How We Keep Client Sites Secure
Security & continuity
A security posture that stands up to vendor due diligence.
Organisations with compliance obligations need more than a hosting invoice. This page states our posture plainly, in the terms a procurement team asks.
Infrastructure
Client sites run on Pressable, an Automattic company, on the WP Cloud platform. The primary data centre is in Amsterdam, in the EU, and EU data residency is maintained for the contract term. That facility holds SOC 2 Type 2 and ISO/IEC 27001:2013 certification. All Pressable data centres are Uptime Institute Tier III or IV certified. Pressable holds Secure Hosting Alliance certification, awarded by the i2 Coalition in May 2026. Pressable publishes the certification list for each data centre: datacenter certifications and regulatory compliance. Where a client specifically requires in-country Irish residency, dedicated Irish hosting is available and quoted on application.
SOC 2 · ISO 27001
Hardening and monitoring
Every site we host sits behind a web application firewall, and Premium and Custom plans add a hardening layer with login protection and file integrity monitoring. HostLogic Shield, our own security header and script control plugin, is being rolled out to managed sites in sequence. Continuous vulnerability scanning runs across our whole managed estate, with patch-level reporting. Malware scanning runs daily. Monitoring and alerting run 24/7.
DAILY · 24/7
Backups and recovery
Every site has real-time off-site backups with one-click restore. Backups are retained for a minimum of 30 days and stored independently of the hosting platform. Our documented Business Continuity and Disaster Recovery Plan sets a 4-business-hour recovery target for site availability, and is tested at least annually. The plan is available to clients on request.
30-DAY · 4H
Access and accountability
Access to client sites is role-based, with an audited activity log. Administrative credentials are held in an access-controlled credential store, not by any single person. Three named contacts can each invoke our continuity plan, so the service does not depend on one individual.
NAMED · LOGGED
Service commitments
Our contractual uptime commitment is 99.9%. Critical incidents receive a response within 1 business hour. Monthly reporting covers uptime, actions taken and vulnerabilities patched. Clients subject to outsourcing obligations receive cooperation with audit and access requests, a GDPR Article 28 Data Processing Agreement, and breach notification without undue delay so the 72-hour regulatory window can be met.
99.9% · 1H
Certifications, stated honestly
Our infrastructure partner’s certifications are listed above and are independently verifiable. At company level, HostLogic does not yet hold third-party certification such as ISO 27001 or Cyber Essentials. We would rather state that plainly than imply otherwise. Our security posture is demonstrated through the documented controls on this page, all of which are operational and all of which we answer for in vendor due diligence.
PLAIN
Questions from your compliance team?
We complete vendor security questionnaires as a normal part of onboarding. Ask for the BCP/DRP or the ESG policy and we will provide them.
Or call +353 86 738 1271.
Document control: owned by Jack O’Connor, Managing Director. Reviewed 1 September 2026. Reviewed at least annually.