Hosting you can put in front of a compliance team.
Compliant Hosting is for organizations that must keep a WordPress or custom web estate and prove how it is controlled: regulated bodies, government, financial co-operatives, and the agencies that serve them. Choose the tenancy that fits, add the compliance module your regulator requires, and get documentation your auditors can hold in hand. Operated by the same small team, on the same hardened stack, for 18 years.
What are you protecting?
Compliance is driven by the kind of data you hold, not by a tier you climb. Pick the driver that fits, on either tenancy. Most regulated buyers need more than one, and the modules stack.
Cardholder data
You take payments. We enforce a hosted or tokenizing gateway so no card data is stored at rest, segment the environment, run quarterly external scans, and hand you the SAQ-A readiness pack and a hosting-side responsibility matrix.
Scope a PCI engagement →Personal & citizen data
You hold members', customers', or citizens' personal records. We deliver encryption at rest with managed key custody, upload-dir hardening, retention enforcement, a breach-response SLA, and a signed DPA. Aligned to the Barbados DPA 2019, GDPR, and the Cayman DPA.
Scope a Data-Protection engagement →Whole-org assurance
Your board or a procurement team wants a recognized standard. We map our controls to ISO 27001 Annex A and SOC 2 TSC, run continuous evidence collection and machine-speed defense, and give you a signed security addendum now and the certificate when it lands (target Q1 2027).
Scope an ISO 27001 engagement →Not sure, or need two of these? That is the normal case. Tell us what you hold and we will map it to the right tenancy and modules on a call.
Compliant Dedicated
A dedicated, single-tenant UpCloud cloud server for data that should not sit on shared infrastructure: sovereign records, financial-institution data, high-assurance estates. A scoped environment built to your requirements on a discovery call, not bought from a cart.
Single-tenant, sized to your workload
A dedicated environment built to your compliance requirements, with the documentation and assurance an institutional auditor asks for. One tier to start, sized to you.
- Dedicated single-tenant cloud server, sized to workload
- Signed security addendum (ISO 27001 Annex A + SOC 2 TSC)
- At-rest encryption, key custody, immutable audit logs
- UK or EU residency, signed DPA and SCCs
- Machine-speed defense, named incident-response contact
We lead with controls you can audit, not a logo.
A certification badge is a snapshot. What your compliance team can actually test is the set of controls a provider operates and can evidence on demand, and how fast it responds when something moves. That is what we put first. Today WebOps operates a documented control set, backed by a signed security addendum mapping each control to ISO 27001 Annex A and SOC 2 TSC, on infrastructure that is itself ISO 27001 certified and PCI-DSS compliant.
We are equally direct about the rest: WebOps does not yet hold its own ISO 27001 certificate, and we are on a funded roadmap to earn one, targeted for Q1 2027. Until then, the addendum, our controls documentation, and our independent vulnerability-scan and penetration-test results are evidence your auditors can hold in hand, not a promise to take on faith.
The things an institutional auditor asks for.
Built on the stack we already run, hardened and documented for buyers whose data carries a regulatory obligation. Available on either tenancy; the depth scales with the module and the box.
Compliant Shared, or Compliant Dedicated?
Both run the same hardened, documented stack and take the same regime modules. The difference is isolation and the depth of the assurance — pick by the sensitivity of the data and what your auditor requires.
| Capability | Compliant Shared | Compliant Dedicated |
|---|---|---|
| Hardened, fully managed WordPress stack | ||
| WAF, intrusion detection, malware scanning, encrypted backups | ||
| Encryption at rest + signed DPA | ||
| Stack PCI / Data-Protection / ISO 27001 modules | ||
| Tenancy | Segmented multi-tenant | Single tenant |
| Tenant isolation standard | PCI-DSS Appendix A1 | Dedicated cloud server |
| Immutable audit logging | Shared retention | 1-year, dedicated |
| Named incident-response contact | Standard SLA | Named + elevated SLA |
| Quarterly vuln scans + annual pen test | On request | Included |
| ISO 27001 certification roadmap | Via ISO module | Target Q1 2027 |
| Price | From $350/mo + modules | From $1,995/mo |
The disclosure-to-exploitation window is now minutes.
Vulnerabilities are discovered and weaponized at machine speed. A host relying on a human on call responds in hours. Ours watches New Relic alerts, parses access logs, fingerprints attack patterns, and drafts fleet-wide mitigations continuously, so we respond at the speed the threat actually moves. The guardrail is deliberate: additive, reversible defenses can deploy automatically, but anything destructive or fleet-wide is reviewed by a person first. That boundary is what makes machine-speed defense safe enough to put in front of a private bank.
From discovery call to documented go-live
No surprises for your compliance team. Each step produces something they can review.
We scope your requirements
A call to understand the buyers, the data, the regulatory frame (Cayman DPA, GDPR, PCI, sector rules), residency requirements, and what evidence your compliance team needs to see. That call decides the tenancy and the modules.
We provision and harden
Shared-segmented or single-tenant in your chosen region, at-rest encryption and key custody configured, audit-log shipping enabled, controls documented, security addendum and DPA drafted for signature.
We migrate, then keep the evidence flowing
Zero-downtime migration, named incident-response contact assigned, continuous evidence collection running. Surveillance and the ISO 27001 program proceed from there.
Let's scope your environment.
A discovery call, an honest read of what your compliance team needs, and a scoped build on the right tenancy with the right modules. If we are not the right fit for your requirements, we will tell you, and point you toward who is. Sourcing regulated or high-net-worth clients as an agency? We host the compliant layer and you keep the relationship.
