Prototype to Production
From Prototype to Production, Built for the Real Product User
Production is different than a prototype: real user data, a security review to pass, named accountability, audits and the system cannot break. We close that gap. First we harden security, access and data handling. Then we make the system able to be run, monitored and recovered.
Production and not a Demo Anymore
Get the security, access and recovery a live deployment needs, engineered in rather than bolted on. One team owns the build and the evidence it is safe.
Engineered for MDR From the Start
We build to EU MDR and GDPR as the system takes shape. The compliance pack grows with the product rather than in a last-minute scramble.
Runs Without
the Builder
We make the system one any team can operate, monitor and recover. It stops depending on the person who built it.
How Prototype to Production Works at punktum
1. Planning the Security Concept
We document how the system protects data end to end: threat model, data classification, encryption and secrets management. A security reviewer can assess and approve.
2. Setting up the Access Concept
We define who can do what, with least-privilege roles, a permission matrix and logged access to sensitive data. Shared logins and orphaned accounts handle it.
3. Technical and
Organisational Measures
We document your GDPR: confidentiality, integrity, availability, data minimisation, retention and a DPIA if necessary. It is what a client's legal team asks for before signing.
4. Defining the
Operations Manual
We write the runbook: architecture, named owners, deployment and rollback, monitoring and incident response. Anyone on the team can run, support and hand the system over.
5. Putting the Recovery
Plan Into Place
We set the backup strategy, test the restore and define recovery time and point objectives, with a plan for provider outages. You get a tested way back, agreed before the outage.
Industries Where We Take Prototypes to Production
The same production discipline applies across sectors. These are the areas where we take working prototypes into operation.
1. Healthcare and Clinical Software
We take clinical and digital-health prototypes into production a hospital or clinic can run, with the compliance evidence to match.
3. Wearables and Connected Devices
We productionise firmware, companion apps and connectivity for body-worn and connected products, from the sensor to the cloud.
2. MedTech and Medical Devices
We take medical-device software and SaMD from prototype to a production build that meets its Rule 11 class and MDR pathway.
4. Sports, Fitness and Wellness
We take sports and wellness prototypes to production at consumer scale, with the reliability and data handling real users expect.
What We Deliver in Taking a Prototype to Production
Taking a prototype to production is more than shipping code. Depending on your product and its risk class, we deliver the following. See our capabilities in detail.
Security and
Access Hardening
We harden security and access: threat model, encryption, secrets management and role-based, logged access to sensitive data.
Compliance and Data Handling
We produce the TOM, DPIA and data-handling records your clients and regulators need before real data flows.
Operations and
Recovery
We deliver the runbook, monitoring, incident response and a tested recovery plan, so the system runs without the builder.
Clients We’ve Already Worked With
Solve Production Challenges
Prototypes stall on the way to production in predictable ways. We solved them already.
Security That
Lives in One Head
Undocumented security fails a review and stalls go-live for months. We write a security concept a reviewer can assess and approve.
Everyone Is
an Admin
No roles and no access logs are heavy production gaps. We define least-privilege access and log every touch of sensitive data.
Real Data
Breaks the Deal
Without a TOM a client legal team will not sign a data-processing agreement. We produce Article 32 evidence correctly for it.
Only the Builder
Can Run It
A system only one person can operate is a failure setup. We write the operations manual so any team can run and support it.
No Tested
Way Back
Backups that weren't restored fail at worst moments. We set and test recovery, with a known recovery time and last pass date.
Prototypes We Have Taken to Production
What Clients Think About our Prototype to Production
CaReHigh
Prof. Dr. med. Winfried März & Prof. Dr. Felix Fath
Stealth Wearable
Alexandra E., Founder
DiaperID
Prof. Dr. med. Philip BuflerWhy Punktum for Prototype to Production
Taking a prototype to production sits between engineering, operations and regulation. We bring all three together in-house, so your build and your evidence come from one partner.
Full-Stack Engineering
We field 120+ engineers across embedded, apps, cloud and AI, so the people who harden your system are the people who can build it. No handoff to a separate house.
MDR and Regulatory Expertise
Our regulatory team handles EU MDR and GDPR alongside the build. Your compliance pack is built to stand up in an audit.
Proven Delivery,
ISO 27001
We have taken products from prototype to production across health, MedTech and wearables. We are ISO 27001 certified, EU-hosted and CET-aligned.
Our Production-Readiness Capabilities in Detail
The three areas above rest on five core capabilities. Here is what each one covers on the way from prototype to production.
1. Security
Concept
We document how the system protects data across its whole lifecycle.
- That covers the threat model, data classification, encryption in transit and at rest and secrets management.
- For an AI system we also define the model boundaries against prompt injection and data exposure.
2. Access
Concept
We define every user type and system account with the least access it needs.
- A role-to-permission matrix, named admin access and logged access to sensitive data make it defensible.
- Less-experienced users are guided through the workflow without slowing the experts.
3. Technical and
Organisational Measures
We document your GDPR Article 32 measures across confidentiality, integrity and availability.
- Data minimisation, retention and deletion rules and a DPIA are set where processing is high risk.
- For health data we add heightened measures and protect record integrity for evidence.
4. Operations
Manual
We write the runbook that lets the system run without the builder.
- It names an owner for each critical component and documents deployment, rollback, monitoring and incident response.
- The result is a system a team can operate, support and hand over around the clock.
5. Recovery
Plan
We set the backup strategy and test the restore and not just the backup.
- Recovery time and recovery point objectives are defined, with steps for each likely failure scenario.
- That includes the case where a cloud or model provider is unavailable. For the build side, see our Development service.
Our Production-Readiness Technology Stack
Taking a prototype to production spans the whole system: security, access, data, operations and recovery. We build across every layer in-house. The stack below is a draft for tech-team validation.
Security and Secrets
- TLS in transit
- Encryption at rest
- Secrets management
- SAST and DAST
- Dependency scanning
- Threat modelling
Identity and Access
- SSO and OIDC
- MFA
- Role-based access
- Least privilege
- Access logging
- Audit trail
Reliability and Recovery
- Backups
- Restore testing
- RTO and RPO
- Failover
- Provider fallback
- Incident response
Observability and Ops
- Monitoring
- Logging
- Alerting
- Dashboards
- On-call
- Runbooks
Data and Compliance
- GDPR and TOM
- Data minimisation
- DPIA
Standards and Compliance
- EU MDR
- IEC 62304
- ISO 13485 / ISO 14971
- IEC 62366 (usability)
- ISO 27001 / GDPR
Your FAQs on Prototype to Production
Q1: What is taking a prototype to production?
A1: Taking a prototype to production means turning a working prototype or proof of concept into a system real users can depend on. That means hardening security, access and data handling, making it operable by a team and adding a tested recovery path. It comes with the documentation an auditor or client expects.
Q2: What is the difference between a prototype and production?
A2: A prototype proves an idea on test data, run by the person who built it. Production runs on real user data, passes a security review, has named accountability and cannot go dark. Passing the first does not make you ready for the second.
Q3: Which documents do you produce?
A3: Five carry most of the weight: a Security Concept, an Access Concept, Technical and Organisational Measures under GDPR Article 32, an Operations Manual and a Recovery Plan. Together they are what an IT-security team, a data-protection officer and a procurement lawyer expect before your system reaches a user. We tailor the depth to your product and its risk.
Q4: Do you work with AI-built prototypes?
A4: Yes. Much of this work starts from an AI-built or rapidly-prototyped codebase. We harden it for production and, for an AI system, define the model boundaries so prompt injection and data exposure are covered. The goal is a system that behaves safely once real users depend on it.
Q5: Can you take a prototype you did not build into production?
A5: Yes. We start with a review of the code, the architecture and the risks, then build the security, access, compliance and operations layer needed to go live. Where the regulatory picture is unclear, an MDR Assessment maps what is missing. We then close the gaps to reach production.
Q6: How does EU MDR fit in?
A6: If your software is a medical device, production readiness and MDR run together. We build to IEC 62304 and ISO 14971 and produce the evidence a notified body expects. Going live and staying compliant become the same track rather than two projects.
Q7: Do you run the system after launch?
A7: We can. Beyond handover we offer managed operations: monitoring, incident response and recovery, so the system stays reliable once real workflows depend on it. You keep the ownership and we keep it running.
