Craft CMS Support & Development Retainers

What services are included in the retainer?

The retainer time can be used for absolutely anything to do with your website including, but not limited to:

• New website features
• Bug fixes
• Technical Support
• Emergency Support
• Research & Development
• Consultation
• Online Marketing Collateral
• Onsite SEO

However, it does not include:

• Out-of-hours support
• Adwords / PPC Management
• Social Media Management
• Offsite SEO
• Craft CMS Upgrades
• Craft CMS Maintenance

How many hours per month are included?

We have four retainer tiers available – each with an increasing amount of hours per month:

1. Starter (10 hours) – Ideal for small projects or occasional support
2. Growth (20 hours) – Suited for ongoing projects or expanding business needs
3. Accelerate (30 hours) – Designed for comprehensive support and regular engagements
4. Elite (40 hours) – Perfect for in-depth involvement and high-priority projects

What is the response time for requests made under the retainer?

Our targets for all support requests are:

• Critical; Business critical, site is down or experiencing an issue affecting all users. Target Response time; 1 hour | Target Resolution time; 4 hours
• High; Not business critical but is experiencing issues affecting most users. Target Response time; 2 hours | Target Resolution time; 8 hours
• Medium; Not business critical and not causing the website to be non-functional or affecting many users. Target Response time; 4 hours | Target Resolution time; 24 hours
• Low; Not business critical and not causing problems for users. Target Response time; 24 hours | Target Resolution time; 1 week

Can unused hours be rolled over to the next month?

No, unused hours on any tier do not carry over to the following month.

How does the billing process work?

You will be billed on the 1st of each month for the upcoming support and development. Invoices will be sent automatically via email and all payments should be made digitally within 7 days of invoice.

Who will be handling our account?

You will have a dedicated account manager for the duration of your retainer. They will be your primary point of contact – and will relay your business goals, support requests and needs back to the most qualified members of the team.

What types of performance reporting will be provided?

Every month you’ll be updated with a report of what’s been done, what's in progress and what’s still to do – and how many remaining retainer hours you have.

Also, our quarterly audit and reporting will uncover the data that will make a difference to your business. We’ll then plan together to have maximum impact over the upcoming quarter.

The audit and report look at:

• Traffic / Leads / Conversions (defined during onboarding)
• Competitor Analysis (traffic + keywords + content gaps)
• Audits:
  • Speed
  • Security
  • Technical SEO

How is communication handled during the project?

All communication will come from your account manager. They will use a combination of email, video calls, phone and project management software.

Please Note: Support is only offered during UK business hours: Monday-Friday 09:00 am–17:00 pm

What is the termination policy?

Either party may terminate this agreement by providing at least 30 days written notice to the other party. In the event of termination by you (the client) before the completion of the agreed hours or the end of the term, an early termination fee equivalent to 50% of the remaining contract value may be charged. This fee compensates for planning and resource allocation made in anticipation of the full term of the agreement.

Upon termination, we’ll hand over all the project files to you and remove our credentials from any of your services.

We can also offer a transition service, either in-house or to another provider once the retainer period ends, including documentation and training for their staff.

How do you ensure the security and confidentiality of our data?

Here's how we ensure the security and confidentiality of our data

SSH-only connection

The servers we use can only be accessed via SSH, meaning the connection is limited to predetermined machines so even if the password was leaked, the server cannot be accessed.

No root connection

The server cannot be connected to via the root user, so sudo tasks cannot be performed without an SSH connection and additional password authentication.

Firewall

Uncomplicated Firewall (UFW) is installed and enabled, only allowing traffic on port :80 and :443

fail2ban

IP addresses of brute force attackers are automatically blocked from the server with fail2ban.

Updates

Ubuntu and any dependencies are updated once per month, and critical security updates are performed automatically.

Craft CMS

Craft CMS follow a lot of best practices related to security, which you can read about on their Security FAQ.

Particularly relevant is their use of CSRF tokens, encrypted cookies, HTML sanitisation, and granular user permissions. Passwords are also stored encrypted, not in plain text.

Honcho practices

Honcho also takes security seriously. Here are some of the ways we keep our and your data secure.

• All passwords are strong and stored in a password manager
• 2 Factor Authentication is enabled on all Honcho accounts where this is an option
• Structural changes to your website database are only enabled on local development
• Websites are only served over HTTPS

If an attack were to occur, what steps are in place after the fact to mitigate and minimise the damage?

In the event of a confirmed breach, we would shut down the server and redeploy your website to a fresh server – using the most recently database back-up.

As a precaution, we would also refresh any API keys and passwords.

How do we handle project prioritisation?

Your retainer project will be continuously scheduled in three months ahead – so we’re always prepared and have capacity to work on your project. We also factor into the schedule the ‘unknown unknowns’ – eg: emergency support requests, so that we can act on these in a timely manner.

In terms of your individual priorities, your account manager will work with you to clarify these for the team each month.

Are there specific technologies or platforms that you specialise in?

Yes : )

We only develop for Craft CMS.

Our current tech stack is:

Our server runs a LEMP stack, which is

• Linux (Ubuntu 20+)
• Nginx
• MariaDB
• PHP 7.4+

SASS / Cloud / Third Party Software

• DeployHQ for deployment
• Imgix for image optimisation and serving
• Sentry for error reporting
• Postmark for transaction emails
• Recaptcha for captchas

Software and code

• Craft CMS 3+ (based on Yii)
• Tailwind 2+ with SCSS
• Vanilla ES6+ JS
• Twig
• Blitz for static caching

Build tools and package managers

• Laravel Mix (which is based on Webpack)
• NPM
• Composer

What happens if we need to scale up our requirements temporarily?

We understand this can easily happen leading up to seasonal spikes or special events – and will be happy to accommodate given adequate notice; ideally at least 90 days.

Can we scale down services if necessary?

We want to give you the flexibility you need, so just like scaling up your requirements, you can also scale them down too. As before we’d be happy to accommodate given adequate notice; ideally at least 90 days.

Can we customise the retainer package to fit our specific needs?

If you have unique needs not covered by our retainer packages – we’d be more than happy to have a conversation to see if we can accommodate. Please see our other services to get a clear picture of what we do. Note: We’re NOT a marketing, SEO or PPC agency – but we do have partners we’d be able to recommend to you.

How do you handle feedback and revisions?

For transparency and accountability, all feedback and revisions are handled via our project management tool; Teamwork.

We'll give you access to this and train you on how to use it. All work is tracked and approved here too.

What is the process for emergency bug fixes or critical issues?

For emergency bug fixes or critical issues – please phone or email your account manager. They will then pass the issue on to the most qualified team member, who will then work to resolve the issue in the appropriate timeframe based on the severity of the issue.

See our target times;

Are there any long-term contracts involved?

The minimum contract commitment we offer is for 3 months.

How is the confidentiality of our projects ensured?

To protect any sensitive information within your business we’d be more than willing to sign a non-disclosure agreement (NDA).

What do we need to do to get started?

The first step is always a call – so we can find out what you need and how we can support you.

If we feel we can help, the next step would be to do a code audit. That would mean getting access to the code base, any scope or documentation you have, and (if possible) a conversation with the developer(s) that built the site.

Our code review will delve into:

• Craft CMS Setup
• Plugins
• Custom Plugins
• Routing
• Multi-site setup (if applicable)
• 3rd Party Connections / APIs

From there we’ll be able to estimate an onboarding cost.

What kind of input or resources will you need from our team?

This will be defined in full during the onboarding process but usually involves your technical lead, IT support or previous developers (when possible).

Typically to onboard a project successfully, we will need:

• Repository access – which should contain the following:
  • composer.json
  • Source files (scss, js, images)
  • package.json
  • Compiler config (gulpfile.js / webpack.js / mix.config.js / etc
• An Admin user to the Craft site
• Database backup (Could be via Craft Admin)
• SFTP details
• An export of any uploaded assets
• The .env file
• API keys for any external services
• DNS access or email access for someone who manages this
• Google Analytics access (if applicable)
• Any original artwork files (XD, Figma, PSD, etc)

Can you handle the transition from another service provider or take over an incomplete project?

Yes, we can take on incomplete projects started by another team – and pick up, complete and support that project.

Do you provide training for our team on the new updates or features developed?

Yes, we do. After implementing new features or systems, we’ll provide training and/or documentation for your team. These will live in an online portal so you can reference them any time you need.

What is your policy on intellectual property rights?

In short: You’ll own the markup, CSS and other code we create for you.

You’ll also own text content, photographs and other data you provided unless someone else owns them – and you’ll own the graphics and other visual elements that we create for you for this project.

How do you ensure the quality and testing of the developed solutions?

We have a thorough testing and quality assurance process. Nothing will ever get deployed without being fully tested internally – and then reviewed by you.

How do we handle changes in our business requirements during the retainer period?

Businesses evolve, and so do your needs. Once your retainer is in place – you’ll have regular contact with your account manager to discuss changes and requirements.

Can you integrate third-party systems?

Yes, we can integrate with third-party services and platforms.

Some recent services we’ve integrated Craft CMS projects with are:

• Sales Force
• Hubspot
• Xero
• Stripe
• Veeqo
• Active Campaign
• Campaign Monitor
• Mailchimp

How do you approach accessibility in web development?

Ensuring that websites are accessible to all users, including those with disabilities, is not only a best practice but also a legal requirement in many regions. All team members undertake accessibility training and adhere to WCAG 2.1 Compliant Development practices – which then get checked during our quality assurance process.

What strategies do you use for search engine optimisation (SEO) during development?

Whilst we are NOT an SEO agency, we’re experts in technical SEO – and understand the critical importance of having an optimised website that adheres to Google's recommendations and Lighthouse and PageSpeed Insights criteria.

We build with all the technical SEO foundations your marketing team will need to dominate search.

Can you manage multilingual websites?

Yes, we work with multilingual and multi-location Craft CMS installations.

Do you provide digital marketing integration services?

Yes, we do.

We have excellent business and marketing acumen and regularly work with marketing teams to produce landing pages for PPC and SEO, with tracking analytics and 3rd party CRMs, like Salesforce and HubSpot.

Can you support emerging technologies such as AI, blockchain, or IoT?

Yes, we can. Please get in touch to discuss your requirements.

Can you work with niche CMSs or proprietary systems?

Nope, sorry. We only use Craft CMS.

Can you provide case studies or references from similar businesses or industries?

Yes, absolutely.