Somebody has to apply the security patches

What's included every month

• Drupal core and contrib security patches, applied and tested — not just reported to you
• PHP and dependency updates, with a tested upgrade path
• Uptime and error monitoring, with someone who reads the alerts
• Backup verification — including actually restoring one, which is the part everybody skips
• A monthly report: what was patched, what was found, what needs a decision
• A fixed pool of change hours for small work, so you don't raise a purchase order to change a phone number
• Incident response within an agreed window

Tiers

Essential	Security patching, dependency updates, monitoring, monthly report. 2 change hours included. Response within 3 business days. €750/month
Standard	Everything in Essential, plus backup restore testing, performance monitoring, quarterly accessibility spot-check. 6 change hours included. Response within 1 business day. €1,650/month
Critical	Everything in Standard, plus same-day response, out-of-hours incident cover, an annual accessibility audit, and a standing upgrade roadmap. 14 change hours included. €3,200/month

What isn't included

New features, redesigns and major version migrations. Those are projects and get quoted as projects — bundling them into a retainer is how retainers quietly become unprofitable for one side and unpredictable for the other.

No lock-in

Monthly terms, 30 days' notice, and full documentation handed over if you leave. If a retainer needs a contract to keep a client, it isn't working.

Relevant experience

Currently maintaining 150+ modules in production on an EU agency platform serving over 500,000 users under strict compliance requirements, including stabilising a legacy Drupal 9/10 codebase that had drifted. Seven years maintaining a Czech government estate across three major Drupal versions.

This is the work I do daily, not an add-on to project work.