Taking over a live compliance platform, and making it safe to improve.
KlarOK is the system Swedish car workshops use to document their way to Godkänd Bilverkstad certification: policies, self-inspections, reminders and reports, done in days rather than weeks and without a consultant. The platform was built by other teams from 2019 and had changed hands before. In 2026 KlarOK asked us to take it over: find out why it had become slow, fix what was broken, and keep building. It is live and in use every day, so we improve it while it runs.
Visit www.klarok.se
- Industry
- Workshop compliance, Sweden
- Engagement
- Takeover, audit, phased improvement
- Inherited
- Laravel 5.7 platform, 2019 build
- Status
- Ongoing engagement
A working product nobody could see inside.
The platform did its job for hundreds of workshops, but the people who built it were gone, pages had grown slow under real data, and every change carried the risk of breaking something nobody could safely test.
- Built by other teams from 2019 on a framework and PHP version that had since reached end of life. The database schema, 210 tables, existed only on the production server: the repository held a single migration.
- The busiest page ran 870 database queries on every load and sent 4 MB to the browser; the dashboard ran 615. Across the whole database there were thirteen secondary indexes and no foreign keys, so most of those queries scanned entire tables.
- A head-office manager opening one progress page could set off roughly sixteen thousand queries, because completion is counted form by form across about 160 separate tables, pulling every row into memory to count it.
- The server handled five page requests at a time, so a few slow pages made everyone wait, and the application log recorded hundreds of errors a day, nearly all from one function.
- Deleted users were only marked as deleted, so usernames stayed occupied and single sign-on accounts were being renamed with random numbers. Rights could say what a user may do, but not what they may see.
- There was no local development environment and no test suite, and production had drifted from version control. Nobody could change anything with confidence.
Make it reproducible, measure it, then improve it while it runs.
We put the system on a laptop with a copy of the production database first, measured every slow page down to the query, and turned the findings into four fixed-price phases the client can approve, reorder or postpone one at a time.
A reproducible copy of production
A containerised environment matching production's PHP and MySQL versions, importing a production dump on first boot, with a mail catcher and the exposed database tools blocked. Every finding since has been measured on real data, on a laptop.
An audit with numbers
Queries per page, bytes sent, error sources, server limits and schema gaps, each traced to specific lines and written up alongside the production reference, the cron schedule and the traps a newcomer would fall into.
A plan in four fixed-price phases
Stabilise, deliver the three changes users had been waiting for, rebuild the slow pages, then add view profiles. Each phase has its own acceptance test and stands on its own.
Stabilise first
Server concurrency, indexes on the tables behind the activity log and the user-company links, the error that floods the log, cached configuration, and administrative tooling removed from the public web folder: small, low-risk changes with an immediate effect.
Faster pages without a rewrite
One query per kind of information instead of one per form, form-structure checks cached, server-side paging and search for the large lists, and daily figures computed once per company. The acceptance test: the busiest pages under two seconds with fewer than fifty queries.
The changes users asked for
Super admins who can create super admins, permanent user deletion that frees the username while every form stays attributed to a deleted user, proper management of single sign-on accounts, and view profiles that decide what each user can see, enforced everywhere a form can be reached.
Understood, reproducible, and improving in the open.
- The platform is reproducible and understood: a local environment with production data and a written audit replaced guesswork, before a line of product code was changed.
- The client has a costed, phased plan with acceptance criteria instead of an open-ended retainer, and approves phases one at a time after a demo on the test environment.
- Nothing is being rewritten and no user has to relearn anything: the product workshops already know is being made faster and safer underneath them.
- The larger risks, an end-of-life platform, further hardening and incomplete translations, are written down and quoted separately, so the roadmap is honest.
Fixed phases, no surprises.
Taking over someone else's software is a trust exercise. We priced each phase as a fixed figure with its own acceptance test, kept the client's existing stack rather than pitching a rewrite, and put a test environment with real data in front of them before every release.
- Technical audit
- Performance engineering
- PHP & Laravel
- Security hardening
- Feature development
- Ongoing support