What visitors see
The design, the words, the pages, the checkout. This is the part everyone discusses, and it is roughly a third of the work. Two quotes can look identical here and differ enormously underneath.
Hosting · Data · Payments · Security
A website is not one thing you buy.
It is around twenty separate services that have to be chosen, connected, secured and kept working together. Most of them are invisible when they are working, and every one of them is obvious the day it stops. This page lists them in plain language, so you can see what you are actually paying for — and so nothing ends up belonging to nobody.
We set it up and keep it running
Chosen, configured, monitored and maintained by us, in accounts registered to your company. You never touch it unless you want to.
Your decision, our implementation
A handful of items need a business decision, a tax detail or a legal position from you. We tell you exactly what is needed and build around the answer.
Three layers, one bill
When people compare website quotes, they usually compare the first layer only.
The other two are where projects succeed or quietly fall apart.
The services behind it
Hosting, database, storage, logins, payments, email, analytics. Each is a separate account with its own settings, its own bill and its own way of failing. They have to be wired together correctly once, properly.
Keeping it alive
Certificates renew, providers change their rules, libraries need patching, cards on file expire. A site nobody maintains does not stay still — it degrades, and the first sign is usually a customer complaint.
The twenty parts of a working website
Every part that applies has to be somebody's job.
Not all of them apply to every project — a brochure site skips payments and logins entirely.
ComponentLooked after by
Foundations
Domain and DNS
Your address, and the records pointing it at everything else. Configured wrongly, your email stops arriving as well as your site.
OwnerDOODLESAVE INC
Hosting platform
Serves your pages. Decides how fast the site feels and whether it survives a busy day without falling over.
OwnerDOODLESAVE INC
Certificate and HTTPS
The padlock in the browser. If it lapses, browsers actively warn visitors away from you overnight.
OwnerDOODLESAVE INC
Global delivery network
Copies your site to servers near your visitors and absorbs floods of junk traffic before they reach you.
OwnerDOODLESAVE INC
Data
Database server
Holds everything that changes: enquiries, orders, accounts, content. Sized wrongly, the site slows to a crawl under load.
OwnerDOODLESAVE INC
Backups and recovery
How far back you can rewind after a mistake or an attack. Nobody checks this until the morning they need it.
OwnerDOODLESAVE INC
File and image storage
Documents, photographs, generated invoices. Held separately from the database and billed separately too.
OwnerDOODLESAVE INC
Accounts and access
Logins and authentication
Passwords, resets, multi-factor. Written badly, this is the single most common way small sites get breached.
OwnerDOODLESAVE INC
Roles and permissions
Who can see what. Determines whether one client can ever see another client's documents — a question only you can answer.
OwnerYour rules, our build
Taking money
Payment gateway
Takes cards without card numbers ever touching your site. Charges a percentage of every sale. Explained below.
OwnerYour account, our build
Invoicing, tax and receipts
The right tax on each order and a receipt your accountant accepts. Rules vary by province, state and country.
OwnerYour accountant, our build
Recurring billing
Subscriptions, renewals and retries when a card fails. A genuinely different problem from taking a single payment.
OwnerDOODLESAVE INC
Communication
Transactional email
Password resets and order confirmations. Without domain authentication these land in spam and customers assume you ignored them.
OwnerDOODLESAVE INC
SMS and messaging
Reminders, delivery updates, one-time codes. Priced per message, so volume is a commercial decision.
OwnerYour choice, our build
Safety and trust
Firewall and bot filtering
Blocks injection attempts, credential stuffing and scrapers. Matters most once real customer data sits behind a login.
OwnerDOODLESAVE INC
Monitoring and alerts
Tells us the site is broken before a customer tells you. Without it, outages are measured in days rather than minutes.
OwnerDOODLESAVE INC
Privacy and data rules
Consent, retention, where data is stored and what your policy must say. The position is yours to take; the implementation is ours.
OwnerYour counsel, our build
Being found and understood
Analytics
Which pages produce enquiries, so the next round of work is decided by evidence rather than opinion.
OwnerDOODLESAVE INC
Search visibility
Structure, speed and metadata so search engines can read the site properly. Built in, not bolted on afterwards.
OwnerDOODLESAVE INC
Content management
How you change wording, prices and photographs without calling us. We set it up; day to day it is yours.
OwnerYou, after handover
What it costs to keep it running
Building the site is a one-time cost. Running it is not.
Every month the site is live, three third-party providers bill for it: Netlify hosts the site, Supabase runs the database and portal logins, and a security layer sits in front of both. These are billed to you directly by those providers — DOODLESAVE INC does not mark them up.
Converted at CA$1.40 to the US dollar
Converted at ₹96 to the US dollar
Fixed
Same amount every month regardless of traffic. You can budget these to the dollarto the rupee.
Usage-based
Moves with how much data your portal serves. This is the part that can climb, so every line below is marked.
Launch
Public site plus a portal with up to roughly 500 active users and light file traffic.
CA$38₹2,600 / month
≈ CA$460 per year≈ ₹31,000 per year
Growing
A few thousand portal users, regular document downloads, a faster database instance.
CA$120₹8,300 / month
≈ CA$1,450 per year≈ ₹1.0 lakh per year
Heavy
Tens of thousands of users or media-heavy files, with point-in-time database recovery switched on.
CA$470₹32,000 / month
≈ CA$5,600 per year≈ ₹3.8 lakh per year
Line by line. Most sites start at Launch and stay there for the first year.
ItemA · LaunchB · GrowingC · Heavy
Hosting — Netlify
Hosting plan
Free tier is enough at launch. The paid plan adds password-protected previews, role-based access and far more monthly credits.
LaunchCA$0₹0
GrowingCA$28₹1,920
HeavyCA$28₹1,920
Extra build & bandwidth credits
Netlify meters deploys, bandwidth and serverless function calls as credits. Busy months buy top-up packs.
LaunchCA$0₹0
GrowingCA$0 – 14₹0 – 960
HeavyCA$28 – 56₹1,900 – 3,800
SSL certificate
Issued and auto-renewed by Netlify. There is no separate certificate to buy.
LaunchCA$0₹0
GrowingCA$0₹0
HeavyCA$0₹0
Database & portal — Supabase
Pro plan
Required from the day the portal goes live: free projects pause after a week of inactivity and have no daily backups. Includes daily backups, 100,000 logins a month and a compute allowance.
LaunchCA$35₹2,400
GrowingCA$35₹2,400
HeavyCA$35₹2,400
Database compute upgrade
The included allowance covers the smallest instance. A larger one is needed once queries slow down under concurrent users.
LaunchCA$0₹0
GrowingCA$7₹480
HeavyCA$70₹4,800
Data transfer & storage
Charged per GB leaving the database and per GB stored beyond the included allowance. Document-heavy portals feel this first.
LaunchCA$0 – 2₹0 – 100
GrowingCA$6 – 15₹430 – 1,000
HeavyCA$50 – 85₹3,500 – 6,000
Security & resilience
CDN, DDoS protection, DNS
Cloudflare's free tier covers this. The paid tier adds a managed firewall ruleset and bot filtering — worth it once the portal holds client data.
LaunchCA$0₹0
GrowingCA$0 – 35₹0 – 2,400
HeavyCA$35₹2,400
Point-in-time recovery
Lets the database be rewound to any second in the last seven days, rather than to last night's backup. Optional until the data is business-critical.
Launch—
Growing—
HeavyCA$140₹9,600
Error & uptime monitoring
Alerts you when the portal breaks before a client tells you. Free tiers are usually sufficient.
LaunchCA$0₹0
GrowingCA$0₹0
HeavyCA$0 – 36₹0 – 2,500
Transactional email
Password resets and portal notifications, sent through an authenticated domain so they don't land in spam.
LaunchCA$0₹0
GrowingCA$0 – 28₹0 – 1,920
HeavyCA$28₹1,920
Domain renewal & WHOIS privacy
Billed annually, shown here as a monthly equivalent.
LaunchCA$2₹160
GrowingCA$2₹160
HeavyCA$2₹160
Typical monthly total
CA$38₹2,600
CA$120₹8,300
CA$470₹32,000
Figures are estimates based on published provider pricing as of August 2026 and assume the usage described in each scenario. Provider pricing and exchange rates can change without notice. This is an estimate, not a quotation.
The security layer, in plain terms
Most of what protects a modern site is included rather than bought separately.
These are the pieces that genuinely cost money, and when each one becomes worth paying for.
Encryption in transit
The padlock in the browser. Certificates issue and renew automatically — nothing to buy or remember.
Denial-of-service protection
Absorbs floods of junk traffic before they reach the site. Cloudflare's free tier is enough for most businesses.
Web application firewall
Blocks injection attempts, credential stuffing and scraper bots. Worth it once real client data sits in the portal.
Login security
Password hashing, sessions, multi-factor authentication and per-row access rules come with the database plan.
Backups and recovery
Daily backups are already included. This upgrade turns “we lost today's data” into “we lost four minutes”.
Security audit
An external penetration test. Usually first needed when a large customer or insurer asks for evidence.
Compliance certification
SOC 2, ISO 27001, SSO and SAML. Only if a client's procurement team demands it in writing.
Cyber liability insurance
Covers the cost of a breach rather than preventing one. Priced against revenue and data sensitivity.
Things that move the bill
Worth knowing before the first invoice arrives, not after.
01
GST/HST on foreign software
Netlify, Supabase and Cloudflare are non-resident suppliers and are required to register for and charge GST/HST on sales to Canadian customers. The rate follows your province, from 5% to 15%. If you are GST/HST-registered you can normally recover it as an input tax credit — confirm the treatment with your accountant.
01
GST on foreign software
Netlify, Supabase and Cloudflare are overseas suppliers. A GST-registered Indian business pays 18% IGST on these under reverse charge, and can normally claim it back as input credit. Please confirm treatment with your accountant.
02
Card foreign-exchange markup
Most Canadian credit cards add about 2.5% on US-dollar charges. Budget roughly that much on top of every figure here, or pay with a no-foreign-transaction-fee card and avoid it entirely.
02
Card forex markup
Paying with an Indian credit card adds roughly 3.5% in currency mark-up, plus GST on that mark-up. Budget about 4% on top of every figure in this document.
03
The exchange rate
Every provider bills in US dollars. These figures use CA$1.40 to the dollar; if the loonie weakens, the Canadian bill rises even though nothing on the site changed.These figures use ₹96 to the dollar; if the rupee weakens, the rupee bill rises even though nothing on the site changed.
04
Where the data lives
Databases can be provisioned in a Canadian region at no extra cost, and we recommend it. Under PIPEDA you must tell users their data may be handled outside Canada, and Quebec's Law 25 requires a privacy assessment before personal information leaves the province. Choosing Canadian hosting at setup is far cheaper than migrating later.
0504
Data leaving the database
The single most common cause of a surprise invoice. Large PDFs, images or exports served repeatedly from the portal are billed per gigabyte. Compressing files and caching them properly is the cheapest fix.
0605
Free tiers pause
A free database project sleeps after seven days of inactivity and carries no daily backups. It is fine for testing and unsuitable for a live client portal — which is why the Pro plan appears in all three scenarios.
Payment gateways, briefly
The component clients ask about most.
And the one where the surprises are commercial rather than technical.
What it actually is
The gateway takes the card details on its own systems, not yours. Your site never sees a card number, which keeps you out of the strictest compliance rules entirely.
What it costs
Typically a percentage of each sale plus a small fixed fee, with a higher rate on international cards. Some providers add a monthly charge on top.
When you get the money
Funds usually settle to your bank two to seven days after the sale. New accounts often face a longer hold until the provider has seen some history.
The account is yours
It is opened in your company's name with your banking and tax details, because the money goes to you. We connect it and handle the technical side.
Chargebacks
A customer can dispute a charge months later. You lose the sale and pay a fee, so clear descriptions and prompt refunds are cheaper than arguing.
Verification
Providers ask for incorporation documents, tax registration and bank proof before releasing payouts. Starting this early avoids a launch-week delay.
Which one to use
The right choice depends on where you are, who you sell to and which currencies you need. We will recommend one and explain the trade-off.
Refunds and reporting
Issuing refunds, matching payouts to orders and exporting for your accountant are part of the build, not an afterthought.
What happens when a part belongs to nobody
These are ordinary failures, not rare ones. Each one traces back to a component that was set up once and then had no owner.
01
The certificate lapses
Every visitor sees a full-page security warning before they see your business. It usually happens on a weekend, and the people who bounced never come back to tell you.
02
Nobody can find the domain login
The registration expires, the site and email go dark together, and recovering a lapsed domain is slow, expensive and sometimes impossible.
03
The backup was never actually running
Discovered on the day it is needed. Anything not backed up is simply gone, including every order and enquiry.
04
An update breaks the checkout
A component updates itself, payments stop, and nobody notices until Monday because nothing was watching.
05
The payment provider asks for documents
The request goes to an inbox nobody reads. Payouts freeze while sales carry on, and the money sits with the provider.
What we need from you
A short list, but projects stall here more often than they stall on code.
- Content and approvals — words, photographs and sign-off. This is the single most common cause of a project running late.
- Business and tax details — needed to open the payment account in your name and to get the tax handling right.
- One person who can decide — someone able to answer questions within a few days, rather than a committee reviewing each round.
- A heads-up when the business changes — new services, new locations, a new bank. Most of these have a technical consequence somewhere.
Why this list exists. Not to make the work sound complicated, but because clients who understand what sits underneath make better decisions and get fewer unpleasant surprises. If a component on this list does not apply to your project, we will tell you and leave it out rather than bill for it.
Want these figures for your own project?
Tell us roughly what the site has to do and we will send the running-cost estimate for your scenario, in Canadian dollars or rupees, before anything is signed.