An agency rarely loses a Drupal client at launch. It loses them later, when the developer who built the site has left, security releases keep landing and nobody on staff wants to own code they did not write. WeebPal maintains those sites for you every month, under your name: updates applied and tested, tickets answered in your system, and a report your client reads as yours.
Who this is for
- Agencies with Drupal sites past launch Clients on a care plan you sell, and not enough Drupal hands on staff to run it well.
- A site you inherited Built by another team, won in a pitch or passed to you at handover, with an update backlog nobody has cleared.
- A developer who has left The one person who knew the codebase is gone, and your client still expects the same answers.
- Drupal 10 sites near end of life Security support for Drupal 10 ends on 9 December 2026. A site that needs an upgrade needs a project, not a patch schedule, and we say which one it is.
What you get each month
- Security releases applied Drupal core and contributed modules, tested on staging first, on the schedule agreed, with urgent ones out of band.
- Fixes against a ticket allowance Taken from your ticket system and answered in the voice your client already receives.
- Backups that have been restored A restore is tested, not assumed.
- Monitoring that reaches a person Uptime and error alerts go to an engineer, who tells you.
- Dependencies kept current So the site does not drift into a version you cannot upgrade.
- A monthly report under your brand Updates applied, tickets, uptime and the risks we see building up. It never mentions us, and it is written to forward unedited.
New features, a redesign or a version upgrade are quoted separately, so the retainer is not quietly spent on project work.
Sample Monthly maintenance report March 2026 · example.org
Your agency logo
- Uptime
- 99.97%
- Updates applied
- 12
- Tickets closed
- 9
- Open risks
- 2
Updates applied
- Drupal core 11.3 patch release Tested on staging
- Search API patch release Tested on staging
- PHP 8.3 patch release Applied
Tickets
- Search results miss PDF content Closed
- New field on the event form Closed
- Slow admin content listing In progress
Risks we are watching
- Medium PHP 8.3 is in security-only support; the move to PHP 8.4 is planned for next month.
- Low A contributed slideshow module has no maintainer; a replacement is proposed.
An engineer reads it and replies within one business day.
How the work runs
How a white-label retainer runs
- Audit A takeover audit of the codebase, dependencies, permissions, deployment and backups. You keep the audit, whatever you decide
- Fixed price The audit sets a monthly fee, fixed for the term once agreed. You keep the scope of the retainer
- Access We join your ticket system, repository and monitoring, under the accounts you issue. You keep control of every account
- Maintenance Updates, fixes and monitoring through the month, logged in your system. You keep the change log
- Report A written report under your brand, ready to forward. You keep the report
When a client site has a problem
An alert on a client site reaches our engineer, not your client. What happens next is agreed in writing before the retainer starts:
- We tell you first What we know, what we do not know yet, and what we are doing about it.
- You tell your client In your words and on your schedule, because you hold the relationship.
- The fix follows your agreement An emergency release is approved by the person your agreement names.
- It appears in the report The incident, the cause and what changed, written so you can forward it.
Who hears what when a client site has a problem
What your client sees
Behind your agency
Your support line and your report
NDA and non‑solicitation
Response targets and the SLA you sell
Support runs in business hours on Indochina Time, UTC+7, which overlaps the Australian working day and the European morning. Cover outside those hours is an option with its own price, not a default. The first-response targets are the ones we publish for every client; the rest of the SLA you sell to your client is fixed in your agreement with us before you sign.
| Severity | Meaning | Response | Agreed |
|---|---|---|---|
| Critical | The site is down, or data is at risk | 4 hours | Cover hours, update interval while it is open, escalation contacts |
| High | A main function is broken with no workaround | 1 business day | Update interval, who approves an emergency release |
| Normal | A defect with a workaround, or a small change | 3 business days | Scheduling against the ticket allowance |
Severity definitions are agreed in writing first, so nobody argues about classification during an incident. A first response means an engineer is on the issue with what is known so far; resolution depends on what the issue turns out to be. You are free to publish these terms to your client under your own brand.
Taking over a site somebody else built
This is the usual case, so no monthly fee is quoted on code nobody has read. The takeover audit comes first: a security and code review, a module and dependency inventory, a look at the deployment path and the backups, and a written list of what we would fix first. You keep that document whether or not the retainer goes ahead, including when our advice is that the site needs an upgrade or a rebuild rather than a care plan.
A warranty is a different thing. It covers defects in a project we built and does not follow code somebody else wrote. On an inherited site the retainer is the cover, and anything we build for it later carries its own warranty, held by your agency.
What you can verify
The sites we maintain for agencies carry the agencies' names, so they are not listed here. The ones we maintain for our own clients are: SPREP, whose sprep.org we redesigned and whose Drupal theme we rebuilt, and the SPREP sites we built from it; the Pacific Islands Roundtable, CreAct and H&N Corporation, built by us. All of them are still maintained by us.
- Code in public The WE Mega Menu issue queue on drupal.org shows how we handle bug reports and releases on a module we maintain; it now has a release for Drupal 11 and 12. More on our open source page.
- Named reviews Reviews on our reviews page carry the reviewer's name, role and organisation, including agencies that give us Drupal work.
What it costs
Maintenance and support is billed per month, per site, sized to the system. The band is published under Maintenance and support on our pricing page, and agencies pay the same band as our direct clients. There is no lock-in period, and you resell at your own price.
What moves a site within the band: traffic and uptime expectations, how many contributed and custom modules it carries, the integrations that must keep working, whether cover outside business hours is needed, and the ticket volume the site really generates. The paid takeover audit turns those into a number, fixed for the term once agreed.
Building or extending a client site under your brand is white-label development, engineers reserved by the month are a dedicated team, and work where the buyer must see our name is named subcontracting. For platforms taken to your own market, see partners. If the site belongs to your own organisation, see Drupal support and maintenance or outsourced development.
Terms that hold
These terms hold across our services; where a service starts differently, its page says how. The full wording is on the warranty page and in why you own the source code.
- A prototype before you sign a build Before a build project is signed, we build a prototype at no charge: a design, a clickable prototype or a working demo on real code, so you decide against something real.
- You receive the system and its source code Custom work is yours from the first commit: the repository, custom modules, theme and deployment configuration. When we build your system on one of our platforms, you receive the whole system and its source code as well.
- Response targets we publish A first response in 4 hours for critical issues, 1 business day for high priority and 3 business days for normal. Support runs in business hours; cover outside them is an option, priced separately.
Agency terms
Agreed in writing before any work starts, and the same for every agency we work with.
- NDA first A mutual NDA is signed before a client name, a requirement or a repository changes hands.
- Non-solicitation, both ways We do not approach your clients or hire your staff, and you do not hire ours. The clause is written into the contract, for the term the contract sets.
- The warranty is held by your agency On development projects the warranty belongs to your agency, as the party that signs with us: 1 year by default, up to 3 years, including the security releases of Drupal core and contributed modules. What you promise your own client is yours to set.
- Code delivered to your agency The code goes into your repository, and your client receives the whole system and its source code under your contract with them.
- Platforms, taken to market together When a client's system runs on one of our platforms, we deploy and extend it with you for that client, and we grow that market together.
- You decide who appears As a white-label team we never appear to your client. As a named subcontractor, on a tender or in a consortium, we appear under our own name where you want us to. Either way, you decide who joins a client call.
Questions we get asked
Can we resell the retainer at our own price?
Yes. You contract with your client on your own terms and at your own rate. Our agreement is with you, and your margin is your business.
Do you reply to our client's staff directly?
No. Tickets come in through your system and replies go out through it, in the voice and format your client already receives, under your name. If a call with the developer is needed, one of us joins it as part of your team, on your bridge, with your introduction.
What if a site needs more than maintenance?
We say so. If the real problem is an unsupported Drupal version, the answer is an upgrade project, not a monthly fee for patches that cannot fix it. We would rather tell you that than bill you until it breaks.
Who owns the code written during the retainer?
Whoever owns the rest of the codebase: your client, or you, exactly as before. We take no licence over a site we maintain.
Is there a minimum term?
There is no lock-in period. The monthly fee is fixed for the term you agree, and leaving takes no handover of anything new, because the repository, the documentation and the runbooks sat in your accounts throughout.
Can you host our clients' sites as well?
Yes, on your client's infrastructure or ours. Hosting sits in the same Maintenance and support band on the pricing page and can run under your brand like the rest of the retainer. Managed Drupal hosting sets out what it covers.
Can we start with one site?
Yes, and that is the usual start: one site, one takeover audit, one retainer. More sites follow once the first has proved itself.
Not covered here? Ask us directly.
Talk to us under NDAAn engineer reads it and replies within one business day.
For agencies
Related services
Hand us one site first
Tell us about the site and where it is hosted. The NDA comes first, and the takeover audit turns what we find into a fixed monthly fee.
An engineer reads it and replies within one business day.