Code and risk-relevant changes
Review new or changed logic, critical paths, error handling and conspicuous patterns in the agreed repository.
Auth, roles and data access
Assess authentication, authorisation, tenant isolation, RLS, administrative functions and sensitive data paths.
Dependencies, CVEs and runtimes
Assess security advisories, package versions and EOL risks for actual exposure and required action.
Architecture, APIs and data model
Review coupling, interfaces, background processes and the data model against maintainability and product requirements.
Deployment and operational risk
Consider secrets, environments, builds, tests, rollback, monitoring and backups where they affect release risk.
Findings and technical clarification
Document prioritised findings and discuss them with your team within the included clarification allowance.
AI code review for AI-built software
Your team continues developing with AI tools or its own engineers. WZ-IT regularly reviews technically relevant changes, assesses risks and documents clear priorities. Implementation, hosting and incident response remain separately commissioned services.
Starting point
Suitable when your team continues development
- An AI-built or AI-assisted application changes regularly
- Your internal team, an agency or individual engineers implement the changes
- Critical changes should receive an independent technical review before releases
- Auth, roles, data access, dependencies and operational risk require recurring prioritisation
- You need traceable findings and direct access to technical clarification
Ongoing technical control
Keep developing without letting technical risk grow unnoticed
The retainer combines recurring human review with documented prioritisation. Your team retains development speed and product ownership while WZ-IT provides an independent technical view of the agreed application.
Review changes in context
Assess not only isolated diffs but also architecture, data paths, permissions and the impact on the existing application.Prioritise risks
Assess dependencies, CVEs, authentication, roles, data access and technical findings according to their actual relevance.Document decisions
Record what should be resolved soon, what matters before a release and what can be consciously scheduled for later.
An AI code audit, ongoing code review and a penetration test serve different purposes. The comparison helps identify the suitable starting point.
Read the comparisonService scope
Human code review with product and operations context
The review allowance is defined around the repository, stack, change rate and risk profile. Automated scanners may be included, while assessment and prioritisation are performed by WZ-IT.
Clear service boundary
Review does not automatically include implementation or operations
- Defect remediation, feature development or refactoring without an added Software Care or development scope
- Unlimited pull requests, repositories or change volumes outside the agreed review allowance
- Deployment, hosting, backups, monitoring or incident response without a separate operating scope
- A full penetration test, legal advice, certification or a guarantee of defect-free software
- Broader product leadership, team management or vendor control without a separate mandate
Collaboration
From a confirmed baseline to a recurring review cadence
The retainer starts after a Production Readiness Audit or an equivalently documented technical baseline. Access, review allowance, cadence and deliverable format then remain transparent and consistent.
- 01
Confirm the baseline
Align repository, architecture, risks and the open backlog with an existing audit or technical onboarding.
- 02
Define the review allowance
Agree the repository, relevant areas, change rate, release windows, communication channel and response target.
- 03
Review changes regularly
Assess risk-relevant changes and advisories on a monthly or continuous cadence.
- 04
Clarify priorities and follow-up actions
Document findings, answer questions and prepare remediation by your team or under a separately agreed WZ-IT scope.
What we need for the initial assessment
- Repository, technology stack and approximate application size
- AI tools and participating engineers or service providers
- Product stage, user groups and processed data
- Current branch, pull-request, test and release process
- Requested review cadence and particularly critical areas
Retainer models
Reserved review capacity instead of unclear one-off requests
Both models cover one clearly scoped repository and an agreed change volume. Multiple repositories, unusually high change rates or intensive launch phases are assessed separately.
Starting point
Monthly Review Retainer
For early products and internal applications with predictable changes and one monthly technical control point.
from €990 / monthexcluding VAT, monthly
- One clearly scoped repository
- One monthly review window within the agreed change allowance
- Dependency, CVE and EOL assessment
- Prioritised findings and next actions
- Up to 90 minutes of technical clarification per month
- Response target for questions: next business day during business hours
Continuous Review Retainer
For actively developed applications with regular releases, real users or more sensitive data paths.
from €1,950 / monthexcluding VAT, monthly
- One clearly scoped repository
- Weekly review cadence within the agreed change allowance
- Deeper review of auth, data access, APIs and critical changes
- Assessment of critical CVE and dependency advisories
- Release-risk assessment for agreed release windows
- Up to 3 hours of technical clarification per month
- Response target for questions: same business day during business hours
The retainer is initially agreed for a minimum of three months. Review and clarification capacity is reserved for the respective month and is not a freely transferable development budget. Scope, access, change allowance and response targets are confirmed in the proposal before work starts.
All prices are net and exclude statutory VAT. The offers are addressed to businesses.
Suitable next steps
Combine baseline, review, implementation and operations separately
The review retainer remains separate from implementation and infrastructure. This makes it clear whether WZ-IT is reviewing, implementing changes or operating the production environment.
Production Readiness Audit
Establish a one-time baseline for an unknown codebase, go-live risk and operational readiness before starting the retainer.
View the auditSoftware Care & Development
Have WZ-IT implement prioritised findings, updates, corrections and small features.
View Software CareManaged Operations
Add infrastructure, monitoring, backups and incident response as a separate operating scope.
View operating servicesFrequently asked questions about the AI Code Review Retainer
Baseline, review cadence, implementation, access and service boundaries
- The retainer is a recurring technical review of one clearly scoped application. WZ-IT assesses agreed changes, security and dependency advisories and relevant architecture, data and operational risks, then documents prioritised next actions. Your team remains responsible for development unless implementation is added.
- The Production Readiness Audit is a one-time baseline before go-live, takeover or a larger investment. The review retainer builds on a confirmed baseline and accompanies ongoing changes monthly or weekly.
- Under the review retainer, WZ-IT reviews and prioritises while your team continues development. Under software maintenance, WZ-IT implements agreed updates, technical corrections and releases. Both services can be combined, but are then offered as one coordinated scope.
- Yes. The retainer is intended for teams that continue working with AI tools or their own engineers. It requires a traceable repository, an agreed review process and sufficient context about the application, data and deployment.
- No. The retainer includes review, prioritisation and technical clarification. Defect remediation, refactoring, tests, releases or feature development are agreed through Software Care, a development retainer or a separate project scope.
- Not necessarily. Dependency, secret, static-analysis and other tools can provide valuable signals. WZ-IT assesses those findings alongside the code, architecture, data paths and product context instead of merely forwarding an unfiltered scanner list.
- A time-limited and organisationally agreed read-only access to the relevant repository is generally sufficient, together with context about deployment, database, authentication and critical user journeys. Write or production access is not automatically required for review-only work.
- The response target describes when WZ-IT picks up technical questions during the agreed business hours. It is not a guaranteed resolution, an incident response time or a 24/7 service level. Critical production operations are agreed separately through Managed Operations.
- No. The service is a risk-oriented technical review, not a complete offensive security assessment. It provides neither certification nor a guarantee of defect-free software. A required penetration test is scoped separately.
Reviews & projects
Software projects with reliable outcomes
Proof for modernization, API extension, architecture, deployment and ongoing operations.
WZ-IT moved our studio infrastructure from decentralised individual devices to a central platform: every site is securely connected via VPN, new devices are onboarded automatically and an entire site is provisioned from a template, without manual steps on location. What impressed me most is the breadth and depth of their knowledge: Timo and Robin are not a typical IT provider who sets up a server and leaves. The two of them think their way into highly complex infrastructure and software topics, work through every requirement we put in front of them, and build networking, provisioning and operations so that everything fits together in the end. WZ-IT is an excellent partner for complex software, network and architecture projects.
Steve KirchnerManaging Director, nextGYM GmbH
International
Built in Germany's Ruhr Valley. Running worldwide.
WZ-IT designs, develops and operates infrastructure and software for clients in Germany and internationally. We deliver projects remotely and continue supporting them in ongoing operations after go-live.
Selected projects
- LiveRemote access platform for distributed water treatment plantsABCO Water Systems · Australia · Secure Access & OT
- 81%AWS migration with substantially lower operating costsEVA Real Estate · UAE · Cloud exit & infrastructure
- 98%Provision new sites in minutes instead of hoursnextGYM GmbH · Germany · Automation & IoT
Read client reviews
- Modernize your legacy software
- Ship your prototype to production
- Design an open-source AI architecture
- Plan a sovereign open-source stack
- Secure your Proxmox & backup setup
- Modernize your infrastructure - sovereign
- Integrate a local AI solution
- Cut cloud cost - up to −81%
- Build a high-availability Proxmox cluster
- Virtualize with Managed Proxmox
- Get collaboration fully managed
- Connect sites and clusters securely
Request a retainer
Which application should be reviewed on an ongoing basis?
Describe the application, repository, change rate and particularly critical areas. We assess the appropriate review cadence and whether a sufficient baseline already exists.
