Question 1

Where is our data physically located, and can we pin it to a region?

Accepted Answer

Default routing is a tier-1 global edge network: each visitor is served from the closest of 330-plus edge datacenters worldwide. Origin compute and persistent storage default to Asia-Pacific (Singapore) for new accounts. If you require EU-only residency for GDPR Article 44, AU-only residency for IRAP or APRA CPS 234, or US-only residency for HIPAA proximity, we configure jurisdictional pinning at provisioning and document it in the MSA. We do not move your data between jurisdictions without a signed change request.

Question 2

Who has access to our production environment, and how is that access controlled?

Accepted Answer

Production access is restricted to the senior engineering team on the account. All authentication is through Google Workspace SSO with hardware-key 2FA required (YubiKey or equivalent). Every access event is logged to an immutable audit trail with 12-month retention. We do not share credentials with subcontractors. Database access is gated behind a zero-trust access proxy. Your team can request an access-log export at any time at no cost.

Question 3

What is the SLA, and how is it measured?

Accepted Answer

99.99 percent monthly uptime. Measured by synthetic HTTP checks every 60 seconds from at least four geographies (Singapore, Frankfurt, Sydney, Virginia). A request counts as failed when two consecutive checks from two different geographies both fail. A scheduled-maintenance exclusion window of 4 hours per quarter applies, announced 14 days in advance. If we miss the SLA in a billing month, credits apply automatically: 99.9 to 99.99 returns 10 percent of that month's fee, 99.0 to 99.9 returns 25 percent, below 99.0 returns 50 percent. The full schedule sits in section 4 of the standard MSA, available on request.

Question 4

What is your incident response process and recovery target?

Accepted Answer

Recovery Time Objective is 4 hours for total origin failure. Recovery Point Objective is 24 hours, set by the daily off-site snapshot held in a separate provider and region. Alerts page the on-call engineer within 60 seconds. Initial human response: under 15 minutes business hours, under 60 minutes overnight. Status updates land on your dedicated status page within 30 minutes of acknowledgement. A written post-mortem is delivered within 7 working days of resolution, including root cause analysis and remediation timeline.

Question 5

How do you handle backups, and have they been verified to restore?

Accepted Answer

Two backup tiers. Tier 1: hourly incremental snapshots retained for 7 days on the primary provider in a separate region. Tier 2: daily full snapshots replicated to an independent second-provider object store in a different region, retained 30 days. We run a scripted restore-to-staging on the first Monday of each month and log the result (pass or fail, restore duration, data-integrity hash match). The log is available to your team on request. Named providers are disclosed in the sub-processor list available on request. If you require quarterly third-party verified restore drills, this is scoped into the Care tier.

Question 6

What does your migration plan look like for a complex site?

Accepted Answer

Standard migration is seven working days. Day 1: discovery, site inventory, dependency audit, DNS registrar access verification, performance baseline. Days 2 to 3: clone to staging, smoke test, surface any silent breaks from your current host. Days 4 to 5: security hardening pass (WAF rules, header policy, CSP), performance tuning, automated regression coverage on the top 20 URLs. Day 6: soft launch behind feature flag at 10 percent of DNS, monitor for 24 hours. Day 7: full DNS cutover during your lowest-traffic window with both teams on a video bridge. Rollback path: under 15 minutes via DNS revert. We keep your previous origin warm for 30 days at no charge.

Question 7

Can we run our own penetration test or security audit?

Accepted Answer

Yes. You may engage any reputable third party for black-box or grey-box testing. We require 14 days notice and a signed Rules of Engagement document. We provision a staging environment with production-equivalent data for the test. Findings are triaged jointly: critical and high within 7 days, medium within 30, low within 90. We do not charge to remediate findings on infrastructure under our control. We will also accept your team's own security questionnaire and return it within five working days.

Question 8

What happens if we want to leave?

Accepted Answer

Thirty days written notice. On day 1 of the notice period we provide: full database export (gzipped SQL), complete code repository transfer or fresh git push to your preferred remote, file storage archive, DNS zone export (BIND format), email-routing configuration documentation, and access logs. We support your engineering team during cutover to a new provider for up to 8 hours at no charge. We do not retain your data beyond 30 days post-departure unless legally required to do so for audit purposes, in which case we will tell you which jurisdiction is compelling retention.

Question 9

Are you SOC 2 or ISO 27001 certified?

Accepted Answer

No. FYI Digital is not independently SOC 2 Type II or ISO 27001 certified. The underlying infrastructure providers we deploy on top of hold both certifications: our primary edge and compute provider carries SOC 2 Type II, ISO 27001, ISO 27018, and PCI DSS Level 1; our off-site backup provider carries SOC 2 Type II. We can provide our internal information security policy, the full sub-processor list, our DPA, and a completed vendor security questionnaire. If formal certification of FYI Digital itself is a hard procurement requirement, we will say so upfront rather than waste your time.

Question 10

What is your sub-processor change notification policy?

Accepted Answer

Our sub-processor list is published and versioned. We give 30 days advance notice via email to your designated security contact before adding or removing a sub-processor that handles your data. You retain a contractual right of objection during that window. The current list covers edge compute and storage, DNS and WAF, off-site backup, transactional email delivery, and error monitoring. The named providers and their function are disclosed in full on request.

Question 11

Can we own the underlying infrastructure account ourselves?

Accepted Answer

Yes. We operate in either of two models. Managed-on-our-account is the default: we hold the underlying infrastructure account, you hold the service contract with us. Bring-your-own: you hold the infrastructure account directly with the upstream provider, grant us a scoped admin role, retain ownership of DNS and account-level settings, we operate inside your boundary. Bring-your-own costs the same. We recommend it for organisations over 50 staff or where the legal team requires a direct vendor relationship with the infrastructure layer.

Question 12

How should we evaluate you before signing?

Accepted Answer

Send us a staging or low-traffic site to migrate as a 30-day trial. We will move it, run it, and write a closing report at day 30 covering uptime, performance, security findings, and the open questions either side surfaced. If you continue, the trial counts as the first month of service. If you do not, you keep the work product and we hand the site back to your previous host or a new provider. We do not consider this a loss leader. It is the cleanest way for a serious buyer to evaluate hosting without taking our word for anything.

Managed hosting and website care, for any site, anywhere in the world.

We are a small senior team running serious infrastructure for clients who would rather not run it themselves.

The capability layer behind every site we host.

The defaults that should be defaults everywhere.

The credit schedule. Written down.

Seven working days. No surprises.

Pick a low-traffic site. Give us 30 days.

A short list, kept honest.

Senior engineers. Direct lines.

Questions we get on vendor questionnaires.

Send us your current setup. We send back a written scoping document within two business days.