You do not get a control panel and a knowledge base. You get a team that provisions, hardens, monitors, patches, backs up and scales your infrastructure, in the region you choose, and writes down what it did every month.
The word "managed" is used loosely in this industry. This is the exact list of what we take responsibility for on every plan, starting with Foundation, and each line produces a record that appears in your monthly evidence pack.
Resources are dedicated to you from Assured upwards. Foundation runs in an isolated container on managed compute that we never oversell.
| Specification | Foundation | Assured | Sovereign |
|---|---|---|---|
| Compute | 2 vCPU · 4 GB, isolated container | 4 vCPU · 8 GB, dedicated | 8+ vCPU · 32 GB, multi-node pool |
| Storage | 40 GB NVMe | 160 GB NVMe | 500 GB NVMe, expandable |
| Architecture | Single node | Single node + managed DB | Load-balanced app tier, separate DB, failover |
| Production sites | 1 | Up to 5 | Unlimited |
| Transfer | 1 TB / mo + CDN | 5 TB / mo + CDN | Unmetered fair use + CDN |
| Staging environment | On request | Included, per site | Included, plus preview per branch |
| Backups | Daily · 14-day retention | Hourly · 30-day retention | Point-in-time · 90-day retention |
| Monitoring | 60 s · 3 regions | 60 s · 6 regions + real-user | 30 s · 6 regions + real-user + synthetic journeys |
| Uptime SLA | 99.9% | 99.9% | 99.99% |
| Regions | EU (Germany, Finland, Netherlands), Middle East (UAE, Bahrain) and US. Residency is chosen at onboarding, pinned, and stated in every evidence pack. | ||
Full feature comparison, including the controls, engineering and growth layers, is on the plans page →
An expired domain or a mail server on a blocklist does more damage than any outage. We treat both as infrastructure, with monitoring and ownership rules to match.
p=reject, with DMARC reports monitoredBusinesses are breached through boring things: an un-patched plugin, a reused admin password, a backup nobody tested. The model below is built around those boring things, and each layer leaves a record.
Managed rulesets against OWASP top-10 patterns, bot filtering, rate limiting on login and API routes, DDoS absorption before traffic reaches your origin.
TLS 1.2+ only, modern ciphers, HSTS, certificates issued and renewed automatically and monitored for expiry.
Origin accepts traffic only from the CDN, SSH by key via bastion, automatic security updates, intrusion detection, immutable container images.
Dependency and CMS updates tested on staging then promoted, weekly vulnerability scans, malware scanning and file-integrity monitoring on Assured and above, findings tracked to closure.
2FA enforced on every admin panel, role-based access, shared credential vault, quarterly access review documented, SSO on Sovereign.
Encrypted off-site backups on append-only storage, scheduled restore drills, documented recovery time and recovery point objectives, tested failover on Sovereign.
We have moved sites off shared cPanel hosts, page builders, agency servers and abandoned cloud accounts. The process is the same every time, the cut-over happens at DNS, and the inventory we produce becomes your first record.
Every domain, record, mailbox, database, cron job, integration and person with access documented before anything moves.
The full stack is rebuilt on new infrastructure in your chosen region and tested against production data behind a private hostname.
Final delta sync of files and databases, DNS TTLs lowered 48 hours in advance, email cut-over coordinated separately.
DNS switched, old host kept warm for 14 days as a fallback, monitoring watched closely for 72 hours, migration report issued.
Where you decide. EU regions in Germany, Finland or the Netherlands by default, Middle East regions in the UAE or Bahrain for residency requirements there, and US regions on request. The choice is made at onboarding, pinned, and stated in every monthly evidence pack so you can show where your data lives.
WordPress and WooCommerce, yes, with a hardened configuration and a strict update policy. Static sites, Next.js, Laravel, Django and containerised applications, yes. Shopify and other hosted platforms are not hosted by us, but we build, integrate and operate the rest of the ecosystem around them, including DNS, email, analytics and headless storefronts.
We provision on Hetzner and DigitalOcean for most workloads, AWS where a client needs specific managed services or regions, and Cloudflare for DNS, CDN and the web application firewall. We choose per client and the account is opened in your name. Our stack page lists everything.
Yes, for the parts that concern hosting, backups, access and change management. The monthly evidence pack answers most questionnaire items directly, and Sovereign clients can request specific evidence on demand. We do not certify you, and we will not answer questions about policies and processes on your side, but we make the infrastructure part straightforward.
Every account is already in your name, so you revoke our access. We hand over a current credential vault, an infrastructure document and a full export, and keep the old environment available for 30 days after cancellation. There is no exit fee. See the refund and cancellation policy.
Yes. Every plan is hosting and operations first; the build and the growth layer are included because clients almost always need them, but if you already have a site and a team you can use Foundation or Assured purely as managed, documented infrastructure. Tell us on the order form.
We read your DNS, hosting, TLS, email configuration and site performance and send back a written report. No access needed for the first pass.