Host
Somebody has to be awake
Managed hosting and support for applications and websites on infrastructure we operate. Every client is a distinct workload: its own inventory entry, its own backup schedule, its own restore test, its own named owner.
What the service actually contains
Monitoring and alerting
Availability and error-rate monitoring with an alert route that ends at a person, not a dashboard nobody opens.
Patching and vulnerability management
A patch cadence by severity, and a record of what was patched when, which is the thing an auditor or a client security review actually asks for.
Backup and tested restore
Backups are a hypothesis until restored. Restore tests are scheduled, performed and recorded, with the RPO and RTO stated per tier.
Incident and major incident handling
Classification, response, communication and a post-incident record. Where personal data is involved, notification to you as controller follows the Article 33(2) route without undue delay.
Planned maintenance
Announced windows, an agreed change route, and an emergency route that is still controlled.
Support that knows the system
First line, second line and the engineers who built it are three phone calls in most companies. Here they are one team.
One thing we will not do
We will not quote you an availability figure for a period in which nothing was measuring. Service tiers, SLA measurement definitions and restore records begin on the date they begin, and we will tell you that date. Back-filling a service record is falsification, and it is prohibited by our own management system.
- ISO/IEC 27001:2022ISO/IEC 27001:2022In progress
- ISO 9001:2015ISO 9001:2015In progress
- GDPR / AVGGDPR / AVGLegal obligation
- NIS2 / CyberbeveiligingswetNIS2 / CyberbeveiligingswetLegal obligation
- ISAE 3000 / 3402ISAE 3000 / 3402Planned
- NEN 7510NEN 7510Planned
- ISO/IEC 42001 & the EU AI ActISO/IEC 42001 & EU AI ActPlanned
FAQ
Often yes, after an onboarding assessment. We need to see what we are being asked to keep alive: dependencies, access, backups, and whether it can be restored at all. If it cannot be supported safely we will say so before taking the contract, not after.
In the EEA. Any transfer outside it requires the EU standard contractual clauses and a transfer impact assessment, and our sub-processor register is disclosable to clients.
A named, reviewed set of people, under a privileged access procedure with periodic access reviews. Everyone with production access can technically read client personal data, which is precisely why the list is short and reviewed.
Tell us which work takes too much time
That is usually the most useful first conversation. Whether the answer is a new system, an AI agent, an integration between what you already have, or nothing at all, you get an honest assessment.