How to Choose a Managed Web Platform Agency: A CTO's Checklist

Most agencies are great at the wedding and terrible at the marriage.

They pitch hard, design beautifully, build enthusiastically — and then, the week after launch, they go quiet. The final invoice arrives, you get a set of logins, and you're on your own the first time something breaks under real traffic. If you've been through this once, you already know it's the single most expensive mistake in web projects: not the build going wrong, but the silence afterwards.

Choosing a managed web platform agency — one that stays involved after launch — is a different decision than choosing someone to build a site. The build is a project. The platform is a relationship. And relationships are worth vetting properly.

Here's the checklist we'd use if we were on your side of the table.

1. Ask what happens the day after launch

The most revealing question you can ask any agency is simple: "What does our relationship look like three months after go-live?"

Watch how they answer. If they talk about a "maintenance package" as an afterthought, or get vague about ongoing involvement, that tells you launch is where their interest ends. The agencies worth hiring have a clear, structured answer — because ongoing operations is a core part of what they do, not a bolt-on they offer reluctantly.

A platform is never "done." Real users surface bugs the QA process never could. Traffic patterns shift. Dependencies need patching. Features need adding. Someone has to own all of that, and you want to know who before you sign.

2. Demand clear, written SLAs

"We'll get to it" is not a support model.

A serious managed partner gives you service-level agreements in writing: defined response times and resolution targets, tiered by severity. A site-down emergency and a minor content tweak are not the same urgency, and your agreement should reflect that.

Ask specifically:

• What's your response time if the site goes down at 2 a.m.?
• What counts as "critical" versus "normal" priority?
• Is after-hours and weekend coverage included, or extra?
• What's guaranteed in writing versus best-effort?

Vague answers here are a red flag. The whole point of a managed relationship is predictability — if they can't put numbers to their commitments, they don't really have a managed offering.

3. Confirm you own your code — completely

This one has ruined more businesses than any bug.

Some agencies build on proprietary systems, keep the code on their own repositories, or structure things so that leaving them means starting over. It's a quiet form of lock-in, and you often don't discover it until you try to move.

Before you sign anything, confirm:

• You own all the code, outright.
• It's delivered with real documentation, not a README stub.
• You have full access to your repositories, infrastructure, and accounts.
• If you ever left, you could hand everything to another team and they could pick it up.

A confident agency has no problem with any of this. An agency that hesitates is telling you something important.

4. Check whether they understand your infrastructure, not just your design

A beautiful front end on fragile infrastructure is a countdown timer.

The agencies that keep platforms healthy long-term understand the whole stack — hosting, scaling, security, monitoring, deployment — not just the visual layer. Ask about their approach to:

• Uptime monitoring: Will they know the site is down before you do?
• Scaling: What happens when traffic spikes during a launch or campaign?
• Deployments: Can they ship changes without downtime, and roll back if something breaks?
• Security patching: Who keeps dependencies current, and how often?

If the agency's answer to infrastructure questions is "we use [hosting provider] and it just works," that's not an infrastructure strategy — it's a hope.

5. Ask how they handle security over time

Security isn't a launch checkbox. It's an ongoing responsibility that most abandoned platforms fail at quietly.

Every month, new vulnerabilities are disclosed in the libraries your platform depends on. Someone has to track them, assess your exposure, and patch. If your agency disappeared after launch, the honest answer to "who's doing that?" is usually "nobody" — until there's a breach.

Ask a managed partner:

• How do you keep dependencies and frameworks patched over time?
• Do you run regular security reviews, or only react to incidents?
• How would we find out if there were a breach?

For businesses handling any customer or payment data — and especially those serving EU customers under GDPR — this isn't optional diligence. It's the difference between a manageable risk and an existential one.

6. Look for honesty about what they won't do

This sounds counterintuitive, but the best sign of a good partner is one who tells you no.

An agency that says yes to everything — every deadline, every scope, every "can you also just…" — is either overpromising or planning to cut corners. The partners worth keeping will sometimes tell you a feature isn't worth building, a timeline isn't realistic, or a cheaper approach would serve you better. That honesty is what protects you over a multi-year relationship.

When you're interviewing agencies, notice who pushes back thoughtfully versus who agrees with everything. The agreeable ones are easier in the sales conversation and harder to live with afterward.

7. Understand how they price ongoing work

Managed relationships usually run on a monthly retainer — a defined block of capacity for development, maintenance, and support. That's normal and healthy. What you want to understand is the shape of it:

• Is the retainer flexible? Can you scale it up for a busy quarter and down for a quiet one?
• What happens to unused capacity?
• Are you locked into a long contract, or can you run month-to-month?

On that last point: be a little wary of agencies that demand long lock-in contracts. Counterintuitively, the most confident partners often don't require them — because they'd rather earn the relationship every month than trap you in one. A month-to-month arrangement that clients stay in for years is a much stronger signal than a two-year contract they can't leave.

8. Ask to speak to a long-term client

Anyone can show you a glossy portfolio of launches. What's harder to fake is a client who's been with them for three years.

Ask: "Can I talk to a client you've worked with continuously for a while?" A managed agency worth its name will have several and be happy to connect you. If every reference is a one-off project that ended at launch, that tells you what kind of relationships they actually have — regardless of what the sales deck says.

The bottom line

Choosing a managed web platform agency is really a bet on what happens after the exciting part is over. The design, the launch, the demo — those are the easy, visible wins. The real value shows up in the quiet months afterward: the incident handled before you noticed, the security patch applied on time, the feature shipped without drama, the message answered a year later.

When you're evaluating partners, weight the checklist above toward the boring, ongoing, unglamorous commitments. Those are the ones that protect your business. The agencies that take them seriously are the ones still worth working with long after launch day.