Care and security are the same job. So they are the same plan.
Every plan on this page keeps your site running and keeps it protected: SSL and uptime watched, dependency and security advisories triaged, patches applied on a clock, access-policy drift reviewed, and backups actually restore-tested. It ships a document on a schedule, states how much change work is included as a number rather than a feeling, and lists what it does not cover.
Priced by how much of it we do, not by how it sounds.
Every figure below is read from the same source the subscription bills against. Annual is twelve months at the monthly rate, paid once, so it is a convenience rather than a discount you have to ask about.
Watch & Protect
Licensed, backed up, patched and watched. No change work included.
- ✓Hosting on our own commercial account, licensed for business use, not a free tier that forbids it
- ✓A database that never sleeps, backed up every day and kept for a week
- ✓SSL certificate provisioning and renewal, monitored
- ✓Domain and SSL expiry checked by hand each month and flagged in your report
- ✓Uptime checks every hour, around the clock including nights and weekends, with an alert as soon as a second consecutive check fails, so one blip is not a false alarm
- ✓Monthly dependency vulnerability triage: you are told which alerts matter and which are noise
- ✓A monthly security sweep of your data, run by hand and summarised in your report
- ✓Security patch releases applied within 5 business days
- ✓A hard spending cap on your hosting, so a traffic spike cannot surprise you
- ✓Quarterly backup restore test, run by hand, with the pass date written into your report
- ✓0 change requests included, by design
Care & Protect
Everything watched, plus four changes a month and the upgrade work done for you.
- ✓Everything in Watch & Protect
- ✓Down alerts on the very first failed check, without waiting for a second
- ✓4 change requests a month, delivered in 3 business days
- ✓Monthly update pass: reviewed, applied, put live and verified, not just reported
- ✓Monthly access-policy drift review on every table added or changed
- ✓Monthly form and email delivery test, run by hand with a real submission
- ✓Monthly broken-link check across your main pages, run by hand
- ✓Page speed checked each month, with a written note whenever it degrades
- ✓Quarterly upgrade of the system behind your data, verified before and after
- ✓One major platform upgrade a year, included
- ✓A staging preview for every change: nothing reaches your live site unreviewed
- ✓90-day rollback: any deploy in the last 90 days can be restored, and we will start within one business day
Care & Protect Plus
For a site your business runs on. Standing hours every month, the fastest acknowledgement we offer, and a backlog we work from.
- ✓Everything in Care & Protect
- ✓10 change requests a month, or 6 hours of development time, your choice each month
- ✓A shared improvement backlog we keep with you and work from every month out of the standing allowance, so the site moves forward in a month you ask for nothing
- ✓Quarterly 45-minute roadmap call with written follow-up
- ✓Recovery to almost any moment, roughly the last two minutes rather than yesterday's backup
- ✓Security warnings fixed, not just reported, with the change written and applied
- ✓An annual mini security review on your anniversary month
- ✓Monthly accessibility check against WCAG 2.2 AA, with every finding listed in your report
- ✓Log retention configured, because the platform only keeps logs briefly
The plan produces a document, on a date, whether or not anything broke.
A quiet month is the outcome you are paying for. It should still land in your inbox as evidence rather than as silence.
Watch & Protect
Site Health Card: one page emailed on the 1st with time online for the month, every interruption and how long it lasted, application errors seen, and what we recommend next.
Care & Protect
Site Health Card plus a written Care Report: what changed, what we did, what we recommend next, and a change log with before-and-after preview links for every request delivered.
Care & Protect Plus
Care Report Plus: everything in the Care report, plus the backlog work done this month with before-and-after evidence, plus a rolling 90-day roadmap of what comes next.
Written on the sales page, not discovered in month three.
Every exclusion below is quotable as separate work. None of it is refused. It is simply not inside the monthly fee, and saying so here is cheaper for both of us than saying it later.
Watch & Protect
- Content, copy or image changes
- New pages, sections or features
- Design changes
- Third-party integrations
- Major platform version upgrades
- Analytics, tracking or SEO work
- Anything that requires a code change
Care & Protect
- New page templates or a design system
- New features or custom development
- Third-party API integrations
- E-commerce or payment work
- Content writing
- SEO strategy, link building or paid ads
- Any single piece over 2 hours, which is quoted separately
Care & Protect Plus
- Net-new applications or products
- Redesigns
- Migrating off this stack
- Content writing, SEO strategy or paid media
- Design system creation
- Work beyond the monthly allowance, which is quoted separately
- A guaranteed human response after hours, at weekends or on holidays. The alerting runs around the clock. A person does not
- 24/7 phone support
Roughly seventy percent of a standard care plan does not exist on this stack.
Which is a good thing, and it is also why the contents look different from every other care plan you have been quoted.
- No plugins, no themes, no CMS core and no PHP, so there is no monthly plugin update to sell you.
- No writable web root, so the classic defacement and file-injection attacks have nowhere to land.
- What this stack does need is supply-chain work: dependency advisories triaged, upgrades merged and verified.
- And authorization work: row-level security policies drift the moment a table is added, and drift is silent.
- And proof: a backup nobody has ever restored is a hope, not a backup.
The entry plan is also not something you can do yourself for less. Vercel’s free tier is contractually not for commercial use and Supabase’s free project pauses after a week of inactivity with no automatic backups, so running your own commercial-grade accounts starts at about $45 a month before anyone looks at anything.