Security updates
Applied on a schedule, not when somebody remembers. What changed is recorded.
Managed hosting and security
Caught while it is still degrading, not after it has stopped
Most outages announce themselves for days: a disk filling, memory creeping up, responses getting slower. Nobody is looking, so the first signal anyone gets is a customer saying the site is down. This service is the automation that looks, and that acts on what it sees before you would have noticed anything.
Watched continuously, without anyone asking
Disk space68 percentFilling
MemorystableHealthy
Response timep95 risingWatch
Certificate42 days leftHealthy
Backup and restore testlast nightPassed
Example of the shape, not of your numbers. Two amber rows here are a week of warning, not an incident.
Zerosupport tickets from clients since October 2025, on 10+ servers
Within 24 hoursmy response when an alert needs a person
Every monthyour own availability figure, in writing
Part of What keeps it all running
Recognise this
You need this if
- Nobody looks at the server until something has already stopped working.
- You have heard about downtime from a customer before you heard it from anyone else.
- The site once went red in browsers and it took a while to work out the certificate had expired.
- Backups run, but nobody has ever restored one to see whether they work.
- Security updates get applied when somebody remembers.
- The system is slower than it was, and nobody can say since when.
Kept secure
The maintenance that only shows up when it was skipped
Certificates
Renewed automatically, and checked from outside so a failed renewal is caught.
Dependencies
Libraries checked against known vulnerabilities, and updated when it matters.
Access
Reviewed periodically. People who left keep no way in, and neither do old keys.
Baselines
What normal looks like is measured, so abnormal is recognisable rather than argued about.
A written record
Every change to the server is logged, so a year from now the history still exists.
The point of it
Automation that reacts to a trend, not to an outage
Checking whether a site answers tells you it has already fallen over. The useful signals are the slow ones, the measurements that drift in the wrong direction for days before anything breaks. Those are measured automatically, every hour, whether or not anyone is thinking about your system that week.
- Disk filling, with an estimate of when it runs out
- Memory trending towards the point where the system starts killing processes
- Database connections approaching their limit
- The slowest few percent of responses getting slower week over week
- Certificates approaching expiry, well before the day
- A backup that did not run, or a restore test that did not pass
What a drifting signal looks like
Disk, four weeks ago41 percentHealthy
Disk, two weeks ago55 percentHealthy
Disk, today68 percentFilling
What that produces
Estimated fullin about 3 weeksAlert raised
Handledduring working hoursNo outage
Illustration. The same shape applies to memory, to database connections and to response time.
Automatic recovery
Most small faults never need me awake
A large share of what goes wrong on a server at three in the morning is recoverable without judgement. Those cases are handled by the machine, immediately, and I read about them afterwards.
- A stopped service is restarted, and the restart is recorded
- Logs are rotated before they can fill the disk
- If the application really is unreachable, visitors get a short maintenance page instead of a browser error
- Repeated failures stop the retry loop and escalate to me instead of hiding
One hard rule. Automatic recovery never deletes, edits or moves your data. It restarts things and frees space it created itself. Anything that touches business data waits for a person.
Overnight, no one involved
02:14WARN
02:14INFO
02:14INFO
03:00INFO
03:20INFO
03:41INFO
08:02INFO
From outside
A watcher on the same machine tells you nothing when the machine is gone
The checks run from separate infrastructure, in a different location. If your server disappears entirely, something that is not your server notices.
- Reachability checked from outside your network
- Certificate validity checked the way a browser sees it
- The domain and DNS watched, not only the application
- Measurements kept, so today can be compared with last month
Who is asking
Inside the server
Disk, memory, processes
Database and queues
Silent if the server is down
Outside, elsewhere
Does it answer at all
Is the certificate valid
Does DNS still resolve
Speaks when the server cannot
Backups
A backup nobody has restored is a hope, not a backup
Backups that run every night and have never been read back are the most common false sense of safety I find. Here the restore is exercised on a schedule, and the result is part of what you get in writing.
- Stored off the server it protects, and encrypted
- A restore performed on a schedule, into an isolated environment
- The result recorded, including failures
- Retention agreed with you, not left at whatever the tool did by default
BackupState
Runs every nightYes
Kept off this serverYes
Encrypted at restYes
Restore actually triedOn a schedule
Result written downIn the monthly report
How far back you can goAgreed with you
Evidence
You should be able to see what you are paying for
The hardest thing about a service like this is that when it works, nothing happens. So every month you get a short written record of what was done, whether or not anything went wrong.
- Availability over the month, measured from outside
- Incidents, with what caused them and what was changed
- Updates applied, and to what
- Backup and restore test results, including any that failed
- What is trending in the wrong direction, and what I suggest doing
Monthly recordContains
AvailabilityMeasured
Incidents and causesListed
Updates appliedListed
Backup and restoreResult
Trending the wrong wayWith a recommendation
Nothing to reportAlso said plainly
What I actually promise
I would rather be believed than sound impressive
Plenty of providers advertise a response inside the hour. This practice is early in its life, and I will not sign a commitment before I can prove I keep it. So the promise is 24 hours, and the work goes into making 24 hours a comfortable margin instead of a risk.
That is what the automation is for. A problem caught while it is still a trend gives you days to act, not minutes. Since October 2025, no client has needed to open a support ticket. That is across 10+ servers I operate, dedicated and shared VPS.
Availability has two halves. One belongs to the provider whose machine it is, and no monitoring changes that half. The other is the application, the disk, the certificate, the database, and that half is mine. I do not advertise a number for either. You get yours, measured, every month.
If your situation genuinely needs someone reachable within minutes at any hour, say so early. I will tell you that this is not the right service, rather than sell it to you.
- Monitoring runs continuouslyChecks and measurements do not stop outside working hours.
- Automatic recovery acts at any hourRestarts and cleanups happen the moment they are needed, without me.
- I respond within 24 hoursWhen an alert needs a person, that is the commitment, from the moment it is raised.
- You get it in writing every monthWhat happened, what was updated, what needs attention.
- No response inside the hourA faster commitment is one I would rather earn than advertise.
- No signed uptime percentagePart of that number belongs to your provider, not to me. I publish what actually happened instead.
Support tickets counted across the systems I run, on 10+ servers, dedicated and shared VPS, from October 2025 to today. Availability is measured per system, from outside the server, and reported to you every month rather than advertised here. Maintenance windows are announced in advance and excluded, as they are in any provider's figure.
How it runs
From launch to a system somebody is actually watching
Baseline
We measure what normal looks like for your system, so abnormal can be recognised.
Instrument
Checks from outside, measurements from inside, alerts set where they mean something.
Automate
The faults that need no judgement are handled by the machine, and recorded.
Report
Every month, in writing: what happened, what was done, what needs a decision.
The aim is fewer incidents, not faster apologies
How it is sold
Two things to settle before the price
Monthly, per applicationA subscription for one system on one environment, cancellable. The provider costs for the server stay in your name and are not part of it.
Built by me, or audited firstI can only promise to protect something I understand. If your system was built by someone else, that is not a no: we start with an audit, I tell you what I found, and then we both decide whether this plan makes sense.See what an architecture review covers
Not sure this applies to you yet? See how infrastructure and deployment work
Questions
Frequently asked questions
Do you offer 24/7 support?
Monitoring and automatic recovery run at all hours, every day. What is not round the clock is the human response: when something needs a person, the commitment is 24 hours. This practice is early in its life and I would rather earn a faster commitment than advertise one. In exchange, the effort goes into catching problems days before they become outages. Since October 2025 that has meant no client needing to open a support ticket.
Can you take over a system built by someone else?
Possibly, but not on day one. Watching a system I have never read would mean promising something I cannot stand behind. So it starts with an audit: how it is built, how it is deployed, what state the server is in, what would happen if it fell over tonight. You get that in writing whatever we decide afterwards. If it turns out to be something I can look after honestly, we go ahead. If not, I will say so, and you still keep the audit.
What if the hosting provider itself has an outage?
Then the system is down for as long as they are down, and no monitoring changes that. What you get is knowing immediately, knowing it is not your system, and having a backup that has been restored before, in case it becomes worse than an outage.
Does this include new features?
No. This keeps what exists running, updated and backed up. Changing what it does is separate work, and it goes through the same route as everything else: development first, your approval, then production.
What happens if I stop the subscription?
The system keeps running. It is on your server, in your account, with your code. What stops is the watching, the updates and the reporting. I will tell you plainly what you are taking on.
Where are the backups kept?
Off the server they protect, encrypted, at a location agreed with you. You can be told exactly where, and you can hold a copy of the keys.
Will you look at our data?
Only what is necessary to keep the system running, and only when there is a reason. Diagnosis starts with logs and measurements. Anything beyond that is discussed with you first.
How is the price set?
By how much of the system needs watching, not by how many visitors it has. One application on one environment is one subscription. You get the figure before you commit to anything.
Want to stop finding out from your customers?
Tell me what you are running today, and I will tell you what would actually be watched.