Commissioning a new website also means choosing the party that will maintain it over the coming years. This became a practical consideration when Malenco was asked to review a supplier's proposal. The offer included a proprietary content management system, the software the client would use to update the website, with AI assistance and automatic translation. The underlying web technology was modern and suitable. To make an informed choice, however, the organisation also needed to understand how it could continue to use, maintain and transfer the website if the relationship changed in the future.
Malenco reviewed the proposal using the information provided, example websites and a public security test. This was therefore not a full assessment of the proposed software: the review of the content management system itself relied on the supplier's description. Together, these sources did reveal where the offer needed further substantiation. Alongside dependency on the proprietary platform, there were weaknesses in the security configuration of the sites examined and unanswered questions about future maintenance. The advice therefore focused on the conditions under which the client could commit to this solution.
Taking the website elsewhere requires agreements in advance
The proposed content management system was the supplier's own software and was available only to its customers. This would leave the client heavily dependent on that one party for maintenance and further development. This dependency is often called vendor lock-in: switching becomes difficult or expensive because the chosen solution cannot readily be continued elsewhere. If service deteriorates, prices rise or the supplier ceases trading, a new website may be needed even while the existing one remains technically adequate. The purchase price then reveals little about the true cost of the decision.
For the client, the key issue was what would actually be available when switching suppliers. Owning the text and images does not in itself confer a right to continue using the software, while access to an export file does not necessarily mean another party can take over the website. Malenco therefore recommended agreeing ownership or permanent rights to use the source code, design and content, alongside a complete export of content and media. An exit agreement needed to specify what the client would receive on termination, within what timeframe and at what cost. The domain name and management of its associated DNS records also needed to remain under the client's control.
This needed to include provision for the supplier ceasing operations. The advice suggested, for example, making the source code available under agreed conditions through an independent escrow agent, or granting a licence allowing continued use of the content management system if the supplier became unavailable. These arrangements were intended to support continuity of use; without further detail, a practical handover could not be assumed. To broaden the comparison, Malenco also recommended obtaining a competing quotation based on a widely used content management system. Both proposals could then be assessed on freedom of choice and total costs over three to five years, including licences, hosting, maintenance and changes.
The sites examined gave reason to look more closely
Dependency on the supplier made the quality of maintenance particularly relevant. Malenco therefore examined the supplier's publicly accessible website and an example customer site. The supplier's own website still supported outdated encryption settings. Both sites lacked several standard security settings, including instructions that help browsers limit certain forms of abuse. Many of these issues concerned configuration and, according to the advice, could be improved with relatively small changes. Their absence from the supplier's own website was reason to discuss the care taken in maintaining its services.
The scans provided no evidence of an acute security vulnerability. Nor did the settings examined establish that the proposed software had been compromised or that the future website could be exploited immediately. The findings were nevertheless specific enough to require demonstrable improvement and clear acceptance criteria. The scope of the assessment remained relevant: a public test reveals only part of the security picture. It did not establish how the supplier remedies vulnerabilities, secures access to the content management system or checks third-party software components.
The advice therefore linked the visible weaknesses to requirements for less visible maintenance practices. Among other things, Malenco called for access to an independent security assessment of the content management system, additional verification when signing in, defined user permissions and a record of administrative actions. A specific remediation timeframe needed to be agreed for critical security updates. Access to the administration environment also needed to be restricted, and the security configuration had to be demonstrably in order at delivery. These were conditions for a potential commission, rather than measures the assessment had confirmed were already in place.
Hosting and AI also needed to be covered by the agreement
Developing these conditions showed that the services surrounding the website also needed clarification. The sites examined used different hosting environments; where the new website would be hosted was still unknown. There was consequently insufficient visibility of backups and recovery in the event of an outage. Malenco recommended hosting within the European Union, with a documented and tested recovery procedure. This needed to specify acceptable recovery time and potential data loss, so the client would know what to expect during an outage.
AI assistance and automatic translation required similar clarity. The available information did not establish which external AI service was used, which data would be sent to it or whether that data could be used to train models. The recommendation was to clarify these data flows and the service providers involved, and to document data processing arrangements, including the AI and hosting providers engaged. Human review of specialist translations also remained necessary. A feature that can simplify publishing also brings responsibility for the content that ultimately appears on the website.
The outcome was conditional advice. The proposed supplier remained a viable option if both the transfer arrangements and the security requirements were incorporated into the contract. If the supplier was unwilling to accept those conditions, Malenco advised against proceeding. This gave the client an informed basis for the next discussion and comparison with an alternative. The available documents do not record a final choice of supplier, nor do they demonstrate that the recommended improvements were implemented.
Having the proposal reviewed before signing gave the client visibility of obligations and dependencies that can easily remain outside a functional demonstration. The new website needed to be suitable for initial delivery and remain manageable as needs or circumstances changed. The advice identified the rights, information and agreements still required to achieve that. The organisation could then base its decision on the consequences for the coming years, alongside the capabilities the platform offered at the time.
This anonymised case is based on advice dated 29 October 2026. The image is illustrative.
