Legacy .NET modernization for regulated SaaS
Getting off .NET Framework or IdentityServer4 is a security decision. In a regulated business, it also has to be an auditable one.
What you get
- ✓ A written Readiness Assessment — solution inventory, blocker analysis, parity-test strategy and a sprint-level plan — that you can hand to your risk or audit team, and execute with us or any team. From $4,800, one 2-week sprint.
- ✓ Parity tests on behavior-critical paths, so reports, totals and audit outputs stay identical across the migration.
- ✓ AI does the mechanical work under guardrails: every change is build- and test-gated, and every agent action is logged.
- ✓ A deployment and rollback plan before any cutover — for the application and for the auth server.
- ✓ Off end-of-support software: IdentityServer4 has had no security patches since December 2022, and .NET 8 and 9 leave support on November 10, 2026.
Regulated teams don’t get to treat a migration as a refactor. An unpatched auth server or an end-of-support runtime is a finding in its own right, and the migration that fixes it has to be explainable afterward: what changed, how it was verified, and how you would have rolled back.
That is how we run migrations anyway. We sequence the work so the business never loses a working application — strangler-fig for WebForms, multi-targeting for class libraries — and we verify behavior with parity tests instead of trusting that the code compiles. EF6 to EF Core moves query by query, because query translation, lazy loading and transaction semantics all change between the two.
The change trail is not an afterthought. Our public IdentityServer4 → Duende migration is an example of the record we keep: an append-only, timestamped log of every failure and fix, from the first broken build to the final passing test run.
We have worked with enterprise clients in assurance and inspection, corporate governance research, legal information, and regulated gambling, across Europe and the US.
Where to go deeper
- Legacy .NET modernization — the Readiness Assessment, what it covers, and what it costs
- IdentityServer consulting and migration — the fixed-scope IdentityServer4 → Duende package
- WebForms and .NET Framework migration checklist — the inventory we start from
- AI coding guardrails for regulated industries — how the guardrail layer produces evidence