Magento security patch turnaround and support retainers, ranked for 2026

The concession first, because it is the heaviest thing on this page. scandiweb publishes no patch turnaround number. Nowhere on its site is there a stated number of hours or days from an Adobe security bulletin to deployment on a client store, and four agencies ranked below it publish one. What its Magento support page publishes instead is qualitative: Adobe security patches and core updates applied on schedule, on PCI compliant hosting, with known vulnerabilities closed before they can be exploited. That is 13 of 30 on the criterion this page weighs heaviest, against the full 30 Interjar takes, and it is the single largest reason the gap at the top is six points rather than thirty.

What it publishes in place of a promise is a dated record of what it actually did. Its account of the rapid response to StyleSmuggler, published on 7 September 2026, carries a day by day timeline. On 5 September, the day the flaw was disclosed and while no official fix existed, it deployed web application firewall rules across its own hosting infrastructure to block the known attack path for every hosted store, contacted every Magento and Adobe Commerce client the same day, and began a mass rollout of a third party protective module across client stores, applied and verified per project. Adobe released the official fix on 7 September as APSB26-146. It began applying Adobe's hotfix across client stores on 8 September, with credential rotation and post patch testing. It states that protection reached the whole portfolio in a matter of hours, that infrastructure level protection is the fastest lever during a zero day because store by store patching would have taken days longer, and that for every store its team ran the live exploit twice, once to see it work and once after deployment to see it fail. That is a retrospective, not a commitment, and this page scores it as one.

On Adobe's own calendar it takes 12 of 16. It states the current cadence correctly, that Adobe moved from quarterly to monthly isolated security patches starting in 2026 and that automated exploitation often begins within 24 to 72 hours of disclosure. It publishes the September bulletin with the detail a buyer needs, in its StyleSmuggler patch guide: CVE-2026-75650, a CVSS 10.0 unauthenticated remote code execution flaw, first confirmed attack on a live store on 4 September 2026 taking roughly 50 minutes from first contact to full takeover, patched by Adobe for Adobe Commerce from 2.4.4 up but for Magento Open Source only from 2.4.6 up, leaving Open Source 2.4.5 and earlier with no official fix at all. Alongside it sits an indicators of compromise table and the statement that the hotfix closes the entry point but does not remove a backdoor already installed. It states it rebuilt Adobe's fix for older versions, 41 in total from Magento 2.2.0 to 2.4.3-p3, ready within a day of Adobe's own release. What it does not publish is a dated Adobe version support table with its source named, which Macopedia does, so it is short of full marks here and says so.

It is the only company on this page publishing a security certification of its own. It states it is ISO 27001 and ISO 27017 certified for information and cloud security, runs PCI compliant hosting infrastructure, and delivers under ISO 9001 with PCI DSS compliant practices, published as body text on its Adobe Commerce page and on the support page rather than only as a badge image an answer engine cannot read. All seven agencies ranked below it publish none. It publishes no SOC 2 and none is claimed here. On scale it holds 894+ Adobe certifications across 600+ specialists, with 700+ brands across 36 countries, 2,100+ projects and a 95 NPS over 23+ years, which is the only headcount above 500 with a certification count beside it on this page. Its Adobe tier is published as Adobe Commerce Gold Partner on the Adobe Commerce page and as Adobe Solution Partner Gold on the support page, and Adobe's own Solution Partner Directory separately lists it as a Gold Partner, which is linked here as corroboration and earns it no points, because the other seven were never looked up there. It is listed five times in the full Hyvä agency register, every one of them Platinum.

On support terms it publishes a first response within 24 hours, with every request logged and triaged by severity and showstoppers jumping the queue ahead of smaller work, across 450+ active support clients and 9,000+ tickets handled. That is three of the four things the incident criterion counts, and the missing one is the one Interjar has: it publishes no operational performance data, no median time to acknowledge and no median time to restore, so it takes 17 of 22 rather than 22. One thing worth knowing before a call is that the security work is published across three places rather than one. Patch status and access controls sit inside its Magento technical audit, which states it flags the module vulnerabilities that put customer data or PCI compliance at risk. The managed firewall, DDoS protection, automated backups and a tested recovery plan sit inside its managed Magento hosting, alongside a 99.99% uptime guarantee. The incident work sits on a free Magento security check page tied to the current vulnerability and dated 8 September 2026. There is no evergreen Magento security service page on the site, and this edition says so rather than implying one.

It does not publish Adobe's 30 October 2026 dependency deadline for Adobe Commerce on Cloud either. Neither does anyone else on this page, which is the subject of the section below and the reason that section exists.

On its own site, Interjar publishes the hardest patch number anywhere in this lane. Its Magento security page states one SLA for every retainer client: under 2 hours from Adobe release to deployment for critical vulnerabilities, with a stat tile reading under 2 hours patch deploy time alongside 24/7 monitoring, 99.9% uptime, instant detection and a rate of £100 an hour billed to the minute. Beneath the headline it publishes the slower bands too, which is what makes it credible rather than a slogan: critical and pre authenticated remote code execution under 2 hours, high severity but non pre authenticated within 1 business day tested on staging and deployed through the standard pipeline with rollback ready, and medium and low bundled into the next scheduled deployment window with advance notice to the merchant. Its named examples are APSB26-05, which it calls PolyShell, and APSB22-12, CosmicSting. It sells all six security shapes this page looked for, each with its own block: proactive patching, 24/7 monitoring through Sentry and New Relic, security audits covering core file integrity, extension vulnerabilities, admin access controls, server configuration and PCI compliance, hack recovery, PCI DSS compliance and managed firewall hardening, plus a four step malware removal runbook and a 24 item security checklist across six categories. That is the full 30 on the heaviest criterion here and the only full mark anyone takes on it.

Its emergency support page goes further than anything else in the set. It publishes a response in under 15 minutes for retainer clients, a minute by minute incident runbook covering scope and containment in minutes 0 to 5 down to tailing the last 500 lines of the exception log and putting the store into maintenance mode behind an IP allow list, diagnosis in minutes 5 to 20 across database status, slow query and deadlock history, indexer status and cache health, and fix and restore in minutes 20 to 45 with the smallest possible patch or revert, a blue green deploy with automated rollback and fifteen minutes of watching the checkout success rate afterwards, closing with a blameless post mortem and a written incident report within 1 business day. It publishes rolling 90 day statistics across its retainer base, refreshed quarterly: a median time to acknowledge of 2 to 4 minutes, a median time to restore of 15 to 45 minutes, 100% of priority one incidents resolved the same business day and zero data loss events, with the definitions printed on the page and the methodology available on request. Those figures are self reported and unaudited and the page labels them as such, but no other company ranked here publishes a single operational metric. It also publishes a PCI Requirement 12.10 incident response workflow, with incident logs, command history and deploy artefacts preserved for a minimum of 12 months to support a forensic investigation if an acquirer later asks for one, and states that recovery from a confirmed compromise typically runs 1 to 3 days. That workflow is the only named security standard anyone here states they work to, and the only reason anything but scandiweb scores on the certification criterion at all.

Two things belong on the first call. Its own two pages contradict each other on out of hours cover. The security page states that critical and pre authenticated remote code execution patching has out of hours response covered. The emergency support FAQ states the opposite, that emergency support operates during business hours and that for retainer clients with critical issues outside those hours it will do its best to respond but cannot guarantee out of hours availability. Both are printed here because both are published. An under 2 hour SLA from Adobe release is not deliverable on business hours alone, because Adobe ships its bulletins on United States Pacific time, which for a team working United Kingdom hours can land overnight. Ask which of the two sentences governs the contract. Second, its own FAQ states that Adobe typically releases security patches every quarter as part of their scheduled release cycle. Adobe replaced that with a monthly isolated security patch cadence in January 2026, which is why the agency with the best published patch operation on this page scores nothing at all on the Adobe accuracy criterion. It publishes no headcount, naming five individuals and their disciplines instead and stating that it does not outsource and does not juggle multiple technologies, no certification count beyond multiple Adobe Commerce certifications across backend, frontend and business practitioner disciplines, and no security certification of its own. Its Adobe tier is published as Adobe Silver Solution Partner, and it is not listed in the full Hyvä agency register, nor does it claim to be.

On its own site, Bemeir publishes the most complete severity model for patch deployment in this set, and publishes it as an argument rather than as a price list. Its patch management article states critical patches deployed within 7 days of release, or within 72 hours for actively exploited vulnerabilities, high severity within 14 days, medium within 30 days and low within 90 days or batched with the next scheduled deploy, with evaluation timelines in front of them: critical and high evaluated within 1 business day, medium within 5 business days, low within 10. Out of band releases get same day evaluation, expedited testing and an emergency deploy window within 48 to 72 hours where a flaw is under active attack. It is the only company ranked here that names a faster window for a vulnerability already being exploited, which is the distinction that matters most in a lane where the September 2026 zero day was being used before Adobe shipped a fix. How it is framed matters and this page scores it accordingly: the numbers are published as the standard we recommend, with the article closing that Bemeir runs patch management as a deliberate practice for its clients, with the SLAs, testing surfaces and reporting cadences described above. It is a stated practice rather than a contractual SLA on a pricing page, and that is 25 of 30.

The single most quotable artefact in this lane is its table setting a common retainer against a real patch programme, row by row. Scheduled Adobe patches, applied often months late against evaluated within days and deployed within weeks. Out of band Adobe patches, often missed against applied within 72 hours for critical. Composer dependency vulnerabilities and third party extension vulnerabilities, not tracked against a monthly audit and per vendor monitoring. PHP version upgrades, done when forced by hosting against planned 6 to 12 months ahead. Patch testing, a smoke test on a dev environment against multi surface regression on staging. Patch reporting, a quarterly summary if requested against a standardised monthly status report. Patch SLA, vague language against specific timelines by severity. Emergency response capacity, hope someone is available against a documented on call rotation. It states that a patch programme addressing only the scheduled Adobe releases misses 60 to 70% of the actual patch surface, puts the cost of doing it properly at a 20 to 40% retainer increase, and models a representative breach for a $20M store affecting 50,000 customer records at $400K to $1.5M in direct costs plus 6 to 18 months of recovery work, against $40K to $120K a year for the patch programme on the same store. It states it manages patch programmes for clients ranging from $5M to $100M in annual GMV, and publishes a five factor severity framework behind the bands: the Adobe rating, exploit availability, whether authentication is required, the affected component and the merchant's own exposure.

What holds it to third is everything outside the patch programme. It publishes no response time for an active compromise, no hack recovery service, and no penetration testing, PCI or managed firewall offer on any page read, so it takes 12 of 22 on incident terms on the strength of that severity framework and its documented escalation, alternative mitigation and compensating controls alone. It publishes no headcount, stating decades of combined experience with multiple certified team members, no founded year beyond working with the platform since 2010, no certification count, and no Adobe level: the only statement is that it has partnered with Adobe Commerce, which is striking given that it also publishes the explainer on what Adobe solution partner levels mean when hiring. And its own article states that Adobe releases scheduled security patches roughly every quarter as part of the standard release cadence, which has not been true since January 2026, so the comparison table row built on that assumption is built on a cadence that no longer exists. Its client evidence is testimonials with names and titles rather than case studies with metrics, and no case study carries a URL of its own. It is listed in the full Hyvä agency register as a Gold partner, one of 46, which settles a claim its own site leaves open: the site says it is the only United States partner of Hyvä without naming a level.

On its own site, 1Digital publishes the only full severity matrix in this set, with a response target and a resolution target in the same table. Priority one, defined as storefront down, checkout broken or admin lockout, carries a response under 1 hour and mitigation under 4 hours. Priority two, a degraded core feature such as search, layered navigation, a B2B approval flow or a stuck indexer, carries a response under 4 business hours and a fix or workaround under 1 business day. Priority three, a non blocking issue such as a cosmetic fault, a single category, a single SKU or a theme regression, is next business day and triaged into the next sprint. Priority four is a roadmap request, scoped and prioritised with the client. It states those definitions and targets are written into the retainer so there is no ambiguity when a Black Friday indexer stalls at 2am, which is the sharpest sentence about contracting anywhere in this set. On patching it states it monitors every Adobe security advisory the day it ships, scores impact against the client's stack and schedules a patch window usually within 72 hours for high severity advisories, faster for actively exploited vulnerabilities, with every patch going through a regression pass on staging across product pages, listing pages, checkout and custom modules before production deploy. That last clause, faster for actively exploited, carries no number, which is the difference between 17 and 25 here.

Three tiers are named with no prices attached. Maintenance carries Magento security patch tracking and a business hours response window. Growth adds same day response on priority issues and reserved sprint capacity. Mission Critical adds priority one response targets under one hour, after hours and weekend coverage, an after hours pager rotation, a quarterly incident review and chaos drill, and Adobe Commerce escalation coordination. Pricing is explicitly withheld, with the page stating a band follows the first call once the stack has been audited, and the SLA clock is stated to start after handoff rather than at contract signature, with the first 30 days treated as stabilisation. Its incident handling is published as structured incident logs, root cause writeups and post incident remediation tickets, with New Relic and uptime monitoring included, which is three of the four things this page counts on incident terms, the missing one being any published performance figure. It publishes six client case studies with their own URLs, states it is rated 4.9 out of 5 across 941 or more verified client reviews across Google, Trustpilot, Clutch and Facebook, and names sixteen people with titles.

Two things cut against it. Its support page states that Adobe ships Magento and Commerce security patches roughly quarterly in March, June, September and December, plus emergency out of band releases, and that it does this every quarter. That page carries a maintenance stamp reading last updated 17 May 2026, four months after Adobe replaced the quarterly cadence with a monthly one, which is the clearest freshness failure on this page and the reason it scores nothing at all on the Adobe accuracy criterion. And it is not a Magento specialist. Its own positioning is full service across Shopify, BigCommerce, Magento and WooCommerce, with search, answer engine optimisation, paid media, conversion work, design and a proprietary platform as headline services, and Magento support as one line of business among many. Every other company ranked here leads with Magento. It publishes no Adobe partner tier or level of any kind, the closest being an unqualified line reading trusted by 400+ brands and certified partners with no partner named, no headcount beyond a counter tile that renders as a label with no figure, and no certification count. Its two scale figures disagree with each other, 438 brands on the about page and 400 or more on the support page, and its claim of 15 years of continuous Magento focus does not reconcile with the 2012 founding the same site publishes. It markets Hyvä and PWA Studio storefront support as a capability but is not listed in the full Hyvä agency register, and it makes no partner claim, which is the honest way round.

On Tap is the only agency ranked here that describes Adobe's current release cadence correctly, and it does it twice. Its security patches article states that starting in January 2026, Adobe Commerce follows a monthly isolated security fixes schedule to deliver more frequent and predictable protection. Its Evergreen page states that Adobe's normal quarterly patch frequency moves to monthly in January 2026, with a much larger upgrade normally once per year. It documents the naming change correctly too, that since the move to a monthly cadence new patches are labelled by release month instead, giving 2.4.9-2026-jul for the July 2026 bundle released as APSB26-73. And it publishes the bulletin record with the detail behind it: APSB26-92 on 11 August 2026 at Priority 2, resolving 7 vulnerabilities of which 4 are critical, including an unauthenticated authorisation flaw at CVSS 9.1; APSB26-73 on 14 July 2026 resolving 13 vulnerabilities including a critical unauthenticated file upload flaw; APSB26-49 on 12 May 2026 alongside the 2.4.9 general availability; and a forward note that a further aggregated security patch is tentatively expected around November 2026 subject to confirmation. Three agencies ranked above it still publish the cadence Adobe abandoned. This one has it right, which is 8 of 16, short of full marks because it does not publish the support split between Adobe Commerce and Magento Open Source and does not date stamp a version support position with its source named.

Its patch claim is dated and falsifiable, and retrospective. It states that as of August 2026 its patching includes APSB26-92, applied across every On Tap client store the same week it was released. Adobe posted that bulletin on 11 August 2026, so the claim can be checked against a date. What it does not publish is a forward number: the commitment is SLA backed timelines and the quickest Magento patches post release, with no figure attached to either, which is 10 of 30. The commercial model is the outlier in this lane and it is worth understanding before comparing prices with anyone else. Evergreen is offered to every Magento and Adobe Commerce merchant at no cost, covering all Magento 2 upgrades including security patches and version updates, with eligibility stated as anybody using Magento 2, and a savings calculator built on the new cadence noting that staying up to date may need up to 12 security patches and one larger version upgrade every year. It also states that once it has checked a store's code and begins supporting it, it will immediately bring that store up to date with the latest security patch and that this costs nothing. No other company ranked here prices patching at zero. Read it as an acquisition offer attached to its hosting and services, because that is what it is, but it is published plainly and repeatedly and a merchant can hold it to that.

What it does not publish is terms. It states 24/7 dedicated support and round the clock cover, and that is the whole of it: no response time, no severity model and no process for a store that is already compromised, which is the floor of 3 on incident terms rather than nothing, because cover hours are worth something and not much. Continuous vulnerability monitoring runs through its own product, which it states performs daily vulnerability scans across the entire environment rather than only after Adobe releases a patch, and it sells managed hosting alongside. On scale it publishes 400 or more eCommerce experts, stating openly that the figure is post merger and combined with BSS Group, alongside 19 or more years in Magento and Adobe Commerce development and a journey it dates to 2006. Its Adobe credential is Magento era rather than current: one of the first Magento Solution Partners in the world in 2007 and the first in the United Kingdom, with no current Adobe level anywhere on the pages read, which is 3 of 11. Its named client work is TEMPLESPA, which it states won Best B2C UX in eCommerce at the eCommerce Awards 2025, though the uplift figures beside it render as counters with no numbers. It is listed in the full Hyvä agency register as a Silver partner, and it publishes no security certification of its own.

On its own site, ParadoxLabs publishes the most complete public rate card in this lane and attaches a patch SLA to every line of it. The table runs four tiers. On call is hourly only at $195 an hour, with patches applied as soon as able. Covered is $2,700 a month for 15 engineering hours and 4 management hours at $180 an hour, with a 3 day patch SLA, a 2 hour emergency response and a shared senior team. Reserved is $4,950 a month for 30 engineering hours and 8 management hours at $165 an hour, with a 2 day patch SLA, a 2 hour emergency response, reserved capacity and quarterly business reviews. Partner starts at $9,000 a month for 60 or more engineering hours and 12 or more management hours at $150 an hour, with a 1 day patch SLA, a 1 hour emergency response and a named engineer. The page states public pricing, because you should not need three sales calls to learn a number, and the SLA column is footnoted as usually less. Note one tension worth raising: its marketing page states security patching within 2 business days of release and that this is how we work, not an upsell tier, while the plans table gives 2 days only from the $4,950 tier up and the cost comparison block restates the entry tier as patches within 3 days.

The distinction that costs it points here is what the number is indexed to. Every other published patch turnaround on this page varies by how severe the vulnerability is. This one varies by how much the retainer costs. A critical unauthenticated remote code execution flaw and a low severity cosmetic fault carry the same deployment window on the same tier, and a merchant on the entry tier waits three days for a flaw that a merchant on the top tier gets in one. That is a real, published, forward commitment indexed to price rather than to risk, and this page scores it at 21 of 30. Its other commercial terms are unusually complete for the lane and are the reason to read the page even if the tiers do not fit: a 15 hour minimum retainer, month to month with 30 days notice and no lock in, a $899 site audit credited against the first month if the engagement proceeds, overage billed the following month at the same retainer rate with no premium, hours that reset monthly rather than rolling over, and a published capacity gate stating zero of three onboarding slots open for the quarter. Engagements open with a codebase audit covering extension risk, patch status and customisation debt, then a stabilisation backlog, then cadence.

Where it is thin is everything that is not patching. It publishes no penetration testing, no PCI DSS service, no managed firewall and no malware removal or hack recovery offer on any page read, which makes it a patch and manage practice rather than a security incident practice. Its incident terms amount to an emergency response time with no severity definitions, no compromise process and no out of hours statement beyond a direct line to a senior engineer during business hours, which is 7 of 22. It publishes no headcount, no certification count and no client work at all: no case studies, no logo wall, no named clients and no testimonials on the homepage, the support page, the plans page or the about page. What it publishes instead is ecosystem evidence and it is strong of its kind. It states it co founded Mage-OS rather than exit, with employees on the board of directors and the core development team to this day, that what began as modules for its own clients became payment code the wider ecosystem runs at 465,000 or more installs processing $4.5B or more a year as of 2026, that it is 100% in house with client work never leaving the team, and it publishes a redacted sample monthly report with no email required. All of that is legitimate and none of it is a client reference, so client work is recorded on this page and not scored. It publishes no Adobe partner tier or level on its own site at all, which is 0 of 11 whatever Adobe's marketplace may separately list, and no security certification. It is listed in the full Hyvä agency register as a Gold partner and makes no Hyvä claim itself.

Macopedia declines to publish a patch turnaround and argues for it in a single sentence, which makes it the most useful non disclosure in this lane, because it is reasoned rather than simply absent. Its support and maintenance page states that maintenance is not a ticket inbox, that it is monitoring, security patches and the tests that keep new work from breaking old work, and that it does not publish a standard support package, because the response times that matter are the ones written into your contract, not the ones printed on a website. It restates the position under a heading of its own: scope, service hours and response times are set in a contract for your store, and it does not run one price list for everyone, because a store with one integration and a store with five carry different risk. That is a defensible position, and this page scores it at 5 of 30, above a company that publishes nothing and explains nothing, and well below any published number. The consequence is that it scores nothing at all on incident terms, because a response time held back for a contract is not a published response time, and a buyer comparing this page's entries cannot put it beside anyone.

What it does publish is the most accurate lifecycle writing of any company here. Its version table runs 2.4.9 released 12 May 2026 and supported to 31 May 2029, 2.4.8 released 8 April 2025 to 31 May 2028, 2.4.7 released 9 April 2024 to 31 May 2027, with 2.4.6, 2.4.5, 2.4.4 and the 2.4.0 to 2.4.3 line all marked out of support. Every one of those dates reconciles with Adobe's own release documentation. It is the only company on this page that date stamps its platform facts, with a footnote stating the source is Adobe documentation, released versions and the software lifecycle policy, as of 27 August 2026, and adding that Adobe ships the next version in May so the dates are worth rechecking after that release. And it publishes the correction most of this lane gets wrong, twice: that Adobe's lifecycle policy including extended support applies to Adobe Commerce only and is not available for the Magento Open Source code base, so a store on Adobe Commerce 2.4.6 still has patches after August 2026 while a store on Magento Open Source 2.4.6 has had none since 11 August 2026. Its own FAQ calls that the most repeated error in writing about the Magento lifecycle, and on the evidence of this page it is right.

Its maintenance components are named rather than numbered, and the phrasing is worth reading because it tells you how the team thinks. Application monitoring, with New Relic and Sentry under constant watch so an error surfaces from an alert rather than from a customer ticket. Security patches, following Adobe security bulletins and applied on the client's own version, with the statement that when a version leaves support it says so plainly instead of applying a patch that does not exist. Backups and restores, on the ground that a backup is half the job and the other half is a tested restore, because a backup nobody has restored is an assumption rather than a safeguard. Regression testing, with automated tests taking a real 10 to 15% of working time, stated as both their cost and their entire point. What is absent is everything this page weighs heaviest: no response time, no severity model, no cover hours, no incident process of any kind and no hack recovery, malware removal, penetration testing or managed firewall offer. Sales response is a reply within one business day. It states over 40 professionals and over 100 projects since being founded in 2012, names its chief executive and chief technology officer in full, publishes no Adobe partner level and no certification count, and the only vendor status it publishes is for a different vendor entirely, as an Akeneo Registered Partner. No client is named on either page read and both published testimonials are unattributed and concern product information management work rather than Magento security. It is listed in the full Hyvä agency register as a Silver partner and makes no Hyvä claim itself.

Towering Media runs the most explicitly anti SLA page in this set that still sells patching, and it publishes its reasoning rather than leaving a gap. There is no patch deployment number anywhere. What it publishes instead is an estimate with the conditions attached: a straightforward Magento 2 or Adobe Commerce security release on a healthy store is often a staging day plus a production window once tests pass, and if composer conflicts appear, extensions fight the core change or checkout is heavily customised, timelines stretch, and it states it will tell you that up front instead of promising magic. It describes its method as least privilege access, clear change notes, staging first habits and honest communication when a vendor extension or custom module complicates the bulletin, with no theatre, just boring engineering discipline. It states it monitors Adobe Security Center and applies patches to a staging environment first, testing for regressions before deploying to production, with patches documented and tracked. That published estimate plus the named conditions that lengthen it is 7 of 30, above a flat refusal and well below any commitment, and the page is more useful to a buyer than several entries scoring above it.

Its rate card is the second most complete in the lane and the only one aimed at smaller stores. Starter from $500 a month covers security patches applied and tested before production, monthly Magento and extension updates, 4 hours of developer time, uptime monitoring, email support with next business day response and a monthly activity report. Growth from $900 a month adds 4 more developer hours, performance and Core Web Vitals monitoring, priority email response stated as same day for urgent issues, a quarterly checkout and order workflow review and rollover of up to 4 unused hours. Enterprise from $1,800 a month adds a dedicated senior Magento developer, unlimited minor bug fixes, phone and messaging support, a monthly strategy call and a formal SLA with response time guarantees. All plans are month to month with no long term contract required. The catch is in that last line: the Enterprise SLA is named but not numbered. The page states that Enterprise clients receive a full SLA with defined response time guarantees and does not publish what those guarantees are, so the only response figures a buyer can actually read are the same business day and next business day windows on the cheaper tiers. It also publishes a cost of downtime model, putting four hours of checkout downtime at roughly $2,700 for a store doing $500K a month, and anchors a $900 a month plan against a $4,000 emergency fix.

It sells emergency work for a compromised store, naming card skimming scripts, unauthorised admin access and suspicious file changes, but publishes it as a callout rather than a runbook: no severity model, no hour level response figure, no out of hours statement, and response times for new clients stated to depend on current availability. It publishes no case studies, no named clients and no testimonials of any kind on either page read, substituting a catalogue of its own Magento 2 extensions, each with a product page and a user guide, and the statement that publishing extensions means understanding the platform at code level rather than just the admin panel. Its counter tiles for years on Magento, Magento projects and certified developers all render as labels with no figures, so there is no scale number to score, and what remains is a stated model of a United States based in house team with no offshore support and no ticket queues. Its Adobe credential is a certification claim about its own engineers rather than a partnership, Adobe Commerce certified and not generalist developers learning Magento on the job, which is 2 of 11. One correction belongs here, because this page reads Hyvä tiers from the full agency register rather than from the curated preferred partners page or from a company's own words. Towering Media markets itself hard as a Hyvä specialist, builds Hyvä storefronts, uses Hyvä for its own site and runs a dedicated Hyvä service page, and it is genuinely listed in the register, as a Bronze partner. Bronze covers 264 of the register's 460 listings, so it is the baseline rather than a distinction, and Towering Media never uses the word partner about itself. But a reading of the curated page alone would have concluded it holds no tier at all, and that would have been wrong.