The part that decides whether the investment holds its value

Security patching is the core. Framework, library, plugin and operating system updates applied on a defined cadence — security patches promptly, feature updates tested on staging first. We track your dependency tree against published vulnerability databases so a newly disclosed issue in something you use surfaces the same day.

Backups with verification. Automated daily off-site backups of database and files, retained to an agreed schedule, and — the part that distinguishes a real plan from a checkbox — a restore performed to a scratch environment every quarter with the result and duration recorded. About one in six estates we take over has a backup that does not restore correctly, and the owners had no idea.

Monitoring and response. Uptime checks on critical journeys from multiple locations, performance monitoring with alerts on degradation, error tracking, and certificate and domain expiry monitoring. When something breaks we usually know before you do, which changes the conversation from a complaint to a notification.

Small changes. Every plan includes a monthly allowance of development time for content updates, small design changes, new pages, form adjustments and minor features. This is the part clients use most, and it removes the friction that otherwise causes sites to go stale.

A support commitment that says "we will respond promptly" is not a commitment. Ours are specific by severity and reported against every month.

A critical incident — site or system down, data at risk, payments failing — gets a fifteen-minute first response on 24×7 plans and one business hour on standard plans, with continuous work until resolution. High severity, meaning a significant function is broken but the system is usable, gets four business hours. Standard requests get one business day, and planned work is scheduled.

Importantly, response time is measured from alert rather than from your report, because our monitoring generally detects critical issues first. Our current median first response across all severities is eleven minutes.

Every client receives a monthly report, and we write it to be read by a business owner rather than an engineer. It contains uptime with any incidents explained, performance trend with Core Web Vitals from real users, security actions taken including specific patches applied, backup and restore verification results, tickets raised and resolved with response times measured against the SLA, and the work done from the monthly change allowance.

It also contains a recommendation section — what we think should be addressed next, with an honest indication of urgency. Some months that section says nothing needs attention, which is a legitimate finding rather than a failure to sell something.

Quarterly we run a review call covering the trend rather than the month: where the system is heading, what will need investment in the next year, and whether the plan level is still right. We have recommended clients move to a smaller plan when their usage did not justify the one they were on.

A large share of our maintenance clients arrive with a system built by an agency or developer who is no longer available. The system works, more or less, and nobody knows how.

We start with a takeover assessment: code review, dependency and vulnerability scan, infrastructure inventory, backup verification, security posture and performance profile. That produces a written report with a prioritised list of what needs attention, separated into "fix now", "fix within a quarter" and "acceptable as is". Clients frequently find this document valuable on its own.

Then we stabilise — usually a two to four week effort addressing the urgent items, establishing backups and monitoring, and getting the code into version control if it is not already. From there ongoing maintenance is straightforward. We have taken over systems in every state including a production application whose only copy of the source code was on a laptop.

A maintenance relationship that only prevents decay is a missed opportunity. The teams who get the most value use their monthly allowance deliberately — a quarterly performance improvement, a new landing page for a campaign, an accessibility fix, a small automation.

We also proactively suggest improvements from what monitoring shows us. A page that is slower than the rest, a form with an abnormal abandonment rate, a search query users repeat that returns nothing, an error appearing a hundred times a day that nobody has reported. These come from data we are already collecting and they are frequently the highest-return work in a given month.

Our Essential plan suits marketing sites and small applications: monthly patching, daily backups with quarterly restore verification, uptime monitoring, business-hours support and two hours of changes a month.

Business adds performance monitoring with real-user data, weekly patch cadence, four-hour response on high severity, six hours of changes and a quarterly review call. This is where most of our clients sit.

Enterprise covers revenue-critical systems: 24×7 monitoring and response, fifteen-minute critical response, dedicated engineer familiarity, monthly restore drills, security scanning, twenty hours of changes and a named account contact.

All plans are month to month after an initial three-month term. We do not use long lock-ins, because a plan people cannot leave is a plan that does not have to stay good.