Application maintenance (TMA) for Drupal, Next.js and business applications
Corrective maintenance, enhancements and security updates under SLA, run from Casablanca for European companies.
Application maintenance, called TMA in France, means handing the upkeep of a live application to an outside team: fixing defects, shipping enhancements, applying security updates and keeping it compatible with its environment, all under measured service levels.
You may know it as application maintenance and support (AMS). VOID provides it for Drupal, Next.js and business applications from Casablanca: nearshore for European companies, and for banks, insurers and institutions in Morocco.
Since 2020
Corrective maintenance and enhancements for Crédit Agricole du Maroc's corporate portal.
About 5 minutes
to produce a maintenance report, instead of 2 to 4 hours. A person approves every report before it is sent.
Updated
What our application maintenance covers
A maintenance contract covers five kinds of work, written into the contract application by application.
Corrective maintenance
We fix incidents and defects in production. Each request's severity level sets its deadline. Urgent fixes ship as hotfixes; the rest follow the normal release cycle.
Enhancements
What moves the application forward: new features, interface improvements, business changes, in batches or as requests come in, with an estimate, your approval and your acceptance testing.
Preventive maintenance
Security updates, framework and dependency upgrades, technical debt reduction. This is what prevents next quarter's incidents.
Adaptive maintenance
Browsers, PHP and Node.js versions, third-party APIs and data protection rules (GDPR in Europe, Law 09-08 in Morocco) keep changing. We keep the application in step with them.
Monitoring and support
Availability and performance monitoring, alerts, a single point of contact and request tracking in a ticketing tool.
| Term | What it covers | At VOID |
|---|---|---|
| TMA / AMS | The software itself: corrective, preventive and adaptive work, plus enhancements. | This offer. |
| TME | Enhancements only: new features and improvements. | Included in the contract, or signed separately. |
| MCO / MCS | Keeping the environment operational and secure: servers, middleware, backups, OS patches. | Handled by the hosting provider. On AWS, by our managed services. |
| Managed hosting | Running the infrastructure: hosting, network, system monitoring. | Our AWS managed services. |
Infrastructure has its own service levels: our AWS managed services (page in French) publish a 4-business-hour response (Standard), or 1 hour with 99.9% availability and penalties (Premium).
Service levels by severity
Every request is ranked by impact, and each severity level comes with three target times: response (an engineer is on it), workaround (service restored, even partly) and final resolution.
| Level | Example |
|---|---|
| P1 · Blocking | Transactional site or customer area down. |
| P2 · Major | Important feature degraded, no easy workaround. |
| P3 · Minor | Annoying defect with a workaround. |
| P4 · Request | Minor request, question, small change. |
Service hours
Our Casablanca office is open Monday to Friday, 9 am to 6 pm local time. Coverage is agreed contract by contract.
Measurement and reporting
Each maintenance cycle ends with a report: components updated, security flaws fixed, performance, critical user journeys re-tested. An administrator approves it before it goes out.
Contract models
The right model depends on how many requests you have and how steady they are. Many contracts combine a monthly core and a budget for enhancements.
Fixed monthly retainer
A fixed fee covers operations, corrective work, security updates and reporting. Your run costs are known in advance.
Work units or tickets
Each enhancement is estimated in an agreed unit, approved by you, then delivered and accepted. You pay for what you order.
Dedicated capacity
A team reserved for your application, with a fixed number of days per month. It is close to an agile squad or a dedicated nearshore team.
Term, scope and notice
Our terms and conditions provide for a maintenance subscription paid monthly or yearly, and monthly time-and-materials billing.
What drives the price
Number of applications, stack and technical debt, service level and volume of enhancements.
Drupal maintenance
Drupal powers 22 of our 24 published projects. We also maintain 6 modules on Drupal.org, where VOID has 19 contribution credits.
Drupal 10 reaches end of life on 9 December 2026, the week Drupal 12 is released (official Drupal release schedule). After that date, a site still on Drupal 10 no longer gets security fixes.
Security and upgrades
We follow the Drupal security advisories, apply core and contributed module fixes, and plan upgrades, starting with Drupal 10 to Drupal 11.
Taking over an existing Drupal site
Before we commit, we audit the code, modules, configuration and technical debt: what can stay, what must be fixed, what the upgrade will cost. See our Drupal expertise.
Testing every update before production
Our Drupal testing platform spins up test environments (DDEV, Docker) and runs SonarQube code analysis and Playwright tests before release.
Long-standing Drupal clients: Crédit Agricole du Maroc (corrective maintenance and enhancements since 2020), Al Barid Bank (since 2020, Drupal and Red Hat) and Diriddik (since 2021, Drupal 10 on OpenShift).
Next.js and React maintenance
A Next.js front end ages fast: npm dependencies, React and Next.js releases, new vulnerabilities every week. Maintenance keeps it current without breaking your user journeys.
Dependencies and CVEs
We watch vulnerabilities published on your dependencies, update in batches and re-run regression tests before each release.
Headless Drupal and Next.js
Drupal serves the content, Next.js renders it. Dar Al Moukawil, a client since 2016, runs on headless Drupal and Next.js on OpenShift. Wafa Assurance, a client since 2019, now runs its portal on headless Drupal 10 and Next.js. We also built Vactory, a headless Drupal and Next.js starter.
Node.js APIs
We also maintain the Node.js APIs behind these front ends.
More on our React and Next.js expertise.
Business applications
Customer portals, subscription journeys, back offices, transactional platforms: applications that run a business process and connect to your information system.
For Wafasalaf, a client since 2018, we rebuilt the transactional platform mobile-first and keep tuning its performance.
Taking over an existing application
Switching vendors is worrying for one reason: knowledge of the application leaves with the outgoing team. So the takeover runs in four steps, each with a deliverable.
Audit
Review of the code, architecture, dependencies and technical debt.
Deliverable: Audit report and risk map.
Knowledge transfer
Collecting documentation, handover with the outgoing team when possible, opening access and environments.
Deliverable: Operations runbook and access inventory.
Stabilisation
Priority fixes, overdue security updates, monitoring in place.
Deliverable: Fixes delivered and upgrade plan.
Steady-state run
Maintenance under SLA, regular steering and a shared roadmap.
Deliverable: First maintenance report.
When there is no handover and no documentation
If the previous vendor no longer answers, we start from the code and production: we read the repository, list access and secrets, compare the code with what runs and write the documentation. Stabilisation takes longer, and the audit says so upfront.
AI-assisted maintenance, human-approved
We use AI where it saves time without making decisions for you. Two uses are documented.
The maintenance reporting agent
On our Drupal and Next.js projects, an agent collects versions, security flaws (CVEs), certificates, performance scores and Playwright test results, then drafts the report. The language model produces no figures: it turns facts collected by code into sentences. About 5 minutes per report instead of 2 to 4 hours, and nothing goes out without an administrator's approval. Read the case study on the reporting agent (page in French).
Fixes prepared by agents
We piloted an agent that detects a vulnerability, prepares the fix, runs the tests and opens a merge request. The pilot covered 100 internal VOID projects and open-source code, never client code. The rules: a dedicated branch, never an automatic merge, a mandatory human review. Details in our article on harness engineering.
What AI does not do: it never decides on a release and never deploys anything by itself.
Nearshore from Casablanca for European teams
Our team is based in Casablanca, and steering committees run by video call.
Time difference
Since 20 September 2026, Morocco has been on GMT (Decree No. 2.26.530, Official Bulletin No. 7521, in Arabic). The EU (Directive 2000/84/EC) and the United Kingdom switch to summer time from the last Sunday in March to the last Sunday in October. Casablanca is therefore one hour behind Paris, Brussels or Berlin in winter and two in summer, and matches London in winter only.
Personal data and contract
Morocco is not on the European Commission's list of adequate countries. Any transfer of personal data from the EU to our team must therefore rely on the standard contractual clauses of Implementing Decision (EU) 2021/914. On the Moroccan side, personal data falls under Law No. 09-08 (in French), supervised by the CNDP: see our CNDP compliance guide.
Financial entities: what DORA asks of the contract
For an EU bank or insurer, DORA, which has applied since 17 January 2025, requires the maintenance contract to state where data is processed, describe service levels and, for a critical or important function, set an exit strategy with a transition period (Article 30 of Regulation (EU) 2022/2554).
For a dedicated team, a squad or a build-operate-transfer centre, see our nearshore and IT outsourcing offer.
Reversibility and security: what the contract should cover
Reversibility is the last phase of a maintenance contract, and often the most negotiated. It is prepared from the start. A reversibility plan covers at least:
- the return of the source code and its history;
- the transfer of access and secrets to your team, then their revocation on the provider's side;
- technical documentation and the operations runbook;
- a handover period with the team taking over.
Clients who trust us with their applications
Since 2020
Crédit Agricole du Maroc
Corrective maintenance and enhancements for the bank's corporate portal, on Drupal.
Since 2018
Elsan group
Drupal multi-site portal bringing together 140 healthcare facilities in France.
Since 2020
Al Barid Bank
Product and corporate portal on Drupal and Red Hat, with a DevOps approach.
Since 2016
Dar Al Moukawil
Platform for small businesses and entrepreneurs, on headless Drupal and Next.js running on OpenShift.
Application maintenance FAQ
- What is TMA (tierce maintenance applicative)?
- TMA is the French term for application maintenance: an outside team looks after a live application. It covers defect fixing, enhancements, security updates and adaptation to the technical environment, under measured service levels with regular reporting. English-speaking buyers often call it application maintenance and support (AMS).
- What is the difference between application maintenance and managed hosting?
- Application maintenance looks after the software: code, dependencies, features and defects. Managed hosting runs the infrastructure underneath: servers, network, backups and system monitoring. At VOID, the first covers your application, and our AWS managed services the infrastructure when it runs on AWS.
- What SLAs do you commit to?
- Each request gets a severity level, from P1 (service down) to P4 (minor request). For each level the contract sets a response time, a workaround time and a resolution time within a coverage window. The maintenance report measures them.
- How is pricing structured?
- Three models, often combined: a fixed monthly retainer, enhancements priced in work units or tickets, or dedicated capacity with a fixed number of days per month. The price depends on the number of applications, their stack and condition, the service level and the volume of changes.
- Can you take over an application built by another vendor?
- Yes, in four steps: audit of the code and architecture, knowledge transfer, stabilisation, then run under SLA. Each step ends with a deliverable, from the audit report to the first maintenance report. With no handover, we work from the code and production and write the missing documentation.
- How does reversibility work at the end of the contract?
- It is planned from day one. A reversibility plan usually covers the return of the source code and its history, access, documentation and runbook, then a handover period with the team taking over.
- How do you use AI in maintenance?
- An agent writes our Drupal and Next.js maintenance reports from facts collected by code, in about 5 minutes instead of 2 to 4 hours, and a person approves each one. We have also tested an agent that prepares security fixes on our internal projects and open-source code, never on client code, with no automatic merge.
- Why nearshore Morocco rather than offshore?
- Because your working days overlap. Since 20 September 2026 Morocco has been on GMT: one hour behind Paris, Brussels or Berlin in winter, two hours in summer, and on London time in winter. Meetings and incident calls happen during your working day.
Tell us what you run
Stack, number of applications, request volume, expected service level: send us the basics. We reply within 24 business hours to set up a first call.