We set it up with you, review what it ships, patch what it misses and step in when it breaks.
More merchants want to make changes to their own store with AI, and they can. What they need is someone senior to set it up properly, read what is deployed, hold the risky changes and answer when something breaks. That is this service, for Magento, Adobe Commerce, Hyvä and Shopify stores: your team does more itself, and we stay answerable for the store. A set monthly figure, agreed once we have seen how you work.
What owners tell us when they first get in touch.
We could do half of this ourselves with AI now, but we are afraid of breaking the store.
A sensible fear, and a solvable one. With staging, a review step and a senior person reading the risky changes, your team can move quickly and safely.
Our AI agent deploys several times a day and nobody reads the changes.
Most changes are fine. The ones that touch payment, data or credentials are the ones worth a second pair of eyes.
We are not sure anyone has applied the latest Adobe security release.
An AI system has no reason to know a bulletin was published. Patching needs a person who follows the calendar.
Set up once, then five things every month.
Repository, staging, pipeline and the tooling itself, set up with your team and explained in plain terms.
Every deployment read within an agreed window; hold-list changes wait for a person.
Adobe releases, PHP, Shopify API changes and dependency advisories, tested and deployed.
Questions answered the same day; a store that cannot take orders comes first.
Protected branches, a staging step and a review gate for the hold list.
Reviewed, held, patched and recommended, on one page.
Understand how you work, set up what is missing, agree the hold list, then review month by month.
Tell us how your store is built and deployed. A senior person reads the public store and replies in writing.
Within two working daysRepository, pipeline, hosting, how changes are deployed and what the AI is allowed to touch. If you are starting from nothing, we build the foundations with you.
Before the retainer startsHow quickly deployments are read and which changes wait for a person, all in writing.
First weekDeploys read within the window, holds released or sent back with a note, security releases and dependencies patched on staging.
ThroughoutWhat was reviewed, held and patched, and what we recommend next.
MonthlySix areas where a change deploying unread costs more than a short wait. Everything else keeps the speed your AI gives you.
Gateway configuration, capture and refund logic, the checkout steps and anything that touches an order total.
Account, address and order data handling, exports, consent and tracking, and anything that sends personal data to a third party.
Admin paths, two-factor settings, API tokens, firewall and edge rules, cookie and header settings.
Catalogue price rules, tax classes, shipping methods and the feeds that carry them.
Keys and tokens for payment, shipping, ERP and marketing integrations, and the code that uses them.
Deploy scripts, environment configuration and the review gate, so the guard rails cannot be removed by the thing they guard.
We price the work, not the clock.
A set monthly figure, agreed once we have seen how you work: how often changes are deployed, what the AI is allowed to touch and how the store is hosted decide the work, so we look first and then put a figure in writing. Anything you ask us to build or fix beyond the review is itemised on the same monthly invoice.
A Hyvä store built by this team, with a programme of consent, tracking and security work. The figures are the store's own, measured by Google.
Hyvä build for dormeo.co.uk and dormeo.ie, designed mobile first around how people choose a mattress.
Core Web Vitals, real-user data (Chrome UX Report), mobile, 28 days to 31st October 2026. Marks show Google's thresholds.
Every line of code and every piece of content that AI tooling drafts is read, tested and signed off by a senior engineer.
Years of Magento and Shopify work tell us what is safe to change on a trading store, and what needs a second look.
Whether we do it for you or your own team does it with AI, the same senior person stays answerable for the store.
With the foundations, which we set up with you: the code in a repository, a staging copy of the store, a deployment pipeline with a review step, and an agreed list of what the AI may and may not touch. Then your team starts with small, low-risk changes, with us reading what is deployed. Most merchants are making useful changes themselves within a few weeks.
Yes. Some merchants want to do the work themselves with AI and have us oversee it; others want us to do it, using the same tooling, and pass on the saving. Many end up with a mixture. See AI-assisted delivery for the second route.
Because it works until the day it does not, and that day is usually a payment change, a security release or a customer data question rather than a feature. The retainer is not a judgement on your setup. It is a senior engineer reading what ships, patching what the AI has no reason to know about, and answering when the store is down.
Only where it touches the hold list: payment, checkout, customer data, security configuration, pricing and tax, credentials and the deployment pipeline itself. Those changes wait for a person inside an agreed window. Everything else deploys as it does now and is reviewed after the fact.
Any that produce code and deploys we can read: changes in a repository, a pipeline we can see and a staging environment we can use. We do not need to operate your AI, and we will not ask you to change tools to work with us.
Yes. Incident response is part of the retainer: isolate, find the cause, clean or roll back, rotate credentials where needed, patch what let it in and write up what happened. If you then want us to take on more of the store, that is estimated separately.
It overlaps and is smaller. The security retainer covers monitoring, patching, a hardened edge and incident response for a store we maintain. The oversight retainer assumes your own AI system does most of the work and adds the review, the patching it misses and someone to call.
Read access to the repository and pipeline, deployment access to staging, read access to logs, and an admin account. For holds on the list to work, the pipeline needs a review step we can act on; we will set it up with you if there is not one.
Give us the address and we will read what the store already shows the world: release, support status, PHP, headers, hosting and any sign of a hijack. One page, by email, within two working days. Nothing is accessed or tested.
What we would do first. Apply the outstanding security fixes, then plan the upgrade to a supported release.