Bounded scopes. Clear pricing. No guesswork.

A full review of your Magento version, patch status, installed extensions, admin access controls, credential hygiene, and backup readiness. You receive a prioritized written report with a remediation roadmap. The assessment is a fixed-fee, fixed-scope engagement — no surprise add-ons.

Typically 5 to 7 business days from the time we receive store access. Larger or more complex stores with many custom extensions may take up to 10 business days. You will get a confirmed timeline before we start.

No. The assessment is standalone. You receive the full report and roadmap and can act on it with your own team, another provider, or come back to us. There is zero obligation to continue.

Hardening scope and cost are determined after the assessment. We review the findings, define exactly what will be hardened, estimate the hours required, and give you a fixed-price quote. You approve the scope and price before any work begins — no open-ended billing.

Most hardening engagements run 2 to 4 weeks depending on the number of findings, server complexity, and whether a staging environment is already in place. We confirm the timeline in the scoping document before kickoff.

Core Care includes 2 support hours per month. Additional hours are billed at a discounted retainer rate of $165/hour. Unused included hours do not roll over but can be used for any maintenance task within the month.

Managed Care includes 4 support hours per month with priority business-hours response. Additional hours are billed at $155/hour. Like Core Care, unused hours do not roll over but are available for any covered task within the month.

Retainers cover scheduled maintenance, security patch review and application, admin reviews, backup checks, and monitoring. They exclude unlimited development work, full migrations, forensic investigations, and emergency response. Those are scoped and priced separately.

Yes. Both Core Care and Managed Care require an initial three-month term. After that, retainers are month-to-month and you can cancel with 30 days notice.

That is a good outcome. You still receive the full written report documenting what was reviewed and the current state of your store. The assessment fee is not refundable because the work — the review itself — was completed regardless of findings.

For fixed-scope projects like Security Hardening, if we fail to deliver the agreed-upon deliverables as defined in the scoping document, we will refund the portion of the fee corresponding to the undelivered work. Assessments are non-refundable once completed. Retainer fees are non-refundable but can be cancelled with 30 days notice. Incident recovery fees are refunded if we cannot contain or recover the store as scoped.

Yes. Incident Triage is available 24/7 for active security incidents. Triage costs $1,500 and includes rapid containment and initial assessment. If extended recovery work is needed, it is capped at $3,500 unless you approve additional scope in writing.

For active incidents we aim to begin triage within 1 hour of your call during business hours and within 2 hours outside business hours. You will have a dedicated incident lead and a direct phone number from the moment you engage us.

Triage ($1,500) covers rapid containment, initial assessment of what happened, and emergency credential rotation. Capped recovery ($3,500) covers the full cleanup — removing malicious code, restoring from verified backups, validating store integrity, and hardening against re-entry. Extended work beyond the cap requires your written approval.

We handle containment and recovery. For full forensic investigation — chain-of-custody evidence handling, legal-grade reporting, or law enforcement coordination — we refer you to a specialist forensic firm from our trusted network. We will coordinate the handoff so nothing is lost in transition.

Migration Discovery is a paid engagement where we analyze your current Magento version, extensions, theme, and data to map out an upgrade path to a supported 2.4.x release. You receive a fixed-price migration plan with a defined cutover and rollback strategy. The discovery fee is credited toward the migration if you proceed with us.

Absolutely. We frequently partner alongside in-house developers or agencies. We focus on the security and operations layer while your team handles day-to-day development. We share all documentation so everyone is aligned.

For the assessment, yes — we need read access to your Magento admin, server, and database. For hardening, we typically work on a staging environment first and promote changes to production after validation. All access is scoped, time-limited, and documented.

No reputable security provider can guarantee immunity from attack. What we do guarantee is measurable, documented work — every change is recorded, every finding is prioritized, and every engagement has a clear scope and deliverable. Security is layers, not a silver bullet.

Book a Magento Security and Operations Assessment through our contact page. We will schedule a 30-minute call to understand your store, confirm scope, and send you an engagement letter. Once you sign and we receive access, work begins within 2 business days.