Work
Case studies
Three projects we delivered: a membership platform, a recruitment platform and a security rescue. The clients’ names are withheld. The work and the numbers are real.
Healthcare NGO · Client journey and membership platform
From one intake a year to four times the members
An international association of academic clinicians admitted members once a year and took six months to decide. We designed a new client journey and, in three months, built it: automated admissions, open all year. Membership grew more than four times, and revenue more than five times.
- 4×the members: from about 1,000 to over 4,000
- 5×the revenue of manual collection
- 80%lower development cost than the previous agency’s quote
- 50%lower hosting cost
The challenge
- Applications opened once a year, came in by email and took six months of manual review.
- Dues (€30 to €60 a year, with plans of up to five years) could only be paid by international bank transfer, and staff spent hundreds of hours matching statements to applications.
- Over 800 records had invalid emails, garbled non-English names or broken postal addresses, and returned or lost copies of the printed journal cost thousands of euros.
- The previous agency charged high rates for basic updates and called a Fellows programme and national society accounts ‘technically impossible’.
What we did
- Designed the member journey. We designed and proposed a client journey architecture: the path each clinician takes through the association. Everything else follows it.
- Moved and repaired the data. Hundreds of pages and thousands of files went to a new cloud server with zero downtime, fixing the 800+ damaged records on the way.
- Opened admissions all year. Standard applicants are approved automatically within minutes of paying; unusual cases get a one-click review.
- Took payment by card. Card checkout for every tier and multi-year plan, with renewals and decisions sent through Amazon SES so they land in inboxes, not spam.
- Built the ‘impossible’ parts. A Fellows track (+€50 a year), national society accounts (€160+ a year) that manage their own member seats, and paid course certificates.
What changed
- Membership grew from about 1,000 to over 4,000 clinicians, and revenue more than five times, from card renewals, five-year memberships, society packages, Fellowships and certificates.
- The build cost about a fifth of the previous agency’s quote, and hosting on our Evolutionary Managed Hosting costs half as much.
- The journey keeps improving: we watch how members use the platform and refine it from what they do, alongside monthly features, security audits and performance work, with no project fees.
- Staff who spent months on applications and payment reconciliations now work on the association’s programmes, research and members.
Legacy Live did the impossible. They took an impossible admin situation that was eating up months of our year and turned it into something simple, easy, and genuinely enjoyable for both our team and our global members.
Recruitment · Platform rebuild and data migration
From zero online applications to a pipeline that fills itself
A specialised placement agency with over 50,000 candidate profiles was stuck on a failing Firebase system: candidates could not sign in, and recruiters could not find people already in it. In nine months we cleaned and moved the data and rebuilt the platform. Candidates are now processed four times faster, at 80% lower service cost.
- 4×faster to add and verify a candidate
- 80%lower service costs
- 10–15×faster page loads
- 1.6%of new daily online applications become billed placements
The challenge
- Candidates could not register, reset a password or log in, so self-applications fell to zero and consultants typed in every detail by hand.
- Locations were not standardised. A search for Bloemfontein missed candidates who had written Free State, a simple typo hid a profile completely, and the agency could not expand into new countries.
- Nothing stopped duplicate ID numbers or emails, so records merged or disappeared.
- The previous vendor charged heavily for minor changes and said moving the database was ‘impossible’.
What we did
- Wrote our own scripts to extract the irregular Firebase data, moved hundreds of thousands of records into a normalised MySQL database, and cleaned more than 45,000 corrupted candidate records. Duplicate ID numbers and primary emails are now refused.
- Added Mapbox, so every location is standardised and geocoded: a search for Bloemfontein also finds Free State and South Africa matches, and typos resolve themselves. South African ID numbers are validated, and gender and date of birth are read from them.
- Rebuilt the platform on Next.js and Directus, with role-based access for consultants and self-service sign-up for candidates, including with their social accounts.
- Built AI CV import, which reads an unstructured CV straight into the right fields. At relaunch we sent sign-up links to the 50,000+ cleaned contacts within 24 hours, and 99% were delivered.
- Launched in nine months: two to rebuild the platform and seven to clean the data. In the two months after launch, we added the advanced features the agency had been told were not possible.
What changed
- With validation up front and AI reading the CVs, recruiters add and verify candidates four times faster.
- Online applications came back, and 1.6% of the new daily inflow turns into billed placements: revenue that arrives without anyone chasing it.
- Service costs fell 80% once the change-request fees stopped. On our Evolutionary Managed Hosting, new features keep arriving without that billing.
- The move came in time: the old system’s corruption was compounding, and the agency was at risk of losing the integrity of all its applicant data.
Healthcare NGO · Security rescue and hardening
From 20 waves of attacks to years without a breach
Minutes after an international academic healthcare NGO moved its membership portal to us, our monitoring flagged active attacks. The site had been breached repeatedly without anyone knowing. We contained it with no member data leaked, cleaned and hardened it, and it has stayed clean for years.
- 1,600+malicious files removed
- 0bytes of member data leaked or corrupted
- 4×faster page loads
- 0compromises since relaunch, over several years
The challenge
- The portal held clinicians’ government IDs, medical licences, board certifications and payment records. A leak would have breached GDPR and exposed members to identity theft.
- It ran on end-of-life PHP with unpatched vulnerabilities, a faulty SSL certificate set-up, and a flaw that let guests see member-only content. Abandoned and redundant plugins made it slow everywhere.
- We found evidence of at least 20 separate attack waves, which strongly suggests the first breach was months or years old and that access to the site had been traded on the dark web.
What we did
- Contained it first. We cut off the real database, gave the infected copy a decoy database of fake records on a private domain, and put the public site on a clean maintenance page. For seven days we watched where the malware called home.
- Cleaned it. With an external forensic specialist, we removed more than 1,600 malicious files, hidden admin accounts and database hooks built to re-infect the site. Our lead developer checked the critical code by hand, because scanners miss layered, disguised code.
- Fixed what let them in. The latest PHP, TLS 1.3 with HSTS, the membership leak closed, abandoned plugins removed.
- Hardened and tested it. Protection at every layer, from the network edge to the database, then OWASP Top 10 penetration testing before relaunch.
- Throughout, we guided the NGO’s non-technical leadership, including how to communicate with users.
What changed
- Back in production with no user-facing downtime. Since then: zero compromises, zero malware and zero unscheduled downtime, over years of international traffic.
- Pages load four times faster, with 75% less waiting.
- Not one byte of member data was corrupted or leaked, and the work brought the portal into line with GDPR Article 32’s requirements for data security and integrity.
The technical detail: what we found
- Webshells (c99, r57, b374k, WSO) giving remote control of files, the database and the server.
- One-line backdoors hidden in core WordPress files, disguised to slip past simple scanners.
- Hidden super-administrator accounts and bypasses of the permission checks.
- Must-use plugin hooks tied to malicious serialised data in the database, which put deleted files back.
- Botnet agents and spam mailers that put the NGO’s domain on international email blacklists.
- Search spam and redirects that sent mobile and search visitors to illicit ad networks while logged-in users saw normal pages.
- Exploits of arbitrary file uploads in outdated form plugins, remote code execution, SQL injection and file inclusion.
- Counterfeit plugins, and genuine ones altered to carry backdoors.
The technical detail: how it is protected now
- Edge: Cloudflare Enterprise firewall rules, DDoS mitigation, bot management and IP and country filtering.
- Server: a hardened container, every non-standard port closed, administration only from private, key-authenticated addresses, and Imunify360 scanning in real time.
- Application: no PHP can run in the uploads folder, XML-RPC and user enumeration are off, file permissions are locked (644 and 755), and the web server cannot write to WordPress’s own code.
- Identity: every password, salt, security key and SFTP/SSH key replaced, and two-factor sign-in.
- Database: least privilege, remote access restricted, and the right to write files revoked.
- Monitoring: our own integrity checks, file hashing and real-time log audits.
The technical detail: how we tested it
A grey-box penetration test against the OWASP Top 10, on the cleaned and hardened copy, before it went live:
- SQL injection and cross-site scripting on every member form, search field and query: nothing got through.
- Access control as a guest and as a logged-in member: member directories, uploads and records stayed out of reach of anyone not allowed to see them.
- Upload bypasses with polyglot files and disguised extensions (.php5, .phtml): nothing ran.
- Scans for exposed .git folders, configuration backups, debug logs and environment files: all blocked at the edge.
The pattern
What all three have in common
Different organisations, different problems, the same four steps. That is what makes the results repeatable.
Find what is really wrong
Each client could feel the problem but not see all of it: a six-month backlog, corrupted data, attackers nobody had noticed.
Move it without losing anything
Tens of thousands of records repaired and validated on the way to a new platform, and not one byte of member data leaked.
Build what was called impossible
Two of the three had been told by their previous providers that what they needed could not be done. We built it.
Keep improving it
After launch we keep looking after it: new features, security work and performance improvements each month, without surprise project fees.
Next step
Tell us what you are trying to do
Get a ballpark for your project, or book a consultation and talk it through.
Or send a WhatsApp message to +27 71 426 7016.