Go-live checklist for client apps

One page to run through before an app goes to production. Works for AWS, GCP, DigitalOcean, Hetzner and similar.

Access

• No shared root or admin accounts. Every person has their own login with MFA.
• Secrets (API keys, database passwords) live in a secret manager or CI variables, not in the repository.
• The client has their own admin access to the cloud account and the domain registrar.
• Off-boarding is clear: who removes access when someone leaves the project.

Environments and deploys

• Separate staging and production, with separate databases.
• Deploys go through CI/CD, not by hand from a laptop.
• Rollback to the previous version takes minutes and has been tried at least once.
• Database migrations are reversible or have a tested plan B.

Backups

• Database backups run automatically, daily or more often.
• Backups are stored outside the main server or account.
• A restore was actually tested, not just the backup job.
• Everyone knows how much data can be lost in the worst case and how long a restore takes.

Monitoring and alerts

• Uptime check on the main URL and on the API.
• Alerts on errors, disk space, memory and CPU.
• Alerts go to a real person or channel, and it is clear who reacts and when.
• Logs are kept long enough to investigate an incident (at least 7 to 14 days).

Security basics

• HTTPS everywhere, certificates renew automatically.
• Only needed ports are open. The database is not reachable from the internet.
• OS and dependencies get security updates on a schedule.
• Basic rate limiting on login and public APIs.

Cost

• Budget alert in the cloud account.
• Resources are tagged per client or project, so the bill can be split.
• Instance sizes match real load, not a guess from day one.

Handover

• Short runbook: how to deploy, how to roll back, how to restore, who to call.
• Architecture diagram, or at least a list of all services and where they run.
• Clear owner after launch: studio, client, or external support.