Symfony development services for enterprise applications

What Symfony is, and when it fits an enterprise project

Symfony is an open-source PHP framework built as a set of independent, reusable components: routing, dependency injection, event dispatching, HTTP handling, serialization, validation and console tooling. Those components can be used together as a full-stack framework, or adopted individually inside another codebase. Symfony also publishes long-term-support (LTS) releases on a predictable cadence, which is why it is a common choice for systems expected to stay in production for many years.

Symfony fits best when the application carries substantial domain complexity: business rules, workflows, permissions and integrations that outgrow a content-managed site. Typical fits are enterprise web applications, API-first backends for SPA and mobile front-ends, integration and middleware layers between ERP, CRM and legacy systems, event- and queue-driven services, and long-lived regulated systems.

Employee-facing systems are a recurring case. Internal tools, approval workflows, directory and document services sit behind SSO and are often exposed inside an existing intranet rather than as a separate destination. Because Symfony and Drupal share the same component foundation, an organization already running Drupal can extend into custom Symfony applications without changing engineering language, tooling or hosting model.

Where Symfony is not the answer, Metadrop says so during discovery: a content-led site is often better served by Drupal, and a small standalone service may not justify a full framework.

Working in Symfony's component layer

Drupal is built on Symfony. Every Drupal platform Metadrop has engineered over 15+ years runs on Symfony's HttpKernel, and its custom code is written against Symfony's own component APIs.

The components Metadrop's engineers work in as routine production work include DependencyInjection (service definitions, compiler passes, tagged services), EventDispatcher (subscribers and listeners), HttpKernel and HttpFoundation (the request/response lifecycle and middleware-style logic), Routing, Serializer, Validator and Console, the last one for long-running and scheduled CLI commands.

This work is carried out directly against Symfony's architectural components: the same service-container patterns, event models and CLI tooling that a standalone Symfony application is built from. Standalone Symfony applications, API Platform integrations and Symfony Console tooling have been delivered as extensions of that foundation on client engagements.

Testing and static analysis are part of the engineering practice: PHPUnit, Behat, and static analysis in the pipeline. Metadrop also runs public PHPUnit and TDD training for other engineering teams. Its published engineering writing covers PHP major-version migration, Composer dependency management, mocking third-party APIs in test environments, and automated testing beyond PHPUnit, the same practices this page's upgrade and maintenance work rests on.

New Symfony applications and API-first backends

API Platform generates REST and GraphQL endpoints, OpenAPI documentation and JSON-LD/Hydra output from annotated resources, which shortens the distance between a domain model and a documented, consumable API. On top of it, Metadrop delivers authentication and authorization patterns including OAuth2/OIDC, JWT, SAML SSO, role- and group-scoped permissions, and per-resource access rules.

Symfony Messenger moves heavy or spiky work such as imports, notifications and third-party synchronization off the request cycle and onto queues, while Mercure pushes real-time updates to browsers and apps. APIs are covered by automated contract and integration tests, so a consuming front-end or mobile app can be developed against a stable, verified surface. The deployment target follows the client's own infrastructure policy: AWS, Azure, Google Cloud, or self-hosted Docker/Kubernetes.

On one engagement, Metadrop built an authenticated GraphQL and REST API backend for a global humanitarian organization operating in more than 50 countries, covering CRUD endpoints, group management and invitation-email flows, with automated API test suites over both interfaces.

Legacy PHP migration and Symfony major-version upgrades

Both journeys start with the same deliverable: an audit of the existing codebase covering dependency inventory, deprecation report, test coverage, integration surface and a risk register specific to that code. Upgrades then run one major at a time, driven by the deprecation messages the framework itself emits, an established and incremental discipline rather than running two frameworks side by side in production.

Rector automates the mechanical part of a version bump, PHPStan raises typing and API-change issues as early as possible during delivery, and PHPUnit and Behat suites guard behaviour at every step. Where a legacy codebase has no tests, characterisation tests are written for the critical paths first.

Legacy migrations are phased by bounded slice, one domain area, one integration or one screen family at a time, so the current system keeps serving traffic while functionality moves across. URL structure, redirects and indexed paths are mapped and verified before and after each phase, so search visibility is checked rather than assumed. PHP version migration usually travels with the framework upgrade as well, since a Symfony major jump normally implies a minimum PHP version, and both are planned as one piece of work.

Long-term Symfony maintenance and support

Maintenance retainers cover security patching, dependency and PHP version upgrades, monitoring, incident response, performance tuning and feature evolution under one agreement. Response and resolution targets are contractual, agreed per priority level during onboarding rather than described in general terms.

Dependency and vulnerability scanning runs in CI through Composer audit, the PHP security advisories database and Symfony's own security checks, so an advisory becomes a scheduled patch rather than a discovery during an incident. Observability is set up as part of onboarding too: application monitoring, error tracking, profiling and log aggregation, so regressions surface from data rather than from a user report.

Onboarding an inherited or undocumented codebase is a normal starting point. Audit, environment reproduction, bootstrapping an automated test suite, and a documented runbook come before feature work. Client relationships commonly run 3+ years, with the longest active PHP platform engagements past the decade mark. Where possible, continuity of the delivery team helps retain architectural context over time. Where a client wants to take delivery back in-house, knowledge transfer and team training are part of the engagement, handed over as agreed in the contract.

Metadrop maintains and evolves the fundraising and donation platform of an international children's-rights NGO under a relationship running since 2015, including a PHP 8.4 migration covering custom code and the QA toolchain (static analysis and automated tests), recurring-donation and payment-gateway work, and Core Web Vitals performance tuning.