If your website goes down, what does it cost you?
The Australian Signals Directorate says disruption to online services is now inevitable. We build and run websites so it doesn't happen to our clients.
Outages aren't rare anymore. Most businesses just aren't ready for one.
AI-powered attacks are rising, and the ASD responded to more than 1,500 cyber security incidents last financial year. Every hour your site is offline costs sales, bookings and reputation. And most outages aren't dramatic hacks. They're an expired domain, an unpatched plugin, or a service nobody remembered was connected.
How we keep clients online
Three layers between your site and a bad day
Layer 1: The platform
Upsun is our recommended platform for clients who need this level of resilience. It's built for businesses that can't afford to be offline.
- Every update is built and tested on a copy of the live site first. If a release goes wrong, we roll it back in minutes rather than take the site down.
- Sites hosted there are isolated from everyone else's, so someone else's problem never becomes theirs.
- Upsun is independently audited every year, including against ISO 27001:2022, SOC 2 Type II and PCI DSS Level 1. Client data is encrypted at rest and in transit.
Layer 2: Cloudflare in front
We put Cloudflare in front of every site we manage, so every visit passes through it first.
- Attacks and bad traffic get stopped before they get anywhere near the server.
- A sudden rush of visitors, or a deliberate flood, doesn't slow the site down.
- The server behind it only accepts traffic that's genuinely come through Cloudflare. An attacker can't go around the firewall, even if they find where the server actually lives.
Layer 3: Vivo
Technology doesn't look after itself, so someone has to. That's us.
- Upsun watches for problems, and so do we, so nothing relies on just one system catching it.
- On our security maintenance plan, every update passes automated checks before it's tested and deployed.
- If something does go wrong, clients ring a person in Brisbane who already knows their site, and we follow a documented process to fix it. Once onboarded onto our console, clients can also reach out to Upsun directly.
Essential Eight
Aligned with all eight Essential Eight strategies
The Essential Eight is a set of eight baseline security practices the ASD recommends to make it much harder for an attack to succeed. We've checked ourselves against all eight, and we meet every one that applies to us. Here's exactly how each one is covered.
Staff devices are centrally managed, with no local admin rights. Only approved software can be installed.
Staff application updates are applied automatically. On the hosting side, we keep pace with every update Upsun makes to its own software.
Not applicable. Macro-enabled documents aren't part of how we build or host anything.
Our standard browser is locked down centrally: automatic updates, an approved list of extensions, and no admin rights to change any of it.
No one holds admin rights by default. Access is granted centrally, only where a role actually needs it.
Operating system updates happen automatically across every device we use, not left to individual staff to remember.
We use MFA, a password plus a second step, everywhere it matters: email, our code storage, the hosting platform and project management, not just admin logins.
Our code is version-controlled with full history, and production is backed up automatically to 21 recovery points. Staff devices don't store local data that could be lost.
In all our time running sites this way…
…the outages we see come from things outside our hosting, like an expired domain or a third-party service failing. That's why we also watch for those too.
Your site is monitored 24/7/365, backed by a one-hour response time and a 99.9% uptime SLA.
Want to talk to the person who'd be looking after your site? Call 07 3257 3418 or email [email protected].
Our long-term trusted partners
Take the website resilience check
Frequently asked questions
On Upsun, with Cloudflare in front of it. That's our recommended setup for businesses that can't afford downtime. It runs in its own isolated environment rather than on shared hosting, and a Brisbane-based team manages it day to day.
A named person on our team, on a regular schedule. Every update passes automated checks first, then a staging copy, before it goes live. Critical security fixes go on within days of release. Routine updates go on monthly.
Cloudflare filters out known attack patterns and traffic floods before they reach the server. The server itself only accepts traffic that's genuinely come through Cloudflare, so the firewall can't just be bypassed. If something does get through, we follow a set process: isolate it, investigate, restore the site, then review what caused it. We don't improvise.
It depends on the size and complexity of the site, but most migrations take a few weeks and are staged so there's no downtime during the cut-over. We'll scope the exact timeline for free as part of a resilience review.