The day the phone was disconnected, the domain had 11 days left
A 45-person machine parts manufacturer spent NT$680,000 three years ago on a custom quoting and order tracking system, then paid NT$18,000 a month for maintenance. In June the vendor PM stopped replying. In July the retainer was still charged but tickets went untouched. In August the phone number was dead. Only then did the owner discover three things: the domain was registered under the vendor, the source code lived in the vendor's GitHub organization, and the database sat in the vendor's cloud account. The system was still running, and nobody could change a single line. The domain expired in 11 days.
Four myths that leave you exposed
- Myth 1: the contract says IP belongs to the client, so I am safe. Ownership is not control. You may legally own the code and still have no Git credentials, no cloud console, no domain admin. By the time a judgment lands, the domain may already belong to someone else.
- Myth 2: a registered company cannot just vanish. A limited company's exposure caps at its paid-in capital, and a studio capitalized at NT$1,000,000 cannot cover the cost of your system going down. Checking registration status on Taiwan's official company registry search takes two minutes, and most buyers have never done it once.
- Myth 3: I pay every month, they will not ignore me. When cash flow breaks, a studio protects its two or three highest-paying retainers and stalls everyone else. Response time drifting from four hours to three days is the clearest early warning you will get.
- Myth 4: it is still running, so it is not urgent. SSL certificates typically renew on a 90-day cycle, domains annually, and cloud hosting on a card that will eventually fail. After a vendor goes dark, the first thing to break is usually not the code but an expiry date.
The core framework: a Single Point of Failure (SPOF) Score
Run it once before signing and every six months after. Score four dimensions from 1 to 5, where 1 means entirely on your side and 5 means entirely with the vendor:
- Asset concentration × 3: how many of domain, DNS, code repository, cloud and database accounts are not in your name.
- Knowledge concentration × 3: how many people actually understand this system. One person scores 5.
- Vendor fragility × 2: headcount, years trading, and what share of their revenue you represent.
- Replacement difficulty × 2: obscure frameworks, zero documentation and forked third-party packages all push this up.
The total runs 10 to 50. 10–20 is acceptable. 21–32 means fix account ownership and documentation within three months. Above 33 you are not outsourcing, you are storing your company's lifeline in someone else's house.
When a vendor actually goes dark, the first fork is a single question: do you control the domain and DNS? If yes, take the rebuild path. If no, recovering the domain outranks everything else — the ICANN Expired Registration Recovery Policy typically allows a redemption window of roughly 30 days after expiry, after which the name goes to public release.
Three companies, three conclusions
| Company | System | SPOF score | Sharpest pain | First move |
|---|---|---|---|---|
| 12-person design services firm | WordPress site plus LINE OA | 18 (low) | Domain and company email die together | Transfer the domain into your own registrar account, two days |
| 60-person B2B manufacturer | Custom quoting system plus ERP integration | 34 (high) | Nobody else knows the ERP integration spec | Document the integration first, and cultivate a backup vendor |
| 200-person retailer | Own e-commerce plus mobile app | 29 (medium) | Payment and app store accounts sit under the vendor | Move Apple and Google developer accounts to the company entity |
What you rescue first depends on what is not in your hands, not on what cost the most.
The hidden cost list
| Item | NT$ range | Note |
|---|---|---|
| Emergency technical audit and risk assessment | 40,000–120,000 | 2–5 working days |
| Reverse-engineering an undocumented system | 25–40% of original build cost | Roughly 170,000–270,000 on a 680,000 project |
| Domain redemption after expiry | 2,500–6,000 | Once publicly released, aftermarket buy-back commonly starts at 30,000 |
| Data reconstruction with no backup | 80,000–300,000 | Some data is simply unrecoverable |
| Re-applying for payment, SMS and map APIs | 0–15,000 | 3–15 working days with the feature down |
| Legal consultation and formal notice | 5,000–20,000 | Per instance |
| Revenue opportunity cost while frozen | Industry dependent | Two weeks of a dead B2B quoting system roughly equals a month of new orders |
Figures are 2026 Taiwan market estimates and move with system complexity. The expensive part is never rewriting code — it is that nobody knows why it was written that way.
Vendor viability scorecard: 12 dimensions
Score each 0 (absent), 1 (partial) or 2 (fully met). Maximum 24.
| # | Dimension | What a 2 looks like |
|---|---|---|
| 1 | Company registration status | Searchable, active, not dissolved or suspended |
| 2 | Years trading | Three years or more |
| 3 | People who understand your system | Two or more |
| 4 | Your share of their revenue | Below 30% |
| 5 | Code hosting ownership | In your company's Git organization |
| 6 | Domain and DNS | Your registrar account, your payment method |
| 7 | Cloud and database accounts | Registered to your company |
| 8 | Third-party service billing | On your company card |
| 9 | Deployment documentation | Runbook plus environment variable list |
| 10 | Response time trend | No deterioration over the last three months |
| 11 | Contract exit clause | Exit procedure and handover deliverables specified |
| 12 | Backups and escrow | Verifiable monthly off-site backup |
20–24 is safe. 13–19 has gaps: schedule them this quarter. 12 or below is high risk, and fixing account ownership matters more than shipping new features.
How ScriptWalker engages, and what we decline
- Advisory (NT$15,000–30,000 per engagement): SPOF assessment and account ownership audit only, no development. For when the incumbent vendor is still around and you want insurance.
- Project (emergency takeover, NT$80,000–250,000): 72-hour triage plus 30 days to make the system maintainable, with handover documentation a third party can read.
- Retainer (NT$20,000–60,000 per month): ongoing operations after takeover, including monthly off-site backup verification and quarterly continuity reporting.
- Full outsourcing: a complete rebuild when the existing system is not worth rescuing.
Honestly, we are the wrong fit in these cases:
- You only want a domain recovered and have no intention of dealing with the system. That is registrar dispute and legal work.
- The stack is a bespoke PHP 5 framework or a Delphi desktop application. Rebuilding beats taking over, and we do not run that line.
- Budget below NT$80,000 with a demand for full takeover in two weeks. That combination only produces half a job.
- Litigation is underway and you need a forensic expert report. We do not provide expert testimony.
One more truth that does not flatter agencies: in month one of any takeover, every quote you receive is an estimate. A vendor who charges a small audit fee first and quotes properly afterwards is more trustworthy than one who promises a fixed price on sight.
The 90-day takeover playbook
- Hours 0–72 (preserve): back up the database, source code and uploaded files to your own cloud; check the domain expiry date and registrar and transfer the same day if you can; confirm hosting and domain will not lapse before you stop any payments (never reverse that order); move all contact to email plus formal written notice.
- Days 4–14 (take back control): change the account entity on cloud, Git, payments and the app stores; rotate every API key and admin password; check registration status and decide between negotiation and legal action.
- Days 15–45 (make it maintainable): rebuild development and staging environments, document the deployment process, add monitoring and off-site backups, then ship one small change to prove the system can be modified.
- Days 46–90 (institutionalize): recalculate the SPOF score with a target below 20; write exit clauses and account ownership into the new contract; schedule quarterly continuity reviews.
Decision checklist: 12 questions
- ☐ The domain is registered to my company and I can log into the registrar
- ☐ DNS management is on our side
- ☐ I hold a complete copy of the production source code
- ☐ The database has a verified monthly off-site backup
- ☐ The root cloud account belongs to my company
- ☐ Payment and SMS merchant accounts are under my company
- ☐ App Store and Google Play developer accounts are my company's
- ☐ Third-party services bill my company card
- ☐ I have a deployment runbook and an environment variable list
- ☐ At least two people at the vendor know this system
- ☐ The contract specifies an exit procedure and handover deliverables
- ☐ Average response time has not slowed over three months
Every box you cannot tick is something you will pay to buy back the day the vendor goes dark.
FAQ
My vendor has not vanished, just slowed down. Should I switch now?
Do not switch yet. Close the gaps first. Switching vendors costs from NT$80,000 and one to two months, while reclaiming four things this month — domain, Git, cloud and payment account ownership — costs close to nothing. Once that is done, the decision about switching gets much cheaper.
The domain is in their name. Can I still get it back?
It depends when you notice. Before expiry you can demand a transfer authorization code or open a dispute with the registrar. After expiry there is a redemption window of roughly 30 days, typically costing NT$2,500–6,000. Once the name reaches public release it becomes an open auction, with aftermarket buy-back commonly starting at NT$30,000 and no guarantee. So the first move after a vendor goes dark is always to check the expiry date, not to keep calling.
Can anyone take over a completely undocumented system, and what does it cost?
Usually yes, but you pay to get acquainted first. On 2026 Taiwan market estimates, a takeover audit for a small or mid-sized system runs about NT$40,000–120,000 over two to five working days, and only then can anyone quote maintenance properly. Also check whether the stack is still supported: the Laravel support policy sets explicit security-fix windows per major version, and a system past that window needs an upgrade budget on top.
The contract assigns IP to the client. Can I just sue for the source code?
You can make the claim, but do the time arithmetic. Litigation runs in years; domains and certificates run in days. The practical order is always technical preservation and account recovery first, legal route second. Assets already in your hands need no lawsuit — a lawsuit is only for the part you genuinely cannot reach.
Spend 30 minutes and get your SPOF score
We offer a free 30-minute consultation to walk the 12-dimension scorecard with you and identify which gaps are cheapest to close now. Even if you have no intention of changing vendors, this number deserves a refresh every six months.
- Email: [email protected]
- Phone: 0916-224-047
- LINE: @ufv9089p