We hold accounts with several providers and choose per client based on region, workload and budget. The account is always opened in the client's name.
Our default origin for EU-hosted clients. Exceptional price-to-performance on dedicated vCPU instances with NVMe, private networking, snapshots and load balancers. Data centres in Germany and Finland.
Droplets, managed databases and spaces across regions including Amsterdam, Frankfurt, London, New York and Bangalore. Clear pricing, solid API, good managed PostgreSQL and MySQL.
For Ecosystem clients who need specific managed services (RDS, S3, SES, Lambda), Middle East regions (Bahrain, UAE) or compliance attestations their auditors ask for.
Authoritative DNS with DNSSEC, global CDN, web application firewall, DDoS mitigation, rate limiting, bot management and origin shielding. In front of every site we host, on every plan.
At-cost registration with registrar lock and 2FA on Cloudflare for supported TLDs; Namecheap for TLDs Cloudflare does not carry and for clients consolidating a large existing portfolio.
Where a client specifically wants a managed WordPress platform rather than our own container stack, we operate on Kinsta for premium performance or Cloudways for cost-sensitive multi-site portfolios, and still manage everything around it.
Boring on purpose. Every component below has a long support window, a large hiring pool and a known upgrade path.
Five-year support windows, unattended security upgrades, Livepatch where enabled. Minimal images, hardened to CIS baseline.
Every application runs as an immutable container image built in CI. Rollback is redeploying the previous tag.
Reverse proxy and static server, tuned for HTTP/2 and HTTP/3, Brotli, strict TLS and security headers out of the box.
Automated ECDSA certificates at the origin, with expiry monitored independently of the renewal job.
Hardened configuration, curated plugin list, updates staged first. The most maintainable choice for content and commerce teams.
For speed-critical marketing sites and headless storefronts. Pre-rendered, cached at the edge, deployed per branch.
Portals, APIs and internal tools, chosen per project. Documented, tested and containerised like everything else.
Managed or self-hosted with replication, point-in-time recovery on Ecosystem, Redis for object and session caching.
The tooling that turns a server into a managed service.
Build, test, performance-budget check and deploy on every push. Staging on pull request, production on merge.
Every Ecosystem environment is reproducible from a repository. Drift is detected, not discovered.
Metrics, logs and multi-region uptime checks with alert routing to the on-call engineer.
Encrypted, deduplicated, stored in a different provider and region from the origin, restored on a schedule to prove it.
Shared credential vault per client, handed over at onboarding, with access revocable by the client.
Image, dependency and application vulnerability scans on a schedule, with findings tracked to closure.
Optional per client, driven by the same checks that page us, so it is never out of date.
Admin panels and staging behind identity-aware access instead of an IP allow-list.
Business mail and application mail are different problems with different tools.
Default for business mailboxes, calendars and shared drives. Seats beyond the plan allocation are passed through at Google's price.
workspace.google.com ↗For organisations already standardised on Outlook, Teams and SharePoint. Same DMARC and monitoring regime.
microsoft.com ↗Form notifications, receipts, password resets and alerts on a dedicated relay, separated from marketing mail so one never damages the other's reputation.
postmarkapp.com ↗Chosen for how well they integrate with the layers below, not for how they demo.
With server-side Google Tag Manager on our infrastructure and consent mode configured per region.
Crawl, index and ranking data feeding the technical SEO audits and the content programme.
Default CRM and marketing automation for Scale and Ecosystem clients; free tier where it suffices, paid tiers passed through at cost.
hubspot.com ↗Campaigns, transactional templates and automation for clients who do not need a full CRM, on a dedicated authenticated sending domain.
brevo.com ↗Managed against server-side conversion events, with spend billed by the platform directly to the client's account.
Finance and marketing dashboards on the warehouse, reconciled monthly against source systems.
Event pipeline destination on Ecosystem; PostgreSQL on our infrastructure by default, BigQuery where GA4 export volume justifies it.
Regional consent banner wired to consent mode, so measurement stays lawful and still useful.
We must be able to operate it for years. A long support window, a clear upgrade path and a hiring pool matter more than features.
It must export. If your data cannot leave a tool in an open format, we will not put your data in it.
It must be paid for in your name. Accounts belong to the client. Our access is delegated and revocable.
Commission never decides. Where a vendor has a partner programme we may join it, and we disclose it. Fit decides the recommendation; the commission is incidental.
Every plan deploys the infrastructure layer above on day one. The rest switches on as you move up.