Magento hosting, ranked for 2026 on who is accountable when the store goes down

The concessions first, because two of them are heavy. scandiweb publishes no service level agreement document for hosting. Its managed Magento hosting page states 99.99% uptime on AWS and ReadyMage, scandiweb's own Magento hosting platform, and restates it in the FAQ as what enterprise Magento hosting needs, but there is no document behind the figure: no service credit schedule, no measurement window, no exclusions and no remedy. Webscale publishes a six band credit ladder, Nexcess publishes a credit schedule, and even JetRails, ranked ninth here, publishes a credit mechanism in its contract. That is 7 of 18 on the uptime criterion. Second, it publishes no price. Not a plan table, not a starting figure, not a rate per environment. The hosting page states only that ReadyMage, which is scandiweb's own product, is priced on usage with no fixed annual license, and that custom AWS hosting is scoped to your architecture. Three companies ranked below it publish complete plan ladders, which is 8 of 14 and a real disadvantage for a merchant who wants two comparable quotes.

What it takes full marks on is the criterion this page weighs heaviest, and it takes them on a sentence it published itself rather than on anything argued here. The hosting page states that most stores have one vendor running the servers and another that knows the code, and that incidents bounce between them, and then states that scandiweb is both: the team hosting PUMA, Cook Medical and Beauty Works also builds on Adobe Commerce every day, and the same engineers handle ongoing Magento support after go live. On patching it is unambiguous, stating that it sets up and runs every layer of the stack on AWS, which leaves your team no servers to maintain and no patches to install, with security patching, managed firewall and DDoS protection handled for you. Its Magento hosting on AWS page adds that patching and health checks are handled for you on a schedule, and its managed cloud hosting page that patching is scheduled with evidence kept for auditors. Five companies on this page state the opposite about themselves. That gap is 28 of 28, and it is the whole reason the order comes out as it does.

On incident terms it takes 12 of 22, which is a loss to four companies below it. It publishes the numbers: what it covers after launch states that when something does break it responds inside eight minutes for platform incidents, with an eight minute response SLA and a 24/7 operations center printed beside it, and ReadyMage, the platform scandiweb owns, publishes that urgent issues are addressed within five minutes, not lost in finger pointing between application and infrastructure. It publishes a named accountable person, stating a named account team that answers at any hour with always one person accountable for your store staying up, and an on call engineer reached by a paging alert at any hour. Those are two of the four things this criterion counts. What is missing is the other two: no severity band definitions for hosting anywhere on the site, and no update cadence or restoration target for an open incident. Webscale publishes both, which is why it takes the full 22 and finishes two points behind overall rather than ahead. Separately, its Magento support retainer publishes a first response within 24 hours with issues triaged by severity and showstoppers taken first, across 450+ active support clients and 9,000+ tickets handled, which is the support contract rather than the hosting one, and the two numbers should not be confused.

On governance it is the only company here taking full marks. It states ISO 9001, ISO 27001 and ISO 27017 certification with PCI DSS compliant practices in body text on its Adobe Commerce page rather than only as a badge image, and ISO 27001 and ISO 27017 certified infrastructure on the hosting page. Behind it sit 894+ Adobe certifications, 600+ specialists, 700+ brands, 2,100+ projects, a 95 NPS and 23+ years. Its Adobe tier is published as Adobe Gold Solutions Partner on the hosting page and Adobe Gold Partner on the Adobe Commerce page, which is 6 of 6 on a test the other nine were put through identically. It appears five times in the full Hyvä agency register and is Platinum on every listing, recorded here as context because Hyvä is not scored on this page. The published stack is Varnish and Redis, Elasticsearch or OpenSearch, PHP 8.1 and above with OPcache, NVMe SSD storage with HTTP/2 and HTTP/3 and a built in CDN, with auto scaling on AWS, and ReadyMage, scandiweb's own platform, publishes data centre regions across Australia, Dubai, Canada, the United States and Europe.

Two things belong on the first call. The two response numbers sit on two different properties and are worded differently: eight minutes for platform incidents on scandiweb.com, five minutes for urgent issues on ReadyMage's own site, which is scandiweb's product. Ask which one governs your contract and what counts as urgent, because neither page defines it. And ask for the uptime figure in writing with a remedy attached, because the 99.99% is published as a number and not as a term. What it does publish in place of a schedule is a record: its own write up of ReadyMage, published on 22 January 2026, states plainly that ReadyMage is a product of scandiweb, and the platform's site publishes a full migration off Azure in under six hours with PCI and ISO compliance maintained, and a store that auto scaled from two servers to nine through an eight times traffic spike. Its engineering write up on server auto scaling in Magento 2 shows the mechanism behind that. Related work sits on its Magento performance optimization and Magento technical audit pages.

On its own site, Webscale publishes the only complete contractual uptime remedy in this lane, and it is the reason the gap at the top of this page is two points rather than twenty. Its service level agreement states that should the company fail to achieve 99.98% service availability over a calendar month, the customer has the right to a service level credit, and then publishes the ladder in full: 99.98% down to 99.97%, which is nine to thirteen minutes of downtime, earns one thirtieth of the monthly list fees; below 99.97% to 99.90%, thirteen to forty four minutes, two thirtieths; 99.90% to 99.85%, three thirtieths; 99.85% to 99.8%, five thirtieths; 99.8% to 99.5%, fifteen thirtieths; and below 99.5%, meaning more than 216 minutes down in a month, the full 100% of the monthly fees. Credits are capped at the month's fees, applied against the next invoice, and named as the customer's exclusive remedy. It also publishes the maintenance window, weekend nights on Mountain Time, and the availability formula itself. That is 18 of 18, and nobody else here comes close.

Its incident terms are the only full marks on the second heaviest criterion, and they are full marks because of one thing nobody else publishes. Its documentation defines four priorities, P0 urgent for a site that is down, P1 high for degraded performance, P2 normal and P3 low, and then gives a first response time for each at each of three support tiers: Essentials P0 thirty minutes, Proactive P0 thirty minutes, Strategic P0 fifteen minutes, with P1 running four hours, two hours and thirty minutes. The service level agreement separately states a fifteen minute guaranteed response for critical errors, defined as errors which prevent the customer's website from taking or processing transactions. Note that the two documents disagree, because the agreement promises fifteen minutes to everyone and the matrix gives it only at the top tier. The thing that earns the fourth point is the update interval, a published cadence for how often you hear from them while the incident is still open, two hours at Essentials, sixty minutes at Proactive, fifteen minutes at Strategic. Included P0 volume is capped at ten and twenty five tickets a month on the lower tiers and unlimited at the top. A named subject matter expert, a direct phone line and a private Slack channel exist only at the top tier, and the documentation is careful to say that the named expert comes with guardrails and schedules and is not an on demand round the clock resource.

Where it loses is the application. The only place Webscale answers who actually applies a Magento patch is its Magento 1 end of life documentation, and the answer is a flat no: it states that Webscale provides the patches to customers, and that customers or their developer team will download and verify the patch in a staging or testing environment before applying it to production. For Magento 2 and Adobe Commerce there is no equivalent statement published at all. What it offers instead is virtual patching, configuring the platform to limit exposure without making any changes to the application code, plus a thirty day patch availability commitment for Magento 1 Open Source and sixty days for Magento 1 Commerce. Application work exists but is metered: developer enablement hours covering code review, troubleshooting and platform level engineering run to zero at Essentials, four hours a month at Proactive and ten to twenty at Strategic, pooled monthly and not rolled over. Its marketing promises more than that, offering application aware troubleshooting that diagnoses slow checkouts, caching issues and third party API failures, but its own positioning statement is that Webscale operates at the infrastructure and delivery layer, beneath your existing stack, all without touching your commerce platform. That is 12 of 28.

Three things belong on the call, and the third is the one that would worry us most. First, the exclusion. The agreement classifies as planned downtime, and therefore excludes from the availability calculation entirely, any downtime due to the customer's application errors, database errors, application server failures or database server failures. For a Magento store those are the most common failure modes, so the credit ladder covers a narrower band of outages than it first appears to. A second clause excludes downtime taken for purposes of maintaining the integrity or operation of the services regardless of the notice provided, which is maintenance with no notice requirement at all. Second, pricing is published as Essentials from $499 a month on a single server environment, Scale from $1,199 a month multi server, and Enterprise custom, but the support tiers that carry the response commitments are sold separately from the hosting tiers and no support tier price is published anywhere. Third, MageMojo. Webscale acquired the Magento host MageMojo, and every page on webscale.com was searched for the name, case insensitive, with zero occurrences. There is no acquisition announcement, no date and no statement about what happened to MageMojo customers anywhere on the site. The domain magemojo.com now redirects to Webscale's positioning page at an anchor that does not exist on it, and MageMojo survives only as a support address and a set of URL slugs inside the documentation. On certifications it states that the Webscale platform holds PCI DSS, SOC 2 Type 2 and HIPAA certifications, with softer built in PCI compliance wording on the product pages; it never claims PCI DSS Level 1 Service Provider status and publishes no ISO certification. Its only Adobe level is from a press release dated 14 February 2023, stating that it joined the Adobe Exchange Partner Program at the Accelerate level, which is a named level in a programme since superseded and scores one point. It publishes no headcount, no founding year and no case study with a URL of its own.

Nexcess and Liquid Web are one company and are ranked here once. Every nexcess.net address now redirects to liquidweb.com, checked on 23 September 2026, the footer reads copyright Liquid Web LLC by Nexcess Corp, the service level page carries two separate documents headed Liquid Web SLA and Nexcess SLA, and the Magento hosting page states that its PCI status belongs to Nexcess infrastructure, which powers our Magento hosting. Ranking them separately would have been double counting the same stack.

It publishes the clearest hand back sentence a buyer will find anywhere in this lane, and it publishes it on the Magento hosting page itself, in answer to its own FAQ question about whether you still need a developer. The answer states that while they manage the server infrastructure, you will likely still need a developer for Magento application level tasks: theme customization, extension installation and updates, custom coding, and Magento core upgrades. Managed hosting is defined on the same page as the server level aspects only, including operating system and stack updates and patching. Its support documentation goes further, listing as out of scope the installation and configuration of third party software, developer related tasks, adding removing or modifying web pages, code, plugins or themes, and code, database or website performance optimization. And its support page answers the question directly: it does not currently offer in house development services, and partners with development agencies instead. Adobe's security patches and Magento core upgrades are therefore the merchant's job, stated plainly by the company rather than inferred. That is 6 of 28, and it is above the floor only because the statement is printed where a buyer will actually read it.

Its service level agreement is a real one and it is the reason it finishes third. Nexcess commits to a minimum 100% uninterrupted transit to the internet and 100% uninterrupted electricity, measured monthly, with a credit of 5% of recurring monthly fees for every additional fifteen minutes beyond that, capped at the month's fees, claimed within seven days, and named as the sole and exclusive remedy. Read the definitions before relying on it. Loss of services means the customer is unable to connect to the Nexcess datacenter, which is reachability rather than store availability, so a Magento store that is up but broken triggers nothing. Outages may not be combined to reach the fifteen minute minimum, so three separate ten minute outages in a month earn no credit at all. The company's determination of credits is final, invoices must be paid in full while a claim is reviewed, and a claim judged false or duplicative carries a fifty dollar charge and possible suspension. The page's own timestamp reads 26 August 2013. Response times are explicitly carved out of the agreement: it states a goal of under one minute on chat and one hour on tickets, and then says in the same paragraph that these initial response times are not part of an SLA and are not guaranteed. There are no severity bands and no escalation process, which is 7 of 22.

On what you can read before a call it takes the full 14, one of only three companies that do. Four Magento plans are published with regular prices, not only promotional ones: XS at $74 a month, S at $145, M at $247 and L at $409, each with its storage, bandwidth and PHP worker counts, on dedicated environments with OpenSearch and a Cloudflare CDN. On governance its own certification claim is specific and unusually strong for a host, that Nexcess infrastructure is a PCI DSS Level 1 Service Provider, which is a materially different statement from the PCI compliant hosting wording most of this field uses; it publishes no ISO 27001, no ISO 27017 and no SOC 2 report of its own. Its scale figures fight each other on its own site, with ten global data centers and 500K+ websites under management on one page against twenty two data centers and over 180,000 customers on another, and no headcount anywhere. It publishes no Adobe partner level of any kind, and instead runs a page positioned against Adobe Commerce Cloud under headings including hidden fees and your code is their code. Its client evidence is genuine: an index of eighteen case studies each with its own URL, including Netalico, where it states the agency sped up a client site by 295%, increased conversions by 350% and saved the client $15,000 a year. One tension is worth naming: its homepage advertises round the clock hosting and application support while its own scope document rules out code, plugins, themes and performance optimisation.

MGT-Commerce publishes the single most explicit refusal in this lane, and it publishes it as an answer to its own question. Under the heading asking whether it applies Magento security patches, its security page states that it does not offer Magento security patches and updates, that its expert team carries out server side security updates, and that it ensures the server is in optimal health. Everything else on the site is consistent with that: its service level table lists MGT tested operating system patches and never Magento patches, and its hosting page lists operating system security patches and updates under what is included while stating that it manages all server related changes so you can focus on your Magento store. Its own terms put third party code risk back on the merchant twice, requiring routine backups before installing applications or extensions from other manufacturers, and disclaiming liability for errors and incompatibility of third party software. There is no statement anywhere about who handles a broken custom module. That is 6 of 28, and the score is that high only because the refusal is unusually clear.

It publishes an actual service level page, which most of this field does not, and the numbers on it are specific. A 99.95% network uptime guarantee applies to all three product families, alongside a two hour instance replacement, round the clock support, a managed AWS port firewall, its own web application firewall, managed backups with full hourly instance snapshots, DDoS mitigation through Amazon Shield, an encrypted file system and a New Relic installation. Response is split two ways: under 24 hours for general guidance on every plan, and guaranteed response for emergencies running from under eight hours on Single Server Premium through four hours and two hours, under two hours across the Multi Server tiers, and down to under one hour on Auto Scaling Premium and under thirty minutes on Auto Scaling Enterprise. An emergency is defined only as your system being down and not operating. There are no severity bands beyond that split, no escalation process, no named engineer and no account manager published anywhere, which is 12 of 22.

Three gaps between what it markets and what it contracts belong on the first call. First, the homepage advertises a fifteen minute response time and calls it the fastest in the industry, while its own service level page gives eight hours for a Single Server Premium emergency and twenty four hours for anything not classed as an emergency; the security page words the same claim honestly, as an average response time under fifteen minutes. Second, the service level page and the Single Server plan page publish different emergency response times for the same tiers, eight, four and two hours on one and four, two and one on the other. Third and most important, the binding contract says something different again. Clause 3.2 of its terms states that a guarantee of service availability free of interruption is not technically possible, and that the customer can expect an average monthly availability amounting to 98% over the year. Ninety eight percent monthly permits roughly fourteen and a half hours of downtime a month against the twenty two minutes implied by 99.95%. Clause 3.3 removes the obvious remedy: in the case of defects, the customer cannot reduce the ongoing payments. No service credit schedule of any kind is published, and a search of the service level page for credit and refund returns nothing. That is 10 of 18, for a contractual figure with no remedy attached.

Where it is genuinely strong is everything a buyer can read before picking up the phone, and it takes the full 14 there. Nine tiers are published with prices: Single Server Premium at 149 euro a month, Ultimate 199, Enterprise 249; Multi Server Basic 299, Premium 499, Ultimate 999; Auto Scaling Basic 1,499, Premium 1,999, Enterprise 4,999, all plus AWS cost pass through, with the architecture spelled out per tier down to load balancers, slave databases, Varnish, NFS, ElastiCache and Elasticsearch. Note that the pricing page publishes Multi Server at 249 euro where the homepage says 299, and that the 149 euro headline is the tier capped at three support requests a month with the slowest emergency response in the table. Its footprint is published as 96 AWS availability zones and more than 250 CloudFront points of presence, with a dated benchmark stating time to first byte measured from an EU datacenter on a cached homepage in February 2026. On governance it publishes 40+ engineers, 5,000+ stores hosted and a 2011 founding, and it holds no certification of its own: every certification named on the site belongs to AWS and is attributed to AWS in the same sentence, which is the honest way to put it and scores nothing here. It publishes no Adobe partner level in any wording, and its Adobe Commerce page is positioned against Adobe's own hosting under the line same Adobe, different bill. It has no case studies at all; its sitemap of fifty one pages contains none, and the eight brand logos under trusted by leading brands carry no caption identifying them as customers and no page behind any of them.

Wolf Sellers is an Adobe Gold Partner that runs managed cloud infrastructure for the stores it builds, and it publishes the hardest response numbers of any agency on this page. Its support and maintenance plans run Starter at eight by five cover with a twenty hour development allowance and a four hour response commitment, Business at round the clock cover for critical issues with forty hours and a one hour commitment, Enterprise at full round the clock cover with eighty hours and a thirty minute commitment, and a custom tier above that. Severity is defined by business symptom rather than by system layer, which is the smartest thing on the page: P1 alerts are named as store down, broken checkout and data loss, handled around the clock every day of the year including holidays, while P2 and P3 can wait for the next business day depending on plan. Defining the top priority by what the merchant loses rather than by which component failed sidesteps the infrastructure versus application argument at triage time, which is exactly the argument this page exists to examine. It states that every plan includes a contractual service level agreement for response time, resolution time and hours of coverage, with monthly activity reports.

On the application it scores 18 of 28, the second highest here and well above every pure play host, because the party answering the ticket is the party that can change the code. Every plan bundles development hours with the response commitment rather than selling them separately, and it publishes a patch commitment of its own: security patches applied within 72 hours, with staging testing before production and automatic rollback on failure. It sells implementation, custom software development, cloud infrastructure on AWS and Azure, and continuous integration and deployment work, so nothing about a Magento fault has to leave the building. What holds it below the top of this criterion is that it never itemises the boundary. There is no published statement anywhere about who is responsible when a third party extension or a bespoke integration breaks the store, and no in or out of scope list for application level debugging. The development hours are an allowance, not a liability position, and a merchant should ask what happens in month two when the eighty hours are gone and the checkout is still broken.

It publishes no uptime percentage at all, which is the single largest hole in an otherwise numerate page and scores zero on that criterion. The nearest thing is a monitoring frequency, uptime monitoring every thirty seconds, which tells you how often they look rather than what they owe you. There is no service credit, no remedy and no availability figure on the hosting page, the support page or the FAQ. Resolution time is named as a dimension of the contractual service level agreement without ever being given a number. There is no escalation ladder, no on call rotation and no named engineer published. Its detection stack is unusually well specified for an agency, naming application performance monitoring through New Relic or Datadog, real time checkout error alerts, queue monitoring across RabbitMQ and Redis, synthetic monitoring of the checkout flow and real user monitoring, which makes the absence of an availability commitment stranger rather than less noticeable.

On price it publishes support plans starting at 35,000 Mexican pesos a month, available annually or month to month, and a hosting cost illustration rather than a rate card, putting a store at fifty thousand sessions a month at roughly $300 to $600 a month on AWS. It publishes no per plan hosting price and no named cloud regions, which is 5 of 14. On scale it publishes a team of 135 people, mostly developers, more than fifty brands and a 2014 founding, and holds no certification of its own: what it publishes is compatibility wording, PCI DSS Level 1 compatible and PCI DSS Level 1 ready, alongside a web application firewall against the OWASP top ten and annual penetration testing. Compatible is not certified, and this page scores it as the former. Its Adobe tier is the strongest credential it holds, published on its own about page as Adobe Gold Partner and described there as the second highest tier Adobe grants to its partners, restated on the service page as a certified Gold Partner. That is the full 6, the same as scandiweb takes. Three clients have case studies with their own URLs, Casa Cravioto, Juguetron and Enlace; the fifty plus brand logos on the portfolio page have no page behind them and are not counted here. One caveat belongs on the page rather than in a footnote: its hosting offer is agency run managed AWS and managed Adobe Commerce Cloud rather than an own brand hosting product, so a merchant comparing it with a host is comparing two different shapes of thing.

Sonassi publishes the cleanest scope boundary in this entire field, in five words: we don't touch your store. The full sentence reads that it provides platform support for everyone, covering platform incident response, autoscaling optimisation, network stability and speed, backup management and platform security, and then draws the line. Its PCI responsibility matrix says the same thing in contractual language, against requirement 6.3: Sonassi is responsible for patching the operating system and services, and you are responsible for patching any software you install, such as Magento or Node. Its billing article states that the day to day running and operation of a client's Magento store is wholly their responsibility, that Sonassi only provides hosting for the application, and that any assistance beyond that is chargeable support. Its statement of work lists Magento upgrades, Magento extension installation, Magento code profiling and deep auditing, and general day to day administration as explicitly not included. It is the only company here that arrived at that position deliberately and says so: its site wide footer records that it formed in 2008 building and hosting Magento stores, and that in 2015 it committed to stop building Magento stores and dedicate itself to hosting, and no longer offers proactive development services.

The clause a merchant should read twice is the burden of proof. If you suspect a server side fault, Sonassi states, you must first conduct the necessary due diligence to rule out your application, configuration or code being at fault; and if it investigates following a support request and identifies the issue as being caused by your application, configuration or code rather than the server, the time spent is chargeable. That is the hand back written as a billing rule. It is honest, it is unusual to publish, and it means that on the night your checkout fails you are paying someone to prove it is not your fault before anyone starts fixing it. It scores 12 of 28 rather than 6 only because paid store tiers genuinely exist: it states that store support is available from its accredited developers, ranging from routine patch management through to full store support, sold as Store Lite and Store Full at tailored pricing, with Store Full adding a dedicated Slack channel and direct access to the development team.

Its response bands are published and they are properly graded, which is more than most of this field manages: emergency one hour, high four business hours, normal seven business hours and low fourteen business hours, identical across the Standard, Enhanced and Intensive plans, with out of hours defined precisely as after 18:00 and before 10:00 GMT on weekdays and all day at weekends. The contact method for every plan is a ticket. Its marketing figures are presented as achieved averages rather than commitments, which is the correct way round: a three minute average emergency response, a one hundred percent support ticket resolution rate and a fourteen hour average resolution on normal priority tickets. No escalation ladder, no on call rotation and no named engineer is published, which holds it to 12 of 22. On uptime it publishes a 99.95% service level agreement on five separate pages, and then publishes nothing behind it. There is no terms page on the site at all, the statement of work contains no uptime clause and no credit schedule, a full search for service credit, refund, compensation and rebate returns nothing, and the download support SLA button on the plans page has no link attached to it. That is 7 of 18, the same rung scandiweb sits on.

Support plan prices are published at Standard included, Enhanced at £80 a month per server and Intensive at £150 a month per server, with additional support at £1.50 a minute and out of hours work at £45 per fifteen minutes; base server pricing renders only inside a JavaScript configurator and is not readable. Hardware is specified more carefully than anywhere else here, enterprise Supermicro servers with hand picked components stress tested for a minimum of two weeks before production, with four hour hardware replacement and a fully owned UK datacentre estate, although no named location. On governance it claims a long list of ISO accreditations as its own, including ISO 9001, ISO 27001, ISO 14001, ISO 22301, ISO 27018 and ISO 27017, which is the strongest certification set after scandiweb's, with one caveat a careful reader should note: the page does not distinguish between standards it is certified against and standards it aligns to, and several numbers in its second badge row are guidance documents rather than certifiable schemes. Its PCI wording is compliant rather than certified, with no Level 1 Service Provider claim and no attestation published. It publishes no headcount and no client or store count, and no case study with a URL, substituting around twenty attributed testimonials from retailers and agencies. It publishes no Adobe partner level for itself in any wording, current or legacy. Two internal contradictions are worth flagging because both are live: one page states it can find and fix any problems, whether server related or your store itself, against we don't touch your store on another; and one page calls it a profitable, privately owned company while another states it is the specialist eCommerce division of iomart Plc and a public limited company.

Cloudways publishes the most precise response commitments in the lane after Webscale, and it publishes them for every plan including the free support tier. High priority tickets carry a three hour target on Standard, thirty minutes on Advanced and ten minutes on Premium; normal priority runs twelve hours, six hours and two hours. High priority is properly defined rather than left to the buyer: it must relate to events that render the customer's infrastructure or services unusable or inaccessible, and it states openly that events rated high priority by customers which do not match that description will be demoted to normal priority by its own personnel. Escalation is published as a rule: a live chat session that runs past the tier's time limit becomes a ticket carried forward by senior engineers, fifteen minutes on Standard and thirty on Advanced, with Premium buying a private Slack channel and phone access around the clock. What it does not promise is a fix. Its own words: the response time goal is the time it takes to acknowledge and have the work started status only, not the time it takes to resolve the issue in question. Three of the four things this page counts, which is 17 of 22, and higher than scandiweb takes.

On the application it is the weakest entry here, and the evidence is its own out of scope list, published on the support page under a preface that leaves no room for tiers: no matter which support plan you are on. The list rules out changes to website content or appearance, changes to the functionality of plugins, themes or modules, debugging custom code, application level security issues, auditing your code, upgrades of plugins, themes or modules, and, in its own summary, in general anything that implies code editing. That applies on the $500 a month Premium tier as much as on the free one. Its Magento hosting page says nothing at all about who applies Adobe security patches; a search of that page for patch and security update returns nothing. What it does publish is server side only, regular operating system patches on your server, and its help centre puts keeping applications, plugins and themes up to date under what the customer is responsible for. The tension is that the same support page's comparison table ticks application support and customization support for the paid tiers, immediately above the list that excludes code editing entirely. That is 3 of 28.

Its service level agreement is worth understanding before anyone quotes its uptime at you, because it is a support agreement rather than a hosting one. In its own words, service availability refers to the Cloudways services support platform console only and in no case applies to the service availability of its third party cloud providers, and the document ends by pointing at the DigitalOcean, Amazon EC2 and Google Compute Engine agreements for the servers themselves. Credits are real but they buy back missed support responses, five percent of the monthly fee for each hour the standard is missed, capped at the month's fees, never aggregated and never paid in cash. Two clauses matter for a customised Magento store. Credits are void where the failure is based on a non standard environment, customer authored code or changes made by anyone other than the provider, which for a Magento build is a wide carve out. And the agreement states that it may be changed at the company's sole discretion and without prior notice. The uptime figures it markets, 99.99% on one product page and 99.9% on another, appear nowhere in the agreement. That is 7 of 18. Note also that the legal counterparty throughout is DigitalOcean, whose legal pages the terms of service, privacy policy and acceptable use policy all link to.

On what a buyer can read before a call it takes the full 14, and it is the reason it outranks three companies with better scope statements. Flexible plans run from $11 a month to $342 a month, Autonomous plans at Growth $99, Scale $199 and Plus $399 with baseline server counts, bandwidth and disk published per tier and overage rates named per gigabyte and per server hour. Its footprint is published as three cloud providers, 43 locations and 58 data centers, with the DigitalOcean regions listed by city. One pricing structure deserves attention: the support add ons that carry the ten and thirty minute response times cost $500 or $100 a month respectively, or ten percent of your invoice, whichever is higher, so the support you need to make the response commitment real scales with your spend. On governance it holds nothing of its own. Its trust page lists only the certifications its infrastructure partners maintain, at the infrastructure level, and its own help centre says the quiet part plainly: a web hosting platform alone cannot be fully PCI compliant, and Cloudways helps with the server and infrastructure security while application level security is managed by you. It publishes over 102,000 customers, a figure that sits on the same page as an unexplained 840K plus, and no headcount and no founding year. It publishes no Adobe partner level in any wording. Its client evidence is strong for a self serve platform, with Magento case studies each carrying their own URL, including Ciyapa at a 22% boost in conversion rates, 40% increase in page visits and 30% faster load times.

magic42 publishes the sentence this entire page was built around, and it publishes it about itself without being asked. When a performance issue appears on your site, it writes, a standalone hosting company will tell you it is a code problem, and a standalone development agency will tell you it is a server problem; with magic42 the same team is responsible for both, so problems get diagnosed and fixed rather than passed back and forth. The page it sits on is headed with the question of why you would host your Magento site with your development agency, and describes the offer as managed Magento hosting on dedicated bare metal and cloud infrastructure from a UK agency that builds and maintains the sites it hosts. On patching it is unambiguous and it is the only company besides scandiweb to name Adobe explicitly: when Adobe releases Magento security patches, its development team reviews and applies them to your site, with testing on staging before deployment to production, and operating system patches go out through a standardised, centrally managed configuration. Its monitoring scope includes application errors alongside server resource usage, response times and security events, which is precisely the thing Hypernode publishes that it does not watch. That is 24 of 28, second only to scandiweb, and it is earned.

Then the numbers stop. It publishes no response time in minutes or hours, no severity bands, no resolution target and no escalation ladder. What it publishes instead is routing, that automated alerts escalate to its development team, and a proactive flagging promise, that if it spots a growing database, memory pressure during peak hours or a pattern of bot traffic it will flag it and recommend a course of action. Its cover model is business hours and it says so rather than claiming otherwise: having your hosting managed by a UK based team means we are in your timezone and available during your working hours. No round the clock claim appears anywhere, no out of hours arrangement is published and no stated office hours are given. That is 3 of 22, the lowest on this page, and it is the whole reason a company with the second best scope statement in the field finishes eighth. A merchant whose Black Friday indexer stalls at two in the morning has nothing published to hold them to.

Its uptime claim is a section heading, 99.9% uptime guaranteed, backed on the page by redundant infrastructure, proactive monitoring and automated alerting, with no service level document, no credit schedule and no remedy behind it: 4 of 18. It publishes no price of any kind, no plan names and no monthly figures, which with a fully specified stack and no named data centre is 5 of 14. The stack itself is specified carefully, with PHP at the correct version, memory limits and OPcache settings for your Magento version, MySQL, Redis, Varnish, Elasticsearch or OpenSearch and a CDN, plus daily automated backups of database, media and configuration stored off server so they survive a hardware failure. On governance it publishes no certification at all, not ISO 27001, not ISO 27017, not SOC 2, not PCI DSS, and not even a PCI compliant hosting marketing claim, on the hosting, about or contact pages. It publishes twenty plus years managing eCommerce infrastructure and forty eight named case studies each with its own URL, and no current headcount, the only team figure on the site being a historical fifteen at incorporation. Its Adobe tier is published as Adobe Solution Partner at Bronze level, dated on its own about page to January 2021, which is 2 of 6 on a test applied identically to all ten.

Read it as the clearest statement of the argument this page makes, from a company that has not yet built the terms to back it. The scope promise is the strongest in the field after scandiweb's, and there is nothing published that a merchant could hold it to if the promise failed. That combination is worth naming rather than smoothing over, because it is exactly the trade a buyer has to make: a smaller agency that genuinely owns both layers, against a host that owes you a credit if the network drops and owes you nothing at all if your checkout breaks.

JetRails puts its scope boundary under a heading rather than in the small print, and the heading is the argument: why JetRails is not a development firm, and why that is a good thing. The text is worth quoting because it is the most self aware version of this position anywhere in the set. We do not write or maintain code, it states; we build and manage the infrastructure that makes that code perform, and that separation keeps us focused on performance optimization, uptime, scaling and managed security. It goes on to say that it is not competing with agencies or developers, so it can recommend partners objectively and collaborate freely. Its security page frames the split the same way: security is a shared system, infrastructure lives with JetRails, application behavior lives with your team, and compliance depends on both. That is a real, published, defensible position.

What it never does is name the patch. The only patching scope stated anywhere is the operating system, rapid operating system patch updates on one page and operating system vulnerability patching and hardening on another, and a search of its Magento hosting page for patch wording returns no matching sentences at all. So while the inference is obvious, JetRails never publishes an answer to the question of who applies an Adobe security patch to your store, which is the single most important thing a Magento merchant needs to know about a host. It muddies it slightly in the other direction too, claiming on the Magento hosting page that it has helped clients resolve stuck carts, failing reindexes, slow admin panels and caching conflicts with third party extensions, which are application symptoms. It scores 6 of 28: the hand back is published where a buyer will find it, but the patch question itself is unanswered.

Its numbers live in marketing and its contract lives somewhere else. It publishes 99.99% uptime on two pages. Section 23 of its terms of service, which is the section headed service level agreements, reads in full that it will use commercially reasonable efforts to maximize availability of the service. There is no percentage in the contract at all. A credit mechanism does exist and is more than several companies here publish: claims must be made within five business days or forfeited, credits cannot exceed two weeks of credit in any calendar month, the exclusions name scheduled maintenance and necessary network upgrades, and credits are the sole and exclusive remedy. But the schedule that would say how much a credit is worth sits in supplements the site does not publish, so a prospect cannot read the actual agreement before signing. That combination, a contractual mechanism with no number and a marketing number with no contract, is 10 of 18, and it is one rung above where scandiweb sits. On response it publishes a fifteen minute emergency response commitment, and publishes it honestly as an enterprise grade service add on rather than as part of the base package, available at the Enterprise tier alongside a dedicated technical account manager. Emergency is never defined, no severity bands exist and no resolution target is published: 12 of 22.

Support is its strongest marketing claim and it is specific about it: round the clock United States based support by phone, email and optional Slack, with no AI bots, no call trees and experienced engineers managing the environment every day of the year. Pricing is published only as a range, with regular configurations between $100 and $2,500 a month and tier names carrying no figures, and its data centres are described only as secure United States facilities with no named locations, which is 5 of 14. On certifications it is unusually straight, stating on its compliance page that while it does not issue certifications it does align your hosting environment with the controls your auditors expect, and listing the audit artefacts it supplies: architecture diagrams, access records, detailed logs, patch histories and configuration notes. Two product pages sit awkwardly beside that, one stating that its environments are PCI DSS Level 1 certified and listing SOC 2 Type II compliance, where the grammatical subject is the environments rather than the company. It publishes no ISO certification and no headcount, a founding in 2000 and thousands of online storefronts. It publishes no Adobe partner level of any kind; its partners page names Shopware, Amasty, Amazon Web Services, Cloudflare, Hyvä and Sansec and no Adobe tier. Its client evidence is the best of the pure play hosts: sixteen case studies each with its own URL, including Galco, which it states moved from Adobe Commerce Cloud to open source Magento on AWS with zero site down incidents since migration across more than three million SKUs, carrying a named quote from the chief information officer, and RuffleButts at a 90% reduction in CDN costs worth more than $20,000 a year and a 500% increase in transactions at high peak.

Hypernode publishes the most useful sentence in this entire research set, and it publishes it inside its own monitoring documentation rather than on a sales page. The big thing missing from the list of things we monitor, it writes, is your application, or does Magento work. What it does monitor is named precisely: the hosting software services that come preinstalled, Nginx, MySQL and Redis, the optional extras Varnish and RabbitMQ, and the root filesystem. Nothing above that line. Its security documentation says the rest in eight words: although we are very skilled in hosting Magento shops, we are no Magento developers. Its scope of support states that it can, as a courtesy, attempt best effort support on issues related to the application, with its primary focus on providing a fast and stable platform and not the inner workings of the web application, and that it cannot assist with the installation of, or issues relating to, third party software such as plugins, modules, add ons, themes or other components or scripts. Magento patching is framed as the merchant's task, with its security page telling you that regular Magento patches are released to secure your shop and offering a free tool so you can check your own patch status.

The clearest illustration of what that means in practice is its own advice when one of your extensions turns out to be vulnerable. Upgrade if an update exists. Contact the developer if it does not. And if there is still nothing, disable the extension, even if you lose some fundamental functionality in your webshop. The host's remedy for a broken extension is to switch the feature off. The same document notes that in the case it describes, the vulnerability was actively abused within less than eight hours of discovery. That is a company being honest about where its job ends, and it scores 3 of 28 rather than 6 for one reason: the scope document lives in developer documentation that renders as a JavaScript application, while its agency facing marketing page calls Hypernode the absolute extension of your development team and invites you to tackle all issues, whether Magento or infrastructure issues. Those two sentences cannot both be the offer.

Its response bands are published and graded, urgent requests at fifteen to thirty minutes, priority requests at zero to one hours and standard requests at two to four hours, with no definition of what makes a request urgent and no resolution target. Its escalation is the most specific published by anyone here: an alert pages an on call operative who is on standby around the clock, and if the alert goes unacknowledged for thirty minutes it automatically escalates to the entire team. That is 12 of 22. But read the hours before relying on any of it. Free support runs Monday to Friday from nine in the morning to six in the evening Central European time. Out of hours is a separately paid emergency service at 200 or 100 euro per incident depending on contract, free only where the issue is caused by a Hypernode outage, and its own page states that its goal is to guarantee the short term continuity of the webshop rather than to resolve anything, with no rights derivable from the solutions offered. The plans page meanwhile advertises that all hosting plans come with round the clock premium support. Ask which applies at two in the morning.

It publishes no uptime percentage anywhere, on any page opened, which is zero on that criterion, and no service credit or remedy. Its terms are published only as a binary document that could not be read, so its contractual availability position is recorded here as unverified rather than claimed in either direction, which is the honest treatment. Plan families are named, Falcon on one cloud and Eagle on AWS, but every price on every plan page renders as an unresolved script placeholder rather than a number, so its pricing is not readable: 8 of 14, earned on the stack detail and the published emergency fees. Where it is genuinely strong is governance, and it is the only pure play host here to score 9. It states that it holds ISO/IEC 27001:2022, NEN 7510:2024 and ISO 9001:2015, and adds the clause that matters, that the certification applies not only to its internal organisation but also to its data centres, which is the difference between holding a certificate and pointing at your cloud provider's. It publishes no PCI claim in any wording and no SOC 2. It publishes 25 plus years, more than 200 agencies and 2,500 plus customers, and no headcount and no named data centre locations. It publishes no Adobe partner level in any wording, including on its own Adobe Commerce hosting page, and one line on that page is worth repeating because it tells you how it sees the market: it states that Hypernode consistently provides demonstrably faster support and is considerably more flexible than Adobe. Its own partner tiering for agencies runs bronze through platinum with progressive recurring commission, which is the shape of this whole lane in one sentence: the host pays agencies to bring merchants, then hands the application faults back to those same agencies.