Straight answers, before you have to ask twice

That depends on two things: where the AI runs, and how it's configured. Where: you can run AI on infrastructure you control, so your data never leaves your ownership or you can use cloud AI services that offer real, contractual privacy commitments: no training on your data, specified data residency, compliance certifications. Both can be safe; they trade control against convenience, and the right choice depends on your data and your compliance environment.

How: data is safe when it's configured deliberately. You know what data flows where, what each vendor promises, and whether that matches what FERPA, HIPAA, or plain donor trust requires. Our job is to lay those options out honestly so you can choose on purpose, rather than defaulting to whichever vendor showed up first.

To give staff their time back, and better serve your community. A custom AI agent can answer donor inquiries, handle routine questions, and surface the right information for your communities (continuously, in your organization's voice) while your team handles the work that needs a human. The point isn't AI for its own sake; it's your mission, better served.

Yes! We'd love to help. In fact, we would insist on it before deploying anything. A practical AI policy covers what data may be used, what tools are approved, who is accountable, and what your organization tells its communities. We've helped organizations draft policies that fit their compliance environment, whether FERPA, HIPAA, or plain donor trust.

Getting aligned on strategy early lets us deliver better results more efficiently. Projects without strategy are expensive guesswork. We take a product-based approach: focused on delivering the features that meet your strategic goals, without going down expensive dark alleys of costly but unused technology. The approved strategy is what every later decision gets measured against: what tools, what features, what budget, what order.

We begin by engaging in a conversation with you and your stakeholders. We assess what you have, facilitate the conversation about what your organization needs to achieve its goals, and work with your stakeholders to draft a strategy you approve. A strategy nobody signed off on is a strategy nobody follows. In the end, you will have a living document your team owns — one that evolves as your organization's needs change.

We work with your team to prioritize work based on the strategy document. Then we work iteratively: focused on the goals laid out for a short period (generally two weeks) we review the work delivered, measure its impact, assess whether the approach needs to change, and then begin the next set of tasks, determined through that same collaborative process. Our years of experience have shown this method to be the most effective way to deliver value to our clients. Strategy, implementation, and continuous improvement aren't three separate purchases; they're one engagement, and the strategy document is what keeps it pointed at your goals.

In our experience, skipping to implementation is often a mistake. Yes, some circumstances, like critical upgrades or accessibility fixes, can go into a quick triage project, but the most successful projects align technology improvements with the organization's strategic goals. A short strategy engagement is the cheapest way to ensure a successful project.

Migrating from Drupal 10 to Drupal 11 is very straightforward. Since Drupal 8, Drupal has been much easier to upgrade than in the past. There is almost always some downtime, but typically minutes, not hours. We would work with you to schedule it for your lowest-traffic windows. Drupal 11 is the most secure, full-featured version of Drupal. And the timing matters: Drupal 10 reaches end of security support on December 9, 2026. Every Drupal 10 site has to pass through Drupal 11 before Drupal 12. Our team has led many major Drupal upgrades over the years — most recently the main UCSF website and around 20 custom sites from Drupal 10 to 11.

WordPress powers a huge share of the web, which makes it a constant target for hackers. The pace of core security releases has increased sharply in recent years. Falling behind on core, plugin, or theme updates leaves your site exposed to vulnerabilities that are being actively exploited. We keep core, plugins, and themes current, test every update in development and staging (with your review of staging before anything is deployed) and monitor for the vulnerabilities that actually get exploited.

Yes! We specialize in taking over existing sites and improving their security, performance, and compliance without a rebuild. Sometimes the right answer is the site you already own, maintained properly. We'd rather tell you that than sell you a new one.

Because they're open-source, and open-source means you own your platform. No licensing lock-in, no vendor hostage-taking, and a global community maintaining the code. For higher ed and nonprofits, they're also the platforms your future hires will know how to work with — which matters for a site that has to outlive any one contractor.

It means people with disabilities can use your site: screen readers can navigate it, keyboard users can operate it, and color contrast meets standards. For most organizations, the benchmark is WCAG 2.1 AA, which aligns with ADA and Section 508 expectations. We build to that standard from the start, and our support retainers include quarterly accessibility audits. Because accessibility is a practice, not a checkbox.

Yes! Including when the honest number is less flattering than the marketing one. Any agency promising "100% accessibility compliance" on a real, changing website is telling you something that can't be true. We test, we report actual conformance findings, and we help fix them.

As always, it depends on scope. Which is why we start with a conversation, not a price list. What we can promise: a proposal with real numbers, no padded line items, and no surprise change orders for work we should have anticipated. Most organizations come to us with a budget they already have; our job is to tell you what's achievable within it.

Security updates and monitoring, performance optimization, quarterly accessibility audits, and dedicated hours for fixes and small enhancements — with transparent monthly reporting. You always know what was done, what it cost, and what's next.

By design, no. You own the code, the content, and the documentation. The sites we build are meant to be run by your staff or taken over by anyone you choose.Tthat's the whole point of open-source and the whole point of governance. Our happiest endings look like UCSF's multisite: still running, UCSF-operated, long after we've left.

A 30-minute conversation about your mission, constraints, and what's actually broken. It's free, and genuinely free. No pitch at the end. If we're not the right fit, we'll tell you and point you toward people who are.

Our experience runs deepest in mission-driven sectors, and that's where we invest. But the fundamentals: open platforms, honest numbers, accessibility, and long-term stewardship travel well. If your organization values them, the conversation is worth having.