The PDG Standard of Care
How the work gets done...in writing.
The written standard for every PDG engagement, so the quality you're paying for is visible instead of taken on faith.
The ten standards at a glance
- Isolated hosting, not shared
- Backups proven, not just promised
- Managed updates, not auto-update-and-hope
- Active security, with disclosure
- Monitoring with real numbers
- Performance measured against revenue
- Accessibility maintained, not audited once
- Every engagement leaves a record
- You own everything
- A named person who answers
Each one is detailed below: what PDG does, what most providers do instead, and what the difference means to you.
Why we wrote this down
A winery owner cannot easily compare VPS hosting against shared hosting, or a real 3-2-1 backup against a nightly snapshot. The work is invisible. A competitor running a $10 shared account can use identical words in their sales copy and pocket the difference. Without a way to make the difference visible, a premium standard becomes unprovable.
Aviation solved this problem decades ago. You don’t ask an aircraft owner to trust that the maintenance was done well, so you hand them the records. Logbooks, inspection sign-offs, compliance documentation. The documentation is the proof, and it’s why that industry can charge for work nobody sees.
This document does the same job: it converts every invisible practice into a visible commitment, and every commitment into a dated artifact you can review.
The ten standards
1. Isolated hosting, not shared
PDG does
VPS hosting via xCloud and Vultr with dedicated resources. Your site runs on its own isolated server instance.
Most providers do
Shared hosting with dozens of sites per server, all competing for the same resources. The “Noisy Neighbor” syndrome.
What it means to you
Your site doesn’t slow down because someone else’s did. Your checkout stays responsive on a release weekend, when it matters most.
2. Backups that are proven, not just promised
PDG does
3-2-1 backups: three copies, two locations, one off-site. Scheduled restore testing with a dated record of each test.
Most providers do
Daily backups, never once verified. The backup exists; whether it restores is a guess.
What it means to you
You know your site can actually be brought back, because it has been, and you hold the record.
3. Managed updates, not auto-update-and-hope
PDG does
Scheduled patching on a known cadence. Anything touching commerce or checkout is verified before it goes live. Every update is logged.
Most providers do
Automatic updates with no review, or no updates at all. Either way, nobody checks.
What it means to you
Your store doesn’t break on a Tuesday because a plugin updated itself overnight.
4. Active security, with disclosure
PDG does
Web application firewall (Cloudflare), off-site malware scanning, and vulnerability management with virtual patching (Patchstack). Monthly statement of what was found, blocked, or patched.
Most providers do
A security plugin nobody reads the output of. No reporting, no transparency.
What it means to you
You find out what was aimed at your site and what stopped it, instead of hearing nothing until something goes wrong.
5. Monitoring with real numbers
PDG does
Uptime and performance monitoring with alerting, reported as actual figures, not adjectives.
Most providers do
Discover the site is down when a customer emails.
What it means to you
You find problems before your customers find them.
6. Performance measured against revenue
PDG does
Baseline and trend on load and interaction speed, interpreted against the DTC revenue path: cart, checkout, club signup, reservations.
Most providers do
Report a score with no business meaning — a number that looks good and tells you nothing.
What it means to you
Speed is reported as its effect on direct sales, which is the only reason it matters.
7. Accessibility maintained, not audited once
PDG does
Accessibility baseline established and held as content changes. Ongoing compliance, not a one-time scan.
Most providers do
Nothing — or a one-time scan that’s stale within a month.
What it means to you
The site stays usable for every customer and doesn’t quietly drift back out of compliance.
8. Every engagement leaves a record
PDG does
Documented findings, dated closeouts, and a running history for the property. Everything written down.
Most providers do
Verbal updates and lost email threads. Nothing you can reference six months later.
What it means to you
You can see what was done, when, and why, and so can the next person, whoever that turns out to be.
9. You own everything
PDG does
Client owns all domains, accounts, code, and content. Credentials documented and handed over on request. Migration assistance guaranteed on exit.
Most providers do
Hold registrar access or licenses hostage as a retention tactic. Make leaving painful.
What it means to you
You stay because the work is good, not because leaving is painful.
10. A named person who answers
PDG does
One person, on a first-name basis, who knows the property. Questions and email cost nothing.
Most providers do
A ticket queue, or an account manager who rotates every six months.
What it means to you
When something breaks on a Friday afternoon, you reach someone who already knows your site.
The proof artifacts
The standard above is only worth what you can see of it. These are the deliverables that make it visible, and each one is a document with a date on it.
| Artifact | When it’s produced | What it proves |
|---|---|---|
| Inspection Record | At audit delivery | Current condition, findings, and priorities. The paid audit is this document. |
| Squawk List | After the audit | Open items with severity, and dated closeouts as each is resolved. (The name comes from aviation…. a “squawk” is a logged discrepancy awaiting repair.) |
| Restore Test Certificate | Quarterly | The backup was actually restored on this date, successfully. Not promised, but proven. |
| Care Report | Monthly or quarterly | Patches applied, threats blocked, uptime, performance trend, accessibility status. |
| Ownership & Access Register | At onboarding, maintained | Every account, domain, and license, and who controls it. You always know what you own. |
Naming these matters. An unnamed practice is a claim. A named, dated artifact is evidence.
Who this is for...and who it isn't
The Standard of Care is a filter, and that's intentional. PDG has capacity for a limited number of clients, so a prospect who self-selects out is doing both of us a favor.
This standard is for wineries that:
- Understand that “it hasn’t broken yet” is not evidence of quality
- Value documentation and transparency over verbal assurances
- Want a partner to work with, not a vendor to blame
- Have a direct-to-consumer channel worth protecting
- Recognize that premium work can’t be delivered at commodity prices
This is not for:
- Anyone shopping for the lowest monthly number
- Anyone who wants the cheapest thing they can get away with
- Anyone who treats the standard as padding rather than proof
- Wineries with no direct-to-consumer channel to protect
Not everyone will pay for this, and that's the correct outcome. The clients who understand what tested restores and isolated hosting are worth are the same clients who pay on time, stay for years, and refer their peers.
What we won't claim
Discipline about wording protects the standard's credibility. Every claim in this document must be demonstrably true. One overreach undermines everything.
We do not promise 100% uptime. We promise monitoring, alerting, and response. Uptime numbers are reported honestly.
We do not claim a site cannot be compromised. We describe the security practices in place and state what was tested, found, and fixed.
We do not describe accessibility work as legal immunity. We describe what was tested against WCAG 2.2 AA, what was remediated, and what is being maintained.
We do not import unverified statistics into client communications. If a number appears in a report we deliver, it has a source we can cite.
The Standard of Care is what you're really buying.
When you engage PDG, this document is the commitment. The price pays for the standard; the artifacts prove it was kept.
Book a free visibility call