--- url: 'https://metadrop.net/en/services/frameworks/symfony-development-services-support' title: 'Symfony Development Services: 15+ Years, EU Partner' author: name: 'Antonio Núñez' url: 'https://metadrop.net/es/user/23600' date: '2026-07-29T08:33:29+00:00' updated: '2026-08-05T12:14:53+00:00' type: article summary: 'Enterprise Symfony development, API Platform backends, legacy PHP migration and major-version upgrades. European partner, 15+ years in PHP. Free consultation.' image: 'https://metadrop.net/sites/default/files/styles/full/public/2026-07/services-symfony.webp?itok=CjCFrbhQ' published: true og: determiner: Automatic site_name: Metadrop street_address: 'Calle Manuel Luna, 12, 3 Dcha' locality: Madrid region: Madrid postal_code: '28020' country_name: España email: hola@metadrop.net phone_number: '910053180' schema: '@context': 'https://schema.org' '@graph': - '@type': Organization '@id': 'https://metadrop.net/#organization' url: 'https://metadrop.net/' name: Metadrop sameAs: - 'https://www.drupal.org/metadrop' - 'https://twitter.com/metadrop' - 'https://asociaciondrupal.es/partner/metadrop' - 'https://www.linkedin.com/company/metadrop' logo: '@type': ImageObject url: 'https://metadrop.net/themes/custom/mdrop_radix/logo-metadrop-500-500.jpg' width: '500' height: '500' - '@type': ItemPage '@id': 'https://metadrop.net/en/services/frameworks/symfony-development-services-support' breadcrumb: '@type': BreadcrumbList itemListElement: - '@type': ListItem position: 1 name: Home item: 'https://metadrop.net/en' - '@type': ListItem position: 2 name: 'Digital Consultancy, Development and Support' item: 'https://metadrop.net/en/services' - '@type': ListItem position: 3 name: 'Framework Services' item: 'https://metadrop.net/en/services/frameworks' publisher: '@type': Organization '@id': 'https://metadrop.net/#organization' --- 1. [Digital Consultancy, Development and Support](https://metadrop.net/en/services) 2. [Framework Services](https://metadrop.net/en/services/frameworks) # Symfony development services for enterprise applications Metadrop delivers Symfony development for **mid-to-large European organizations**: new applications and API-first backends, legacy PHP migration to Symfony, major-version upgrades, and long-term maintenance under a contractual SLA. [Contact us](https://metadrop.net/en/contact)[Explore](#scroll-to-content) ## What Symfony is, and when it fits an enterprise project **Symfony is an open-source PHP framework** built as a set of independent, reusable components: routing, dependency injection, event dispatching, HTTP handling, serialization, validation and console tooling. Those components can be used together as a full-stack framework, or adopted individually inside another codebase. Symfony also publishes *long-term-support (LTS)* releases on a predictable cadence, which is why it is a common choice for systems expected to stay in production for many years. Symfony fits best when the application carries **substantial domain complexity**: business rules, workflows, permissions and integrations that outgrow a content-managed site. Typical fits are **enterprise web applications**, API-first backends for SPA and mobile front-ends, **integration and middleware layers** between ERP, CRM and legacy systems, event- and queue-driven services, and long-lived regulated systems. Employee-facing systems are a recurring case. **Internal tools, approval workflows, directory and document services** sit behind SSO and are often exposed inside an existing intranet rather than as a separate destination. Because Symfony and Drupal share the same component foundation, an organization already running Drupal can extend into custom Symfony applications without changing engineering language, tooling or hosting model. **Where Symfony is not the answer**, Metadrop says so during discovery: a content-led site is often better served by Drupal, and a small standalone service may not justify a full framework. ## Symfony development services we provide ### Custom Symfony application development Net-new **enterprise applications** on the current Symfony LTS and PHP 8.3+: customer portals, back-office and workflow systems, marketplaces, and domain-heavy business applications. They are built with Doctrine ORM for the persistence layer, Twig for server-rendered interfaces, and a test suite from the first sprint rather than added afterwards. ### API-first backends with API Platform REST and GraphQL APIs built on **API Platform**, with JSON-LD/Hydra and OpenAPI documentation generated from the same resource definitions the API is built on. They are the backend for SPA front-ends, mobile apps and system-to-system integrations. ### Legacy PHP to Symfony migration Structured routes off **unmaintained custom PHP, an abandoned in-house framework, or an end-of-life PHP version** onto a supported Symfony codebase. Migration is phased and test-guarded, designed to keep the current system serving traffic while functionality moves across. ### Symfony major-version upgrades Stepwise upgrades across majors, **deprecation-driven and test-guarded**, one major at a time, bringing a codebase back onto a supported LTS. ### [Enterprise integrations](https://metadrop.net/en/services/drupal/integrations/salesforce) Symfony applications connected to **SAP, Salesforce, Microsoft Dynamics, Sharepoint, payment gateways, search engines and custom SOAP/REST back-ends**, with queue-backed asynchronous processing where volume requires it. ### Architecture consulting and code review An independent assessment of an existing Symfony or PHP codebase covering service architecture, dependency graph, test coverage, performance profile and upgrade route, delivered as a prioritized roadmap **before any code changes**. ### Maintenance, support and SLA Long-term ownership of a production Symfony system: security patching, dependency and PHP version upgrades, monitoring, performance tuning and feature evolution under **a contractual SLA**. Not sure which of these you need? Describe your codebase and your deadline; we'll outline a practical route in a free, no-commitment consultation. [Get my free consultation](#contact) ## They've Trusted Metadrop From industrial manufacturers and B2B marketplaces to humanitarian organizations and public bodies, organizations across **50+ countries** have relied on Metadrop for PHP, Symfony-component and Drupal engineering. Pause logos Play logos ## Working in Symfony's component layer **Drupal is built on Symfony.** Every Drupal platform Metadrop has engineered over **15+ years** runs on Symfony's HttpKernel, and its custom code is written against Symfony's own component APIs. The components Metadrop's engineers work in as routine production work include **DependencyInjection** (service definitions, compiler passes, tagged services), **EventDispatcher** (subscribers and listeners), **HttpKernel** and **HttpFoundation** (the request/response lifecycle and middleware-style logic), **Routing**, **Serializer**, **Validator** and **Console**, the last one for long-running and scheduled CLI commands. This work is carried out directly against **Symfony's architectural components**: the same service-container patterns, event models and CLI tooling that a standalone Symfony application is built from. Standalone Symfony applications, API Platform integrations and Symfony Console tooling have been delivered as extensions of that foundation on client engagements. Testing and static analysis are part of the engineering practice: **PHPUnit**, Behat, and static analysis in the pipeline. Metadrop also runs public [PHPUnit and TDD training](https://metadrop.net/en/services/training-courses/drupal-unit-testing-tdd-course-with-phpunit) for other engineering teams. Its published engineering writing covers PHP major-version migration, Composer dependency management, mocking third-party APIs in test environments, and automated testing beyond PHPUnit, the same practices this page's upgrade and maintenance work rests on. ### Our Symfony technology stack - **Framework and language:** Symfony (current LTS and latest), PHP 8.3+, Symfony Flex. - **Data:** Doctrine ORM and DBAL, MySQL/MariaDB, PostgreSQL, Redis. - **APIs:** API Platform, REST, GraphQL, JSON-LD/Hydra, OpenAPI, OAuth2/OIDC, JWT. - **Async and real-time:** Symfony Messenger with RabbitMQ or Redis transports, Mercure. - **Interfaces:** Twig, Webpack Encore/Vite, and SPA front-ends in [Angular](https://metadrop.net/en/services/frameworks/angular-development-services-support), React or Vue where a rich client is required. - **Search:** Solr, Elasticsearch. - **Quality:** PHPUnit, Behat, PHPStan, PHP CodeSniffer, Rector, Composer audit. - **Infrastructure and CI/CD:** Docker, Kubernetes, AWS, Azure, GitLab CI, GitHub Actions, Jenkins, Varnish, Cloudflare. ## New Symfony applications and API-first backends **API Platform** generates REST and GraphQL endpoints, OpenAPI documentation and JSON-LD/Hydra output from annotated resources, which shortens the distance between a domain model and a documented, consumable API. On top of it, Metadrop delivers authentication and authorization patterns including **OAuth2/OIDC, JWT, SAML SSO**, role- and group-scoped permissions, and per-resource access rules. **Symfony Messenger** moves heavy or spiky work such as imports, notifications and third-party synchronization off the request cycle and onto queues, while **Mercure** pushes real-time updates to browsers and apps. APIs are covered by **automated contract and integration tests**, so a consuming front-end or mobile app can be developed against a stable, verified surface. The deployment target follows the client's own infrastructure policy: AWS, Azure, Google Cloud, or self-hosted Docker/Kubernetes. On one engagement, Metadrop built an authenticated **GraphQL and REST API backend** for a global humanitarian organization operating in more than 50 countries, covering CRUD endpoints, group management and invitation-email flows, with automated API test suites over both interfaces. ## Legacy PHP migration and Symfony major-version upgrades Both journeys start with the same deliverable: an **audit of the existing codebase** covering dependency inventory, deprecation report, test coverage, integration surface and a risk register specific to that code. Upgrades then run **one major at a time**, driven by the deprecation messages the framework itself emits, an established and incremental discipline rather than running two frameworks side by side in production. **Rector** automates the mechanical part of a version bump, **PHPStan** raises typing and API-change issues as early as possible during delivery, and **PHPUnit and Behat suites** guard behaviour at every step. Where a legacy codebase has no tests, *characterisation tests* are written for the critical paths first. Legacy migrations are **phased by bounded slice**, one domain area, one integration or one screen family at a time, so the current system keeps serving traffic while functionality moves across. URL structure, redirects and indexed paths are mapped and verified before and after each phase, so search visibility is checked rather than assumed. **PHP version migration usually travels with the framework upgrade** as well, since a Symfony major jump normally implies a minimum PHP version, and both are planned as one piece of work. | Where the codebase is now | Typical route | What guards it | |---|---|---| | Custom PHP, no framework | Rebuild by bounded slice onto current Symfony LTS, running alongside the legacy system | Characterisation tests on critical paths, phased cutover per slice | | Abandoned in-house or end-of-life framework | Domain model and data migrated to Symfony + Doctrine; integrations re-implemented as services | Data-migration dry runs on production-equivalent data | | Symfony 2.x or 3.x | Stepwise through each major to the current LTS | Deprecation reports, Rector rule sets, PHPStan, regression suite per step | | Symfony 4.x or 5.x | Stepwise to the current LTS, usually with a PHP version bump in the same programme | Same per-step gates, plus dependency and bundle replacement plan | | Current LTS, no upgrade discipline | Move onto a maintained upgrade cadence under a support retainer | Automated dependency and security scanning in CI | Long-lived PHP platforms in practice Metadrop migrated a European sports media publisher's news platform across two major Drupal versions with a custom migration pipeline of 16 coordinated migrations covering users, files, media, taxonomies, content types, redirects and path aliases, with custom process plugins rewriting embedded editor images into managed media references, so content and indexed URLs carried over. On another engagement, Metadrop carried a global B2B marketplace in the wind-energy sector through consecutive major upgrades, Drupal 7 to 9, then 10, then 11, each jump crossing a Symfony major version, alongside module replacement and multilingual reconfiguration, with the platform live throughout. Stuck on an unsupported Symfony or legacy PHP version? Send us the version you're on and the deadline you're working to; a short call is enough to sketch the upgrade route and the risks worth budgeting for. [Scope my upgrade](#contact) ## Long-term Symfony maintenance and support Maintenance retainers cover **security patching, dependency and PHP version upgrades, monitoring, incident response, performance tuning and feature evolution** under one agreement. **Response and resolution targets are contractual**, agreed per priority level during onboarding rather than described in general terms. Dependency and vulnerability scanning runs in CI through **Composer audit, the PHP security advisories database and Symfony's own security checks**, so an advisory becomes a scheduled patch rather than a discovery during an incident. Observability is set up as part of onboarding too: application monitoring, error tracking, profiling and log aggregation, so regressions surface from data rather than from a user report. Onboarding an **inherited or undocumented codebase** is a normal starting point. Audit, environment reproduction, bootstrapping an automated test suite, and a documented runbook come before feature work. Client relationships **commonly run 3+ years**, with the longest active PHP platform engagements past the decade mark. Where possible, continuity of the delivery team helps retain architectural context over time. Where a client wants to take delivery back in-house, knowledge transfer and team training are part of the engagement, handed over as agreed in the contract. Metadrop maintains and evolves the fundraising and donation platform of an international children's-rights NGO under a relationship running since 2015, including a **PHP 8.4 migration** covering custom code and the QA toolchain (static analysis and automated tests), recurring-donation and payment-gateway work, and Core Web Vitals performance tuning. ## Security, compliance and governance ### GDPR-aligned data flows Lawful-basis mapping, consent handling, data-minimisation in the domain model, retention rules and data-subject-rights tooling are designed into the application rather than retrofitted. ### Prepared for NIS2 requirements A secure SDLC practice covers peer-reviewed changes, dependency and CVE scanning in the pipeline, environment separation, least-privilege access, and a vulnerability-response SLA, prepared for NIS2 requirements in regulated sectors and public bodies. ### ENS-certified partner Metadrop is certified under the Spanish National Security Scheme (ENS), a requirement in Spanish public-sector procurement and evidence of a documented security posture in tenders elsewhere. ### WCAG 2.1 AA for Twig interfaces Server-rendered Symfony interfaces are built with semantic markup, ARIA patterns and keyboard navigation, audited automatically and manually. WCAG 2.1 AA is today's legal accessibility baseline in the EU; WCAG 2.2 AA is applied as a design-quality target, not presented as legal conformance. Whether a given application meets a standard depends on the client's own scope, content and processing activities, so these are technical readiness statements rather than legal advice. ### Application security baseline CSRF and XSS protection, parameterised persistence through Doctrine, secrets management, security-voter-based authorization, rate limiting, audited authentication flows, and dependency scanning on every pipeline run. ### Independent technical governance Architecture reviews, dependency audits and release gates surface technical risk during discovery and before each release, with Metadrop working as the client's technical partner across architecture, build, migration and support. ## What drives the cost of a Symfony project Four variables move a Symfony budget most: **integration count**, **domain complexity** (workflows, permissions, business rules), **data-migration volume and quality**, and **test coverage in the existing codebase**. Legacy state matters as much as scope, because an undocumented codebase with no tests carries discovery and characterisation work that a documented one does not. Test coverage is one of the areas that often has the greatest impact on an upgrade timeline. Metadrop quotes per project after a **free consultation** rather than publishing a rate card, because rates vary by seniority, engagement model and contract length. A **paid audit or discovery phase** is available as a standalone first step, producing a scope, risk register and estimate the client owns, with no obligation to continue. ### Engagement models ### Dedicated team a Metadrop squad (tech lead, senior and mid developers, QA, PM) working to the client's roadmap. Best for multi-quarter builds and migration programmes. ### Staff augmentation engineers experienced in Symfony and PHP added to an in-house team under client management. Best for a known skills gap. ### Fixed-price project a scoped deliverable with agreed budget and timeline. Best for a well-defined migration, upgrade or MVP. ### Time and materials flexible delivery at an agreed day rate. Best for evolving scope or discovery work. ### Support retainer a monthly envelope with SLA-backed response targets. Best for a production system already live. ### How a project runs 1. ### Discovery and audit goals, constraints, integration map, codebase and dependency assessment, risk register. 2. ### Architecture and roadmap service architecture, data model, API contract, migration or upgrade route, prioritized backlog. 3. ### Agile delivery in 2-week sprints a demo, a retrospective and a visible backlog every sprint, under Metadrop's Scrum and Kanban practice. 4. ### Quality gates automated tests, static analysis, security scanning and accessibility checks before each release. 5. ### Release and handover deployment pipeline, runbook and documentation. 6. ### Support and evolution [maintenance under a defined SLA](https://metadrop.net/en/services/drupal/maintenance) with a planned upgrade cadence. Ready to put a number and a date on it? An initial call with an engineer is often enough to define the first phase, its deliverable and a realistic budget range. [Discuss my project](#contact) ## Frequently asked questions - ### Is Drupal built on Symfony? Yes. Since Drupal 8, Drupal has been built on **Symfony components**, among them HttpKernel, Routing, DependencyInjection, EventDispatcher, HttpFoundation, Serializer, Validator and Console. This is why experience building Drupal platforms also provides experience working with Symfony's core components, and why a Drupal major upgrade is also a Symfony major upgrade. - ### Symfony or Laravel for an enterprise application? **Symfony** suits long-lived, complex systems: decoupled components, explicit configuration, a predictable LTS cadence, and a service architecture that supports long-term maintainability. **Laravel** favours convention and speed of initial delivery, which suits smaller applications and faster time-to-first-release. Metadrop works in both and recommends per project during discovery, based on lifespan, team composition and integration surface. Laravel services are covered separately. - ### Which Symfony versions do you upgrade from? From **Symfony 2.x and 3.x** upward, stepwise through each major release to the current LTS, as well as 4.x and 5.x codebases. Legacy PHP applications with no framework, or on an abandoned in-house framework, are handled as migrations rather than upgrades. - ### How long does a Symfony major-version upgrade take? A typical single-major upgrade of a mid-sized application runs **4 to 12 weeks**, depending on codebase size, third-party bundle count and existing test coverage. Multi-major jumps are planned as consecutive steps, each with its own release, rather than a single long-running branch. The codebase audit in the first phase replaces this range with a project-specific estimate before any commitment. - ### How much does Symfony development cost? Cost is driven by integration count, domain complexity, data-migration volume and the test coverage already in the codebase. Metadrop quotes per project after a free consultation, and offers a paid audit or discovery phase as a standalone first step whose scope and estimate the client keeps. - ### Should we use API Platform or a custom Symfony REST API? **API Platform** is the faster route when the API maps onto a domain model, since it generates REST and GraphQL endpoints, OpenAPI documentation and JSON-LD/Hydra output from the same resource definitions. A **hand-built controller layer** fits better when the API surface is small, highly bespoke, or shaped by an external contract that does not follow the resource model. Both are common in Metadrop projects, and the choice is made in the architecture phase. - ### Are your Symfony applications GDPR, WCAG and NIS2 ready? GDPR-aligned data flows and WCAG 2.1 AA accessibility are part of the delivery baseline, with WCAG 2.2 AA applied as a design-quality target. Delivery practice is prepared for NIS2 requirements, and Metadrop is ENS-certified for Spanish public-sector work. Whether a given application meets a standard depends on the client's own scope, content and processing, so this is a technical readiness statement rather than legal advice. - ### Can you take over a Symfony application built by someone else? Yes. Onboarding an inherited codebase starts with an audit, environment reproduction, bootstrapping an automated test suite, and a documented runbook before feature work begins. After onboarding, the application moves onto a support retainer with contractual response targets per priority level. ## Start your Symfony project with Metadrop Enterprise Symfony delivery across architecture, build, API Platform backends, legacy migration, major-version upgrades and SLA-backed support. Tell us the version you're on, the system you need built, or the codebase you need taken over, and we'll come back within one business day and scope a free 30-minute consultation with an engineer. No commitment required. You must have JavaScript enabled to use this form. Name Email Organization Tell us more Escribe tu mensaje aquí... Privacy policy I have read and accepted the [privacy policy](https://metadrop.net/en/privacy-policy) regarding data processing. Leave this field blank ## Framework Services Choose the right stack: frontend, backend and cross-platform framework engineering with long-term SLA support from a European partner. - [**Angular**](https://metadrop.net/en/services/frameworks/angular-development-services-support "Enterprise Angular development services from a European partner: custom SPAs, customer portals, dashboards, AngularJS migration and long-term SLA support, GDPR and WCAG ready.") Enterprise Angular development services from a European partner: custom SPAs, customer portals, dashboards, AngularJS migration and long-term SLA support, GDPR and WCAG ready. - [**Express JS**](https://metadrop.net/en/services/frameworks/express-js-development-services-support "Node.js and Express backends built by a Drupal-certified European team: APIs, microservices, real-time services and long-term SLA support.") Node.js and Express backends built by a Drupal-certified European team: APIs, microservices, real-time services and long-term SLA support. - [**Flutter**](https://metadrop.net/en/services/frameworks/flutter-development-services-support "Cross-platform Flutter apps for iOS and Android, legacy app consolidation, Drupal API integration and long-term SLA support.") Cross-platform Flutter apps for iOS and Android, legacy app consolidation, Drupal API integration and long-term SLA support. - [**Laravel**](https://metadrop.net/en/services/frameworks/laravel-development-services-support "Enterprise Laravel development, legacy PHP and Symfony migration, API backends and SLA-backed support from a European partner.") Enterprise Laravel development, legacy PHP and Symfony migration, API backends and SLA-backed support from a European partner. - [**Next JS**](https://metadrop.net/en/services/frameworks/next-js-development-services-support "Enterprise Next.js development, SEO-conscious migration, headless Drupal frontends and SLA support from a senior European, compliance-ready partner.") Enterprise Next.js development, SEO-conscious migration, headless Drupal frontends and SLA support from a senior European, compliance-ready partner. - [**React**](https://metadrop.net/en/services/frameworks/react-development-services-support "Enterprise React development, legacy migration, headless Drupal integration and SLA support from a European, compliance-ready partner.") Enterprise React development, legacy migration, headless Drupal integration and SLA support from a European, compliance-ready partner. - [**Vue.js**](https://metadrop.net/en/services/frameworks/vue-js-development-services-support "Enterprise Vue.js and Nuxt development: legacy Vue 2 to 3 migration, headless Drupal integration and SLA support for European organizations.") Enterprise Vue.js and Nuxt development: legacy Vue 2 to 3 migration, headless Drupal integration and SLA support for European organizations.