ZENDORVAPackages
Three levels of service.
Pick the level that suits where your business is now. Projects are quoted individually. You’ll receive a fixed quote before work begins.
Basic
Basic
For businesses establishing a professional digital presence.
- Basic Website Development
- Mobile Responsive Design
- Basic Security Setup
- Hosting Setup
- 1 Month Support
Growth
Growth
For businesses that need a more capable digital platform.
- Advanced Website or App Development
- UI/UX Design Enhancement
- SEO Optimization
- Branding Support
- Hosting + Maintenance
- 3 Months Support
- Advanced Security & Protection System
Security measures at this levelWhich of these apply depends on the project.
Authentication & User Security
- User signup/login
- Password hashing using bcrypt/Argon2 where appropriate
- JWT/session authentication
- Password reset
- Email verification
- Login attempt protection
Authorization
- RBAC
- Admin/user/guest permissions
- Route protection
- API access restrictions
- Feature-based access control
Input Security
- Input validation
- Data sanitization
- XSS protection
- Parameterized database queries
- File upload validation
API Security
- Protected API routes
- Authentication middleware
- Request validation
- Rate limiting
- Request size limits
- API key protection where appropriate
Rate Limiting & Anti-Spam
- IP-based rate limits
- Throttling
- Temporary blocking
- CAPTCHA integration
- Basic bot detection
Security Headers
- CSP
- HSTS
- X-Frame-Options
- X-Content-Type-Options
- Referrer Policy
- Permissions Policy
Logging & Monitoring
- Request logging
- Error logging
- Failed login tracking
- Suspicious activity logs
- Admin audit logs
Abuse Detection
- Repeated failed-login detection
- Request spike detection
- IP anomaly signals
- Temporary blocking
- Alerts
Data Protection
- Password hashing
- Encryption where appropriate
- Secure token storage
- Sensitive output masking
Environment & Secrets
- Environment variables
- Secret protection
- Environment validation
- Prevention of secret leakage
Dependency Security
- Dependency vulnerability review
- Safe-version recommendations
- Risky dependency identification
- Safe upgrades
Security Testing
- Simulated attack cases
- Input testing
- Vulnerability checks
- Security misconfiguration checks
File Security
- File type validation
- File size limits
- Secure storage paths
- Risky file blocking where appropriate
Session Security
- Secure cookies
- HttpOnly
- Secure
- SameSite
- Session timeout
- Token refresh
- Logout invalidation
Cloud Protection
- Cloudflare configuration where applicable
- HTTPS
- WAF configuration where applicable
- Bot/spam filtering
- Traffic protection
Server Hardening
- Firewall configuration
- Required ports only
- SSH key authentication
- Server hardening
Elite
Elite
For businesses requiring a complete software and security ecosystem.
- Full Website + App Development
- Advanced Security Protection
- SEO & Performance Optimization
- Brand Identity Design
- Ongoing Maintenance & Support
- Advanced Security & Protection System
Security measures at this levelAdditional measures for applications that handle sensitive users and data. Which apply depends on the project.
Authentication & Access Control
- JWT authentication
- Refresh token architecture
- Email OTP 2FA
- RBAC
- Session tracking
- Idle timeout
- Login attempt limiting
- Secure logout/token invalidation
Data Protection
- bcrypt/Argon2 password hashing
- Encryption for sensitive data where appropriate
- HTTPS/SSL enforcement
- Secure cookie configuration
- Environment secret protection
- Prepared statements / parameterized queries
Attack Protection
- SQL injection prevention
- XSS protection
- CSRF protection where applicable
- Frontend/backend validation
- Sanitization
- Secure file uploads
- API/login rate limiting
Server & API Security
- Token-authenticated APIs
- API throttling
- CORS configuration
- Security headers
- Technology fingerprint reduction where appropriate
Monitoring
- User activity logs
- Error logging
- Suspicious activity signals
- Admin security overview
- Login-attempt monitoring
Alerts
- Failed-login alerts
- New-device login notifications where implemented
- Suspicious activity alerts
- Temporary blocking where appropriate
Backup & Recovery
- Database backup configuration
- Scheduled backups
- Restore workflow
- Recovery support
Security Audit & Hardening
- Pre-deployment checklist
- Vulnerability scanning where applicable
- Secure coding practices
- Performance/security optimization
- Unused endpoint review
Advanced Protection
- Device/session tracking
- Token rotation
- Bot/spam protection
- Admin permission restrictions
- Secure file storage
- Anti-clickjacking protection
WAF and DDoS protection, and any advanced monitoring, depend on the hosting provider and the environment. We set them up where applicable and do not assume them by default. Monitoring, alerts and backups are scoped per project and are not guaranteed.
What is included, and what changes the quote
- What affects the quote
- The final quote depends on the number of pages, the features, the integrations, the content and the support you need.
- Included and optional
- Each package lists what it includes. Items marked Optional in the comparison, such as app development in Growth, are quoted only if you want them.
- Hosting
- Basic includes hosting set-up. Growth includes hosting and maintenance. Elite includes hosting, ongoing maintenance and support. Third-party hosting and domain fees are separate.
- Maintenance
- Ongoing maintenance is not part of Basic. Growth includes it alongside hosting, and Elite includes ongoing maintenance and support.
- Revisions
- The number of revision rounds is confirmed in your fixed quote.
- After launch
- Support after launch lasts 1 month on Basic and 3 months on Growth, and is ongoing on Elite. Work outside the agreed scope is quoted separately.
| Included | Basic | Growth | Elite |
|---|---|---|---|
| Website | |||
| App Development | Not included | Optional | |
| UI/UX | Standard | Enhanced | Full identity |
| SEO | Not included | ||
| Branding | Not included | Support | Full identity |
| Hosting | |||
| Maintenance | Not included | ||
| Security | Basic setup | Advanced | Advanced+ |
| Authentication | Not included | With 2FA | |
| RBAC | Not included | ||
| API Protection | Not included | ||
| Monitoring (where included) | Not included | Basic | Advanced |
| Backup (where included) | Not included | Not included | |
| Support | 1 month | 3 months | Ongoing |
Not sure which package fits?
Tell us about the project.
Share what you are building and where it is stuck, and we will recommend the smallest useful starting point.
Typical response time during working hours: 0–1 hour.