A monthly subscription that includes the build, the hosting, the maintenance and a named operator is a structurally different product from a quote-on-quote agency rebuild. The economics differ. The exit costs differ. The legal posture differs. The risks if the vendor disappears differ.
This guide gives you the nine questions I would ask before signing a £495/mo (or thereabouts) infrastructure subscription. They are the questions I would ask of my own service, and the ones I expect prospective clients to ask me. If a vendor cannot answer all nine in writing, the subscription is not infrastructure. It is a hostage arrangement with a recurring invoice.
The number £495 in the title is illustrative. The questions hold at £195, at £1,495, and at £6,000. They scale.
01Why subscription beats one-off, and when it doesn't
A one-off rebuild assumes the operator's role ends at launch. In practice, the website is alive, the operating system underneath updates monthly, the SSL certificate rotates every 90 days, the form vendor changes its DPA, the host raises prices, the framework's security patches arrive at 11pm on a Thursday. Someone has to be on call.
A monthly subscription that includes infrastructure custodianship, hosting + monitoring + DNS + named operator + minor changes, folds those running costs into a predictable invoice. The economics are usually better than they look: a £495/mo subscription is £5,940/year, which is below the cost of two emergency dev-shop hours per month at market UK rates.
Subscription does not beat one-off when:
- The vendor uses "subscription" as a label for an over-priced retainer with no infrastructure.
- The vendor holds the source code in a way you can't transfer out.
- The named operator is "the team" rather than a human you can ring.
- The cancellation terms make leaving more expensive than rebuilding.
The nine questions are designed to surface those four failure modes.
02The nine questions, in order
| # | Question | What you're protecting |
|---|---|---|
| 1 | What is the uptime SLA in writing? | Reliability |
| 2 | Where is the source code, and what's the escrow? | Continuity |
| 3 | What is the cancellation notice and what do I get? | Exit rights |
| 4 | Who is the named operator, contractually? | Accountability |
| 5 | Where does my data sleep? | Sovereignty |
| 6 | If the developer disappears tomorrow, what do I do? | Survival |
| 7 | What's the price ladder over the next 36 months? | Cost predictability |
| 8 | What's in scope each month, in numbers? | Value |
| 9 | What does month 13 look like? | Long-term fit |
Ask all nine. Reject any vendor that cannot answer at least seven on first read.
03Question 1, Uptime SLA in writing
A real SLA has four components:
- Target, 99.9% (43m/month down), 99.95% (21m/month), or 99.99% (4m/month).
- Window, measured calendar-monthly, or rolling 30-day, or 365-day.
- Credit, what you get if missed. 10% of monthly fee per 0.1% below target is reasonable.
- Exclusions, scheduled maintenance windows, force majeure, your DNS, third-party services upstream.
Acceptable answer: "99.9% calendar-monthly, measured by an external probe, 10% credit per 0.1% miss, exclusions listed in section 4 of the MSA."
Walk-away answer: "We aim for 100%" or "uptime is a best-efforts commitment". Both mean the vendor has not put a number in writing.
A note on 99.99%: for most UK SME sites, 99.95% (21 minutes a month) is the right target. 99.99% (4 minutes) implies a multi-region failover that costs an order of magnitude more, pay for it only if downtime literally costs you bookings.
04Question 2, Source-code escrow and ownership
The right answer has three parts:
- It lives on a platform you can access, GitHub, GitLab, Bitbucket, or a private Forgejo/Gitea instance. You can log in. You can see the commit history. You can clone.
- You own the repository, not the vendor, your organisation has admin rights. The vendor has push access. When you leave, the vendor's push access is revoked and you still own the code.
- Escrow exists for the vendor's death case, if the vendor cannot transfer access (sudden death, bankruptcy, dispute), an independent escrow service or a code-deposit clause releases the latest production build to you within N days.
Acceptable: "Repo lives in your GitHub Organisation; we have collaborator access; you keep admin; on cancellation we hand over the deploy keys and remove our access within 7 days."
Walk-away: "We host the code on our internal repo and we'll send you a zip if you leave." (The zip is months old, doesn't include the deployment config, and may exclude the secret management.)
05Question 3, Cancellation rights and notice
This is the single most commonly mis-aligned clause in agency subscriptions. The vendor wants long notice + exit fees. You want short notice + no penalty for leaving with the assets.
The line I would draw:
- Notice period: 30 days, calendar, no longer. Anything above 60 days is hostile.
- Exit fees: none. A subscription that bills you to leave is a loan with a balloon payment, not a service.
- What I take: the source code, the database export, the DNS records, the form-vendor admin transfer, the email-host admin transfer, the deploy configuration. In writing.
- Transition support: N days of paid migration help if I need it. Optional. Not coerced.
Acceptable: "30 days notice. No exit fee. On the last day we transfer all admin to you and remove our access. £150 per hour if you want migration support; otherwise zero."
Walk-away: "6 months notice" (effectively locks you in) or "exit fee equal to 3 months of subscription" (penalty for leaving) or "we keep the code" (the asset isn't yours).
06Question 4, Named operator, contractually
A subscription with no named operator is a subscription with a help-desk queue. When the site falls over at 11pm, "the team" does not answer the phone, a specific human does, or doesn't.
Insist on:
- The named operator's full name in the master service agreement.
- Their direct mobile number, not the company switchboard.
- An escalation path, who do you call when the named operator is on holiday?
- A successor clause, if the named operator leaves the vendor, what happens? (For a small vendor, this is fragile; insist on the source-code escrow + 30-day exit as the safety net.)
Acceptable: "Jordan Gilbert. +44 7553 070841. Email hello@ukwebmarketing.com. If I'm unavailable >24h, the deputy is documented in section 9 of the MSA. If I leave the company, you have a 60-day option to terminate without notice."
Walk-away: "Our support team" or "we'll assign an account manager". Account managers route tickets. They do not fix sites.
07Question 5, Where does my data sleep?
The Schrems II judgment (CJEU, July 2020) made transfers of EU/UK personal data to the US a structural problem. For a UK SME, especially a regulated one (clinic, law firm, financial advisor), data residency is a compliance question, not a preference.
The answer should list, for each:
| Asset | Vendor | City/Region | Jurisdiction |
|---|---|---|---|
| Production database | (e.g. Hetzner) | Falkenstein, Germany | EU (DE) |
| Backups | (e.g. Backblaze B2 EU) | Amsterdam, Netherlands | EU (NL) |
| Application logs | (e.g. Better Stack) | Frankfurt, Germany | EU (DE) |
| Email transactional | (e.g. Postmark EU) | Frankfurt, Germany | EU (DE) |
| CDN | (e.g. BunnyCDN EU-only) | EU POPs only | EU |
| Error tracking | (e.g. Sentry EU) | Frankfurt, Germany | EU (DE) |
If the vendor cannot produce that table in 24 hours, they do not know.
08Question 6, What happens if the developer disappears?
A good vendor has answered this on paper before you ask. The answer should cover:
- Code access: how the source-code escrow releases (see Question 2).
- Hosting access: how the registrar, DNS, hosting accounts transfer. Often via a sealed envelope held by a named third party, the vendor's solicitor, a notary, a separate director.
- Documentation: a runbook that a competent developer can read and bring the site back up. If the runbook does not exist, the vendor has not thought about this.
- Continuity time: how long the site continues to run on its own before manual intervention is needed. (For static-hosted sites, usually weeks or months. For dynamic sites, days, at best.)
A reasonable answer: "Code is in your GitHub Organisation; you have admin. Hosting credentials live in a 1Password vault you co-own. Runbook is in docs/runbook.md in the repo. The site is static-hosted on Vercel and will continue to serve indefinitely without any of us. If something dynamic breaks (forms, payments), it's a 2-day job for any competent Next.js developer, and the runbook tells them exactly what to do."
A bad answer: "I'm not going anywhere."
09Question 7, What's the price ladder going to be?
A subscription with a soft promise of "we won't raise prices much" raises prices. The right answer pins the ladder.
Options that work:
- Locked annually: the price is frozen for 12 months; renewals are agreed in writing 60 days before the anniversary.
- CPI-linked: the price rises by UK CPI annually, capped at 5%. Predictable, fair, defensible.
- Tier-locked: the price is fixed for the duration of the tier; moving up the ladder is the only price increase.
Walk-away: "We review pricing annually" with no formula. That's a unilateral right to raise.
10Question 8, What's in scope each month, in numbers?
"Unlimited support" is a marketing phrase. It is not a contract term. A real scope statement has numbers.
For a £495/mo tier I would expect roughly:
- 1 named operator on call during working hours.
- 99.9% uptime SLA (Question 1).
- Monthly OS / framework / security patches applied.
- 1 substantive content or feature change per month (1–4 hours of dev time).
- Form changes, copy edits, image swaps as needed (no overage up to N units).
- Quarterly performance + accessibility review.
- Annual penetration / dependency audit.
If the vendor says "unlimited", reframe: "If I send 50 substantive change requests in a month, what happens?" The honest answer is some form of fair-use or overage. That is fine. The honest answer is the one you want.
11Question 9, What does month 13 look like?
Subscriptions decay. The first year is exciting, there's a build, a launch, a settling-in. By month 13, both sides have run out of obvious things to do. Either the subscription has matured into a long-term operating partnership, or it has become a £495/mo invoice for nothing.
A good vendor has an answer:
- Year two is custodianship and growth. The growth work shifts from build to optimisation, content depth, conversion testing.
- Year three is platform evolution. The framework is upgraded major-version; the integrations are revisited; the design is refreshed.
- Year four is review. Are we still the right vendor? An honest vendor offers to re-tender themselves.
Walk-away: "It's the same as year one." If month 13 is the same as month 1, you are paying maintenance fees for a build that should have ended in month 3.
12The red-flag answer sheet, patterns to walk away from
| Pattern | What it means |
|---|---|
| "We aim for 100% uptime" | No SLA, no remedy when it falls over. |
| "We host the code; we'll send you a zip" | You don't own the asset. |
| "6 months notice to cancel" | Locked-in by attrition. |
| "We'll assign an account manager" | No named human. |
| "We're proudly hosted on AWS" (no region) | They have not thought about Schrems II. |
| "We don't have a runbook, it's all in our heads" | The bus-test fails. |
| "We review pricing annually" (no formula) | Unilateral price right. |
| "Unlimited support" | No scope, no accountability. |
| "Year two is more of the same" | You're paying to stand still. |
| The vendor cannot answer 7/9 in writing within a week | They are not infrastructure operators. They are a body shop with a marketing site. |
Closing, the £495/mo case in one paragraph
A £495/mo infrastructure subscription is worth it when it answers all nine questions affirmatively and in writing. At that point, you have folded the running cost of a website, hosting, monitoring, DNS, named operator, monthly maintenance, one substantive change per month, into a single predictable invoice that costs less than two emergency agency hours a month. Below that bar, "subscription" is just an upsell on a retainer.
UK Web Marketing publishes its own answers to all nine questions in the master service agreement before either side signs. If you would like to read ours, ask. The people who wrote this guide reply, same hour, during working hours.
Sources + further reading
- ICO, International transfers and Schrems II ·
ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/international-transfers/ - CJEU C-311/18, Schrems II judgment ·
curia.europa.eu - UK Cabinet Office, IT escrow guidance ·
gov.uk/guidance/escrow-agreements - NHS England, Data Security and Protection Toolkit ·
dsptoolkit.nhs.uk - UK Office for National Statistics, CPI rate ·
ons.gov.uk/economy/inflationandpriceindices