About

A specialist studio, not an agency.

StackRefit is specialist work for businesses that depend on legacy PHP and Linux systems they can't afford to lose — or rewrite.

Specialist model

Senior-only, hands-on delivery.

StackRefit works on systems that quietly run real businesses: often built years ago, lightly documented, and maintained by someone who's no longer around.

StackRefit exists because the market doesn't only need someone who can write code. It needs someone who can map an old system quickly, communicate risk clearly, talk to non-technical owners honestly, and avoid recommending rewrites the business can't survive.

Principles

How we work, in six lines.

These aren't slogans. They show up in the proposal, the access checklist, and the invoice.

01 / 06

Audit before action

We don't touch production until we understand it. The audit protects the client, the agency, and us.

02 / 06

Preserve what works

Old code is often correct, just undocumented. We refit around real business logic instead of replacing it.

03 / 06

Senior-only delivery

No outsourcing chains, no junior handoffs. The person you talk to is the person doing the work.

04 / 06

AI-assisted, not AI-hyped

We use AI to accelerate documentation and analysis. We don't sell magic.

05 / 06

Fixed scope, fixed price

Hourly billing on legacy work creates bad incentives. Every engagement is scoped first.

06 / 06

Honest opinions

If your system doesn't need a refit, we'll say so. If it needs more than we offer, we'll say that too.

Operational safeguards

Discipline that's part of the value.

Working on revenue-critical infrastructure means tight rules. We don't hide them — they're part of why agencies hire us.

  • 01NDA before sensitive access
  • 02DPA where personal data is involved
  • 03Named authorization before production access
  • 04Written scope before touching production
  • 05Read-only access for audits where possible
  • 06Backup confirmation before urgent production changes
  • 07Staging-first approach where feasible
  • 08Rollback plan for every upgrade
  • 09Password manager + 2FA · least-privilege access
  • 10No external AI processing of client code, logs, credentials, or personal data without written approval
  • 11No takeover where no responsible owner can approve access and changes