What every site we build includes

Every build ships against a written budget. We measure it on your own domain with Google's own tools and hand you the report on launch day, and a page that misses the budget is fixed before launch, not after you notice.

The budget holds because of how the site is built: server-rendered pages, images compressed at build time, local fonts, and no page builder shipping code nobody asked for. Measured on a mid-range phone over a normal mobile connection, every page ships inside these limits:

• Largest Contentful Paint under 2.5 seconds
• Interaction to Next Paint under 200 milliseconds
• Cumulative Layout Shift under 0.1

Every site is built on correct document structure: one h1, headings in order, landmarks, labelled form fields, visible focus states and text contrast that meets WCAG 2.1 AA. Meaningful images get alt text, decorative ones are hidden from screen readers.

The whole site works from the keyboard alone, which is also the structure search engines read.

That is the baseline, not a certificate. A full audit, a conformance statement and remediation under the European Accessibility Act are separate work: see accessibility and the European Accessibility Act.

The site is served over HTTPS with a certificate that renews itself, and ships with security headers set: content security policy, strict transport security, frame and content-type protection.

Dependencies are pinned, updated and monitored for known vulnerabilities. The code is application code we wrote and can read, not a page builder carrying twenty plugins from twenty authors, which is where most compromised sites come in.

Every page ships with its own title and description, a canonical URL, Open Graph and structured data, so search engines and the AI systems now answering on their behalf can read it correctly.

Multilingual sites get hreflang pairs in both directions and a language-correct sitemap; single-language sites get the sitemap and robots rules anyway.

The HTML carrying your content is in the first response, not assembled by JavaScript afterwards, so a crawler sees the same page your visitor sees.

The domain is registered to you, or stays where it already is. The repository is yours and we work inside it. Hosting, analytics, email and payment accounts are opened under your company, with us added as collaborators you can remove.

Content exports in a standard format at any time, and no subscription is attached to the code: if you stop working with us, the site keeps running and someone else can pick it up.

At launch you get a written handover: where everything lives, which accounts exist, how to publish content, how to restore a backup and who to contact when something breaks. Not a folder of screenshots.

We walk through it on a call, recorded if you want it, so the next person on your team can watch instead of guessing. Editable content stays editable: whatever you wanted to manage yourself is wired to an editor.

No third-party trackers are added by default. Analytics stays first-party where that is possible, and any tool that sets a cookie or sends data elsewhere is named, agreed with you and placed behind consent before it ships.

Where the law or your own customers require it, the database and file storage run in the EU, and a data-processing agreement is available on request: see data processing agreement.

The first 30 days after launch are covered by the warranty: anything that does not work the way the accepted scope says it works is fixed at no cost. Small content changes such as text, photos and prices are included in those 30 days as well.

After that, keeping a site fast and secure is ongoing work and we sell it plainly: website care plans start with hosting, backups, updates and monitoring. Not taking a plan is a perfectly good answer, and everything stays yours either way.

A standard you cannot measure is advertising. Every proof below is something you can run yourself, with free tools.