Engineering firms
Drawings, method statements and capability claims, where the hard question is what may be published rather than where it is stored.
Engineering firms hostingMost hosting advice treats a website as a target to be defended. In an economy built on export controlled work, it is better read as a publication. Everything on it has been released to the world, deliberately or not, and the sentence that causes trouble is rarely the one an attacker took. It is the one somebody typed, approved without thinking, and left up.
AldoMedia is not in Huntsville. The work is done from Buffalo, New York. There is no Alabama office, no local number, and nobody who is going to drive over and look at your building. Setup, migration and support all happen remotely, over a connection and a telephone, which is how hosting has worked for as long as it has existed.
Hosting companies talk about risk in one direction. Somebody breaks in, takes something, and you find out later. That is real and worth spending money on. It is not the problem that costs a supplier here its place on a programme. Where the engineering is done under contract rather than sold to the public, the damage is usually published on purpose, by somebody with good intentions, because a page looked thin and the site needed updating.
Read your own site the way a compliance officer reads it and the picture changes. Every page is a release to anyone, anywhere, with no record of who took a copy. A foreign national reading your capability list from another country has been handed the same access as a customer down the road, and under some regimes that handing over is itself the event that matters.
So the useful question about a programme supplier's website is not whether the server is hardened. It is whether the words on it were ever meant to leave the building. Those are two different questions, they are answered by two different people, and only one of them has anything to do with hosting.
That is an awkward thing for a hosting company to write, because it points away from what we sell. It is still true. A supplier who buys a larger plan and a security add on, then leaves up a page describing a process in enough detail to repeat it, has paid for the wrong risk.
Send the address. We will tell you what it weighs, how fast it loads on a phone, whether the certificate is valid, what files are hanging off it and whether you can edit and remove pages yourself. What belongs on it is a decision for you and whoever holds export responsibility, not for us.
Nobody outside your business can tell you where that line falls. It depends on what you make, who you make it for, which regime applies to it, and how much is already public because somebody else decided so. Anyone who answers confidently without reading your contracts is guessing with your licence, and that includes us.
What can be said plainly is who decides. Not the marketing person, not the agency writing the copy, and certainly not the company selling the hosting. In firms doing this kind of work there is normally somebody who carries export responsibility by name, and often a deputy who can act in their absence. If website changes do not pass that person, they are not being reviewed. They are being published.
None of that is a hosting setting. It is a reading of your own site by somebody with the authority to say take that down, done once properly and then repeated on a schedule rather than in a hurry after somebody notices.
One part of this is genuinely hosting shaped. Taking a page down does not take it back. Search engines hold copies, archives hold copies, and a file fetched once exists somewhere beyond your reach. The review has to happen before publication rather than after it, and quiet removal is not a remedy. Treating it as one is how a small problem becomes a serious one.
The arrangement that works is dull. A short written rule about what the website may contain. One named approver and one deputy. A record of what was approved and when. An editing setup where a page can be pulled down in minutes by somebody in the building, rather than by a vendor who replies on Monday.
That last point is where ownership stops being paperwork. In an ordinary business, not knowing who controls the domain is an irritation waiting to happen. In a firm holding contracts with disclosure obligations attached, it is the difference between a page being gone before close of business and a chain of emails to somebody who set the site up years ago.
Three things get treated as one and they are separate. The domain registration, which is the name itself. The hosting account, which is where the files live and which card is billed. The editing tool, which is the only one of the three that lets a sentence change. A business can pay for all three every month and reach none of them without asking a favour.
The test takes ten minutes. Sign in to the registrar yourself and see your own company on the record, with a company address as the contact. Reach the hosting account without asking permission. Change one line of text on a live page today, with no ticket and no waiting. Any of those that depends on another party is your real takedown time.
Suppliers in this trade tend to have long, friendly relationships with whoever built things for them, which is why this goes unexamined for years. Nobody behaved badly. A helpful person registered the name on a personal account once and it has worked ever since. Where that person has gone quiet, taking over a website sets out how to recover each piece in order.
Copy, test, redirect the old addresses, switch the domain last, keep the mail records intact and keep dated copies of what was live before and after. You carry on working while it happens.
Most firms that come to us are leaving something rather than starting something. The mechanics are settled and boring. Copy everything across, test it on a temporary address, write redirects for anything whose address has to change, and repoint the domain last so there is never a window pointing at nothing. Website migration sets that order out properly.
What a move usually throws away is the history, and here that matters. A rebuild from a blank page loses every earlier version of every page, and with it any ability to say what was public in a given month two years ago. That question is easy to ignore until somebody asks it formally. Keep dated copies through the change, which is what website backups are for beyond undoing accidents.
Mail is the second thing, and it fails the same way in every town. Somebody rebuilds the domain settings for the new site and does not carry the mail entries over, so messages stop arriving on the day of the switch. Write down what exists before anything is touched. Email migration covers keeping it alive through the move.
The third is worth a sentence because it matters more here than elsewhere. Old addresses that no longer exist should not quietly land on the home page as though nothing had changed. Decide what each one does. A page withdrawn on purpose and a page lost in a migration look identical from outside, and you want to tell them apart.
The hosting line is rarely the largest item on the invoices we are asked to read. Around it sit a domain renewal, a certificate that is very often already included, a builder or theme subscription, a backup add on, a security product and sometimes an email plan still paying for addresses belonging to people who left.
Two of those are not optional. The domain and a working certificate stay. Backups earn their keep only if somebody has actually restored one and watched it come back. A second security product covering ground the plan already covers is the commonest quiet waste we find, and the pitch lands easily here, because the word security already means something specific in these buildings.
Spending more is justified when people log in, when the site holds a real document library, or when a day offline costs you actual work. Visitor numbers alone almost never justify it. A firm whose enquiries arrive by email from people who already know the company is usually paying for capacity nobody uses. What a website costs to run puts the whole picture in one place.
The honest summary for a small engineering or manufacturing firm here is that the plan is almost never the problem. The review process is. One is a monthly charge and the other is an hour with the right person in the room, and only the second one changes what you are exposed to.
Three kinds of business here whose websites carry more weight than their size suggests, each with a page of its own.
Drawings, method statements and capability claims, where the hard question is what may be published rather than where it is stored.
Engineering firms hostingThe capability list is the most valuable page on the site and the easiest one on which to say more than intended.
Manufacturers hostingClient names and programme references are the whole credibility pitch, and the part most often published without asking anyone first.
Business consultants hostingEvery trade we cover is on hosting by industry, and every city on our locations page.
It matters, and not because the agency did anything wrong. A copywriter is paid to make the work sound impressive, which pulls the text towards how rather than what. Nobody in that chain is qualified to judge what your contracts permit you to publish. Have the person who carries export responsibility read the current page line by line, before you think about hosting at all. If the text needs changing, change it, then make sure you can change it again yourself next time without a purchase order.
It can be made to try, and you should not rely on it. Country blocking works by guessing location from an address, it is wrong often, and it is trivially defeated by anyone who cares. Treat it as tidying rather than as a control. Nothing that genuinely must not be published should be sitting on a public page with a filter in front of it. If a document cannot be released freely, keep it off the site and hand it over another way, with a record of who received it.
Probably not, and it is better to know now. Search engines keep cached copies for a while, web archives keep them for much longer, and any file that was downloaded once is on somebody else's machine permanently. Removal stops further spread, which is worth doing immediately, but it does not undo publication. Tell whoever handles your compliance what went up and for how long, and let them decide whether anything more is required. Quietly deleting it and saying nothing is the choice that turns small into serious.
For a public marketing website in Huntsville, almost certainly not. Those plans exist for systems that hold controlled information, and your public site should not be holding any. Buying one does not make a page safe to publish, and it can create a false sense that the question has been handled. Spend the money on a proper read of what is already live instead. If you do have a genuine requirement to store controlled material, that is a separate system with separate rules, and it does not belong on the same account as the brochure.
Tell us what the site runs on, who can edit it, and who signs off on what it says. We will tell you what to fix, what to leave alone, and whether the plan you are already paying for is the right size.
See hosting plans Get help choosing
Or call 716-771-2536. We are in Buffalo, New York, so we answer Eastern time.