What managed hosting should include for an online store

A Bengaluru brand selling phone cases, chargers and cables runs a festive sale every October. Last year the store slowed to a crawl on the first evening, the checkout timed out for some customers, and nobody could say whether the problem was the server, a plugin or the payment gateway. The hosting plan said "fully managed". The support reply, sent the next morning, said the server was fine and suggested they check their code.

Most merchants who have been through something like this learn the same lesson: "managed hosting" is a label, and the specification is what counts. Two providers can use the same words and mean very different things.

What managed should mean in plain terms

At its simplest, managed hosting means someone other than you keeps the store running. They look after the servers, keep the software updated, watch for problems and fix them. You run the business: products, prices, orders, marketing and customers.

The useful question is where exactly the line sits. Ask every provider to state, in writing, which of the following items they handle, which they share with you and which are yours alone.

The checklist

Servers and capacity

The provider should run the servers, the database and the file storage for images, and size them for your traffic. Ask what happens when traffic jumps. Some setups add capacity automatically, some need notice, and some simply slow down. If you run planned sales, tell the provider your dates and ask what they will do beforehand.

Software updates and security fixes

An online store runs on layers of software: the operating system, the web server, the database, the commerce platform and any extensions. Each needs updates, and security fixes need applying promptly. A managed provider should apply these for you, test them before they reach your live store, and tell you about anything that changes how the store behaves. Ask how quickly security fixes are applied and who decides when.

SSL certificates

Your store should load over HTTPS on every page, with the certificate renewed automatically. This should be included without you having to think about it. If a provider charges extra or asks you to renew it yourself, treat that as a sign of how much else is left to you.

Backups you can restore

Backups are only useful if they can be restored. Ask:

• How often the store and its database are backed up.
• How long backups are kept.
• Where they are stored, and whether that is separate from the live servers.
• Whether restores are tested, and when one was last done.
• How you request a restore, and how long it takes.

Also ask whether you can get a copy of your own data on request. That leads to the next point.

Your data and how you leave

Your products, customers and orders belong to you. A good provider will say so in the contract and will export them in a standard format, such as CSV files, when you ask. Ask what an exit looks like in practice: what you receive, how long it takes, and whether there is a charge. Do this before you sign, when everyone is in a good mood.

Monitoring and incidents

Someone should watch whether the store is up and responding, and be alerted when it is not. Ask who is alerted, what hours they work, how you will be told about an incident and how you report one. After a serious incident, ask for a short written note of what happened and what changed.

Be careful with uptime percentages. A figure on a pricing page means little unless the contract defines how it is measured and what you get if it is missed. Ask for the definition and the remedy along with the number.

Performance

A store should load quickly on a mid range Android phone on a mobile network, because that is how most Indian shoppers will see it. Images should be compressed and served from somewhere close to your customers. Ask what the provider does about speed, and how you can check it yourself.

Payment data

Card details should be handled by your payment gateway and never stored on your store's servers. The gateway carries its own PCI DSS obligations for card data. Ask the provider to confirm that the checkout passes card entry to the gateway, and that no card numbers are written to the store's database or logs.

Admin access and accounts

You will want staff to log in with their own accounts and only the access their job needs: packing staff see orders, the catalogue team edits products, and only the owner changes payment settings. Ask how accounts are created and removed when someone leaves. If two factor authentication matters to you, ask whether it is available or needs adding.

Support

Support is where expectations differ most. Get these written down:

• Which channels you can use, such as email, phone or a ticket system.
• The hours support is available.
• What counts as urgent, and how urgent issues are handled outside office hours.
• Whether support covers questions about how to use the platform, or only faults.
• What is billed separately.

A provider who is vague here will be vague on the day you need them.

What managed hosting does not cover

Even with a good provider, some things remain yours. Knowing them avoids arguments later.

Your content and catalogue

Product data, images, prices, descriptions and policies are your responsibility. A provider keeps them safe. It does not check them.

Your legal obligations

As the seller, you are responsible for meeting the rules that apply to selling online in India. These include GST on your sales, the Consumer Protection (E-Commerce) Rules, 2020 on how you display seller details, prices, returns and grievance contacts, and the Legal Metrology (Packaged Commodities) Rules for the declarations required on packaged goods. Your shoppers' details are personal data under the Digital Personal Data Protection Act, 2023, which makes you responsible for how that data is collected and used, including responding to a personal data breach. Your hosting provider handles data on your behalf and should help, but the obligation stays with you. Confirm the specifics for your business with your CA or lawyer.

If you need help with consent records and DPDP processes, TrustOS, at dpdpatrustos.com, is the Code Colonies group's compliance product for this.

New features and custom work

Managed hosting keeps what you have running. Building something new, such as a returns workflow or an ERP connection, is development work and is usually priced separately. Ask how that is quoted and billed so it does not come as a surprise.

Third party services

Your payment gateway, courier aggregator, email and SMS providers run their own systems. When one of them has an outage, your provider can confirm the cause and help you switch or wait it out, but cannot fix their systems.

Questions to ask before you sign

Bring this short list to every conversation:

1. Which parts of running the store do you handle, and which are mine? Please put it in writing.
2. How often are backups taken, where are they kept, and when was a restore last tested?
3. How quickly are security fixes applied?
4. What happens to the store during a sale with five times the usual traffic?
5. Who do I contact when something breaks at 9 pm on a Saturday, and what happens next?
6. How do I get all my data out if I leave, and what does it cost?
7. What is included in the price, and what is billed separately?

Clear, specific answers are a good sign. "Everything is taken care of" is not an answer.

How ShopenUp approaches this

On ShopenUp's managed plans, hosting, updates and support are handled by the Code Colonies team, so you work on products and orders. Specifics for your store are given in writing, plan by plan. Ask us the seven questions and we will answer each one for your plan, including what is included and what would be quoted as custom work.

If a different provider gives clearer answers for your needs, choose them.

For how ShopenUp handles hosting, access, payment data and shopper data, see the security page.