Does HEM certify compliance?
No. Compliance work and specialist testing are quoted separately; HEM does not claim certification.
Answers · Security
How much does website security work cost at HEM Studio?
HTTPS and basic security are part of every HEM website. Beyond that, a Security Review is $750 one-time for written, prioritized recommendations; a Security Upgrade is from $1,500 one-time to implement agreed fixes; and Advanced Backend Security is from $3,500 (custom quote after a requirements review) for client areas, role-based access or sensitive information.
Which level you likely need
A brochure site with a contact form
Standard HTTPS and basic security usually cover it. A Security Review is useful if you're unsure how the form, spam protection or connected tools are set up.
Known issues to fix
If a review (HEM's or another) has found problems, a Security Upgrade implements the agreed fixes. The review is not automatically charged with it.
Accounts or private client data
If people log in, see different things, or you store sensitive information, Advanced Backend Security is scoped after a requirements review.
Ongoing care is a separate, optional choice
Pick one plan if you want ongoing upkeep: maintenance $250 per month, Website Care & Protection $350 per month, or Website + Automation Care $650 per month. They are alternatives, not add-ons to each other.
What each level covers
- Review: permissions and API-key handling, database access rules, spam protection, backup and recovery settings where applicable
- Upgrade: agreed fixes to those areas, verification and handoff
- Advanced: authentication and role-based permissions, restricted database access, server-side validation and rate limiting, audit logging, monitoring and recovery planning as scoped
Boundaries
- The Security Review does not include implementation.
- Specialist testing and compliance work are quoted separately.
- No guaranteed security and no 24/7 response.
- Care plans have defined monthly allowances; no unlimited support.
Related questions
Do I need a review before an upgrade?
An upgrade is based on a review, and its scope is agreed before work begins.
What's the difference between the $350 and $650 care plans?
Website Care & Protection includes routine updates, uptime monitoring, backup checks and up to 1 hour of small fixes. Website + Automation Care adds automation failure checks, with up to 2 total hours a month.
Exact deliverables, revision rounds and schedule are confirmed in a written proposal before work begins.