We protect the sites we host and the data they hold.
When an organization hands us its website, it hands us the accounts its staff sign in with and the trust of everyone who visits. We adopted three written security policies in October 2026 so that none of that rests on memory, and your IT team is welcome to a copy of each.
We host client WordPress sites on WP Engine in Montreal.
Our clients’ sites sit on WP Engine’s managed WordPress platform in its Montreal region, which runs on Google Cloud. WP Engine holds SOC 2 Type II attestation and ISO/IEC 27001:2022 certification, and an outside firm tests its platform for vulnerabilities every year. Each site has development and staging copies beside the live one, so we test every change before the public sees it.
We can hold the hosting agreement for a client, or the client can hold it directly.
Everyone on our team signs in with multi-factor authentication.
Multi-factor authentication is on for every account that supports it, including email, file storage, hosting, WordPress, code repositories and domain registrars. Each person signs in with their own account and reaches only the projects they work on. Passwords live in a password manager and never travel by email or chat. We remove a person’s access within one business day of their leaving a project. Our laptops use full-disk encryption and install updates automatically.
We work to written security policies.
Our information security policy sets the rules for the accounts and devices we use on client work. The incident response plan says who does what when something goes wrong, and our secure development lifecycle governs how code gets reviewed and released.
A senior developer approves every change to a client site’s code before it goes live. We apply WordPress and plugin updates each month after testing them on staging. Security releases go out within 48 hours, or on the same day when attackers are already using the flaw.
We follow a written plan when something goes wrong.
Our incident response plan sorts each incident by how serious it is and sets a response time for each level. When a site we look after is down or under attack, we respond within two hours and tell you as we start. If personal information may be involved, we tell you straight away so you can meet your own legal obligations.
Within two business days of resolving an incident, we send you a written report on what caused it and what we’ve changed so it doesn’t happen again. We test each site’s restore on staging while we build it and at least once a year while we support it.
We tell you where your site’s data lives.
Each site’s files, database, backups and logs stay on WP Engine’s servers in Montreal, and everyone on our team lives and works in British Columbia. Some parts of the service reach beyond Canada by their nature. The delivery network keeps copies of published pages on servers around the world so they load quickly for visitors, and WP Engine’s support staff in Texas and Ireland can reach a site’s servers to troubleshoot it.
This site sets no cookies.
Vercel Web Analytics counts our page views without cookies and keeps nothing that could identify you. Adobe Fonts serves the typefaces and counts page views for font licensing, and it sets no cookies either. Films load in Vimeo’s player only after you press play, with Vimeo’s do-not-track setting on. A 360° tour loads from the server that hosts it once you choose to open it.
The choices you make in Settings stay in your browser’s storage on your device. The site’s functions run in Vercel’s Montreal region, and since you reach us by email or phone, the site has no forms.