Sep 2026, excl. VAT. Internal: contains supplier costs.
Four risks owners should know about
- AccessProtection is not on by defaultSeparation between customers must be enforced, not assumed.
- ContinuityBackups are not confirmedProduction databases sit outside our infrastructure code. Being confirmed now.
- MoneyPayments can fail silentlyA Stripe reconciliation will show the real impact.
- PeopleKnowledge sits with the supplier~90% of code changes, plus QA, releases, operations and cloud admin.
Details go to the incoming CISO, not this deck. First checks within 30 days.
The same work opens new markets
UK operators require ISO 27001. Germany, with about 3,600 coach operators, could follow.
- ISO 27001A gate for UK salesControls must run, with evidence over time. Starting late delays revenue.
- GDPRThe same across the EURetention, logging and supplier rules for the data we hold.
- One platformA market is configurationLanguage, e-invoicing and accounting as settings, not a new build.
Safety work doubles as evidence for auditors and new markets alike.
Built for sustainable transport
SDG 11.2Transport for everyoneWheelchair places recorded for each vehicle, and accessible apps as a minimum standard.
SDG 13Lower emissionsCO2, Euro class and fuel for each vehicle, and planning that cuts wasted kilometres.
SDG 3.6 · 8.8Safe working hoursRostering and timesheets that help operators keep to drivers' hours and rest.
Next: CO2 per trip. Large clients must report their emissions, and new EU rules set how transport emissions are counted.
Six stages, each one gated
- R0 · SafetyBackups, alarms, tests, protection on by default.
- R1 · One home for appsA shared repository for all our web apps.
- R2 · Retire the old UIA new backend for the web apps replaces the old one.
- R3 · TiersThe mechanism to sell modules and API access.
- R4 · Clean seamsSplit the API by business domain.
- R5 · New stackMove each domain to TypeScript, one at a time.
No big bang. Every stage has a measurable gate, and stages overlap only where it is safe. We can pause without leaving anything half-built.
Bring the platform close to home
Team · first setup
Our own team in Oslo
Tech Lead, two full-stack developers, one frontend developer and one UX / UI designer. Devops is shared by the team.
Leadership
CTO → CISO, Tech Lead → CTO
Security and ISO 27001 get an owner. The Tech Lead leads the team and the transition.
- Mid-NovemberWe advertise four roles.
- JanuaryTwo bridge contractors start.
- 31 JanuaryThe supplier's last day.
- April – MayThe new team is in place.
Initial dates, not final: they can move, for example with the supplier's notice terms or hiring.
Fewer people, more output
| Measure | Today (offshore team) | Target (own team) |
|---|---|---|
| How often we ship | About weekly | Daily |
| Change to production | 9 days median, features 22 | Under 2 days, features under a week |
| Rework | 53% of shipped tickets are fixes | Under 25%, falling |
| Roadmap items per quarter | Counted from today's team | Higher, from Q3 2027 |
Why fewer can deliver more: no hand-over layer, far less rework, one platform instead of many copies, and AI-assisted development. Reported to you every quarter from April 2027.
More delivered, for less money
5.5MNOK a year for the four new hires, all employer costs included
7.5MNOK a year for the offshore team today (current run rate)
−2.0MNOK a year, or −2.7M if the UX / UI hire replaces the external designer
6.2MNOK for the next 12 months, including the handover and two bridge contractors
The risk is the handover, not the money. February and March have no offshore team and no new hires yet. Two contractors from January cover operations, and everything the supplier knows must be written down by 31 January.
Source: doc 28 (employer costs 2026: employer's tax 14.1%, holiday pay 12%, pension 5%). Dates are initial and can move. Internal: supplier costs.
Cheaper by March, ahead by May
Initial dates, not final: they can move. Delivery is the plan (today's team = 100), measured every quarter.
The first setup, not the end state
- Spring 2027Four hiresTech Lead plus two full-stack, one frontend and one UX / UI. About 5.5M a year.
- At capacityA fifth hireAnother full-stack developer. About 7.0M a year, still below the offshore team today.
- As sales demand itGrow furtherMobile, or a platform engineer once devops outgrows the shared model.
The saving pays for the growth. Each step follows the delivery figures and sales: UK operators once ISO 27001 is in place, or a first German customer.
Confirm, stabilise, then hand over
- Days 1–30ConfirmBackups, security checks, rotate credentials, alarms, a payment baseline, and a register of who holds access to what.
- Days 31–60StabiliseFix payment flows, add automated checks on every change, write runbooks the new team can use.
- Days 61–90Hand overTake over every account and access, and move operations from the supplier to the bridge contractors.
Product delivery continues. The supplier stays on the delivery queue until 31 January, while the safety work and the handover happen.
Four decisions
- Back the direction: gated, safety first, no big bang
- Our own team, with the supplier ending on 31 January
- A target date for ISO 27001
- Timing of the CTO / CISO change
The dates are initial and can move. For a 31 January end, a three-month notice to the supplier must be given by 31 October.
Questions
Alexander · Tech Lead