One price per machine. Licences included.
Most managed-server quotes are hourly labour with the tooling billed separately, or a low headline number that covers very little. This is the whole stack on one line.
Everything below, on one server. Setup, hardening and migration from an existing provider included.
Start with a free reviewSame stack, same coverage. Shared monitoring and a single point of contact across all of them.
Ask about multiple machinesWhat the price actually covers
| Capability | What it does for you | Tooling |
|---|---|---|
| Rebootless kernel patching | Security patches applied to the running kernel. No reboot window, no scheduling it for a Sunday. | KernelCare |
| Intrusion detection & log analysis | Host-based detection, log collection and retention, and file integrity monitoring on the paths that matter. | Wazuh |
| Real-time monitoring & alerting | Per-second metrics on CPU, memory, disk, network and services, with alerts that reach a person. | Netdata |
| Zero-trust private access | Your machines and your people on a private mesh. SSH and admin interfaces come off the public internet. | Tailscale |
| Off-site backups + integrity checks | Encrypted, deduplicated backups pushed to versioned S3-compatible object storage in a different failure domain. The server can write but not delete, so an overwrite adds a version rather than replacing the original. | resticprofile |
| Patching, hardening & upkeep | OS and package updates, firewall and access review, and the quiet maintenance that prevents incidents. | Internal tooling |
Licence costs for the commercial components are included in the monthly fee. You are not billed separately, and you do not need your own subscriptions.
What isn't included
Being clear about this up front saves us both a conversation later.
- The server itself. You keep your own hosting account and pay your provider directly. You own the machine; I manage it.
- Contractual response times. Alerting is continuous and I respond as fast as I reasonably can, but a guaranteed out-of-hours SLA is a separate agreement; see below.
- Application development. I keep the platform healthy. Building or debugging your application is quoted separately.
- True immutability. Backups are protected by access separation and versioning, not by write-once storage. An append-only key still permits writing over an existing file, because object storage has no separate overwrite permission; versioning is what preserves the original, and recovering from a malicious overwrite is a manual, version-by-version job rather than a single restore command. Anyone holding the storage account credentials can still destroy everything. Restic cannot use S3 Object Lock, because it writes and removes a lock file on every run and prune cannot rewrite locked objects. If a compliance requirement demands genuine WORM retention, that is a different backup tool, and I will tell you so rather than sell you this one.
- Scheduled restore rehearsals. Backup repositories are integrity-checked automatically and restores are performed when you need one, but a full application-level rehearsal of a multi-terabyte dataset (bringing the database up, verifying game or application state) is scoped and quoted separately. Anyone promising it inside a flat monthly fee has not priced it.
- Compliance certification. I implement and evidence the technical controls; I am not an auditor and cannot certify you. What that distinction means.
Backups as a standalone service
Not everyone wants full management. Off-site backups can be bought on their own for €50/mo. If I already manage the machine they are included in the monthly fee, not billed on top. The storage account is yours: you open it with Backblaze B2, or any S3-compatible provider, and pay them directly at their rates. I set it up and show you how it works, so nothing is locked to me.
- resticprofile to S3-compatible object storage (Backblaze B2, BorgBase or your own), encrypted, compressed and deduplicated
- Append-only credentials on versioned storage. The server can still write over a file, but that creates a new version; removing the old one needs credentials kept off the machine, as does pruning.
- Retention, schedule and resource limits configured per client
- Actively monitored, with a self-service restore guide if you would rather not wait for me
One-off work
Not everything needs a monthly arrangement. Server setup and hardening, a security review, a migration, or recovering a machine that is already in trouble are quoted individually. Describe what you need and you get a fixed number before any work starts.
As a rough anchor, one-off work generally starts at €50.