Quick answer
If you hire a small studio to build and run your website, insist on a short, clear service agreement covering: an availability target and how it is measured; response and resolution times by severity and whether they apply out of hours; a backup and recovery regime that includes offsite copies and recovery testing; who is responsible for data and an explicit data‑processing addendum (DPA); and practical exit/transfer terms so you can move hosting, domain names and content without delay. These items protect availability, help you recover from incidents (including ransomware) and set expectations on liability and cooperation.
For backup practice and the need to test recovery, follow the NCSC guidance to keep reliable copies of business‑critical data and to practise recovery so you can be confident data is restorable (NCSC).
Minimum SLA terms to insist on
Keep SLA language short and measurable. Avoid vague promises such as “we’ll keep the site up”. Include these minimum elements.
- Availability target: state a clear percentage (for example, measured monthly) and the components covered (hosting, application, DNS). If certain third parties are excluded (CDN, external payment gateways), name them.
- Measurement window: define how uptime is measured (UTC or local time, monthly calendar, and acceptable monitoring sources). Specify the monitoring method you’ll accept (external HTTP checks, synthetic transactions).
- Maintenance windows: specify permitted windows for planned maintenance (days/times), minimum notice for planned downtime and whether maintenance is excluded from uptime calculations.
- Notice periods: require written notice for planned changes that affect service or availability (email plus ticketing record) and minimum lead times for major changes, e.g. two weeks for infrastructure changes that cause downtime.
Response and resolution tiers
Define severity levels so both parties know expected reaction times. A practical set for a small supplier:
- Critical (Severity 1): site offline or major payment/checkout failure affecting customers — initial response within 1 hour (24/7), and an estimated time to restore or a published workaround within 4 hours during business days. Resolution times can be best‑effort; use regular updates until resolved.
- Major (Severity 2): partial outage or degraded performance affecting many users — initial response within 4 business hours, target resolution within 48 hours.
- Minor (Severity 3): content updates, minor bugs, non‑urgent requests — response within 2 business days and agreed scheduling for resolution.
Be realistic: smaller studios may not offer 24/7 engineering. If you need out‑of‑hours cover, negotiate a retainer or on‑call fee rather than relying on ad‑hoc promises.
Backup and recovery expectations
Your SLA should state the backup frequency, retention policy and where backups are stored. Minimum expectations:
- Backup frequency: daily backups for content and databases if you publish frequently; more frequent snapshots for high‑transaction sites.
- Retention: keep at least 30 days of backups and a longer archival copy for historic recovery (e.g. 12 months) depending on your needs.
- Offsite and immutable copies: store backups separately from the live environment to reduce ransomware risk; immutable or versioned backups are preferable where supported.
- Recovery testing: require periodic, recorded recovery tests (restore to a staging environment) to verify backups actually restore. The NCSC recommends practising recovery so you can be confident data is restorable (NCSC).
Data protection and processor obligations
If the studio processes personal data on your behalf, you are likely the controller and they are the processor. The contract must include a DPA that reflects UK GDPR requirements. At minimum:
- List what data is processed and permitted purposes.
- Require written approval for subprocessors and a public subprocessors list or advance notice of changes.
- Set breach notification times (e.g. inform the controller without undue delay and provide assistance to meet controller obligations to authorities and data subjects).
- Require cooperation on DPIAs, data subject requests and returning/deleting data on termination.
For statutory details on controller/processor contract elements and liabilities, refer to ICO guidance (ICO).
Practical contract checklist and template clauses
Use this one‑page checklist in briefs or tenders, and ask the supplier to include the following short clauses in the contract.
- KPIs & reporting: Monthly uptime report and incident log within five business days of the month end.
- Monitoring: Continuous external HTTP(s) checks; alerting to named contacts via email and ticketing system.
- Change control: All non‑emergency changes to be scheduled with at least 10 working days' notice and rollback plans documented.
- Exit assistance: Supplier will provide a full export of site code, database and media within 10 business days of termination and reasonable assistance to transfer DNS and hosting.
- IP & domain access: The customer retains ownership of domain registration and site content; supplier will provide administrative access to domain registrar and hosting control panels on request.
- DPA clause: The supplier acts as processor and will comply with the DPA attached to this agreement, including subprocessors, breach notification and assistance obligations.
- Backup clause: Daily backups retained for 30 days, stored offsite, and quarterly restore tests with test reports supplied.
Next steps and red flags
Negotiate a modest retainer if you need guaranteed out‑of‑hours support. If the supplier refuses basic items (backup testing, written DPA, exit assistance), treat that as a red flag. For disputes about unfair contract terms or late payment, see Small Business Commissioner guidance (Small Business Commissioner).
If you want a ready brief you can paste into a tender or a set of sample SLA numbers and draft wording adjusted to different hosting scenarios, I can prepare that next. For a quick self‑check before you sign, run through our website launch checklist tool: Website launch check.