Legal

Plan Conditions

Drupal Support · Effective 2026-10-01 · Version drupal-conditions-2026-10-v1

What these conditions cover

These conditions govern the Drupal Support plans (Essential, Professional and Growth) and the weekend and holiday on-call add-on offered by CAMF Solutions Inc.. Subscribing means agreeing to them and to our Terms of Service. If the two differ, these conditions apply to Drupal Support. Each plan covers one Drupal site (one codebase with its production environment and, where the plan includes it, a staging environment).

Definitions

• Business hours: 9:00 to 18:00 US Eastern Time, Monday to Friday, excluding US federal holidays. A business day is any of those days.
• Response: a person on our team has acknowledged your request, assessed it and told you the next step. A response is not the same as a fix.
• Security release: a release of Drupal core or of a contributed module installed on your site, published with a Drupal security advisory.

Onboarding

• Onboarding starts once we have the access we need, and normally takes up to ten business days. We review the site, set up uptime monitoring, confirm a working backup and agree how you want to be reached. Onboarding does not use your hours.
• Update windows, response times and service credits apply from the day we confirm by email that onboarding is complete.
• If onboarding shows the site cannot be supported safely as it is (for example, it is already compromised, its hosting cannot run a supported PHP version, or it depends on abandoned code with known vulnerabilities), we tell you before onboarding ends. We then quote the work needed to fix it, or you can cancel and we refund your first payment in full.
• Sites on a Drupal version that no longer receives security releases (Drupal 7, 8 or 9) can be supported while an upgrade is planned. The update windows below apply only to security fixes that are actually published for that version.

Support hours

What uses your hours

• Bug fixes, configuration changes, troubleshooting and technical questions, on every plan.
• On Growth, also new development: features, integrations, content types and workflow changes.
• Adapting custom code (code written for your site, by us or others) when an update requires it.
• Fixing accessibility, privacy or other findings from our reviews, when you ask us to.

What does not use your hours

• Applying security and maintenance updates to Drupal core and contributed modules, including resolving conflicts between them that the update causes.
• Uptime monitoring, backup verification, the monthly status report, and the reviews, calls and planning listed for your plan.
• Fixing anything our own work broke.

How hours are counted

• Time is recorded per request in 15-minute steps, rounded up. Your monthly report shows the time used.
• Hours are available from the first billing period after onboarding is complete and reset at each monthly renewal. Unused hours expire, except on Growth, where up to 4 unused hours carry over to the next month only. Carried hours are used first, do not carry over again, have no cash value, and are lost if you cancel or move to a lower plan.
• Before going beyond your plan's hours, we tell you and ask. Extra work you approve in writing (an email or a request in your account is enough) is billed at $150 an hour on your next invoice. Larger work, such as a redesign or a major-version migration, is quoted as a project, and on Growth your remaining hours can be put towards it.

Security update windows

The clock starts when the Drupal security advisory is published. "Applied" means the update has been tested (on staging, on plans that include it) and deployed to your production site.

• Severity is the one the Drupal Security Team gives the advisory. Less critical releases are applied in the next scheduled monthly update.
• If a window would end on a weekend or US federal holiday, it ends at the start of the next business day instead.
• If an update cannot be applied safely within the window (for example, because custom code needs changing first), we apply a mitigation where one exists, tell you, and complete the update as soon as practical.
• On Essential, which has no staging environment, updates are deployed to production after automated checks, and you accept the small risk that brings.

Support requests and response times

• Essential: response within 1 business day, by email.
• Professional: response within 4 business hours, by email; a video call when a call is the quickest way to resolve it.
• Growth: the Professional times, plus a response to P1 requests within 1 hour during business hours.
• P1 requests must be sent through the emergency channel we give you at onboarding. We set the priority using the definitions above and tell you if we change the one you gave.
• We work on requests until they are resolved, but fix times depend on the problem, so we do not commit to them.

Weekend and holiday on-call (Growth add-on)

With the add-on, P1 requests sent through the emergency channel on Saturdays, Sundays and US federal holidays get a response within 1 hour, at any time of day. The add-on covers P1 requests only; the work uses your plan's hours, and beyond them is billed at the extra-hours rate. It can be added or removed at the next billing period.

Service credits

• On Professional and Growth, if we miss a security update window or a P1 response time after onboarding is complete, you can claim a credit of 10% of that month's plan fee for each miss, up to 50% of the fee in any month.
• Claim it by email within 30 days of the miss. The credit is applied to your next invoice, and has no cash value if the subscription ends.
• No credit is due when the cause is one of the exclusions below, a delay waiting for you, a change freeze you asked for, or a lost or withdrawn access.
• Service credits are the only remedy for missing these times.

Reviews, reports and planning

• Backup verification (monthly): we check that a recent backup of your site exists and can be restored. Your hosting remains the primary backup; see your responsibilities below.
• Stack review (Professional, quarterly) and migration runway planning (Growth): a written assessment of what is outdated or at risk and what to plan for. Carrying out the work uses hours or is quoted.
• GDPR technical review (Professional, quarterly): we check consent forms, the cookie banner and how the site collects and stores personal data, and report what to fix.
• GDPR operational support (Growth): the quarterly review, plus documentation templates for your privacy lead or Data Protection Officer, data subject request workflows set up on your site, and an annual technical review.
• Accessibility spot-check (Growth, quarterly): a check of your key templates against selected WCAG 2.1 Level AA success criteria, with a findings report.
• Privacy and accessibility work is technical support, not legal advice or a guarantee of compliance; you remain the data controller and responsible for your site's compliance, as the Terms of Service describe. Our Data Processing Agreement covers the personal data we handle on your site.
• Account manager and strategy call: Professional and Growth have a named account manager; Growth includes a 30-minute strategy call each month, which does not carry over if unused.

What the plans do not cover

• Bugs in Drupal core or contributed modules themselves. We work around them, report them upstream and apply community patches; writing a patch ourselves uses hours.
• Outages or problems at your hosting, CDN, DNS or email provider, or in third-party services and APIs your site uses.
• Problems caused by changes that someone other than us made to the site, its server or its hosting.
• Content entry and editing, design changes and content migration, unless your plan's hours cover them.
• Hosting costs, licences for paid modules or services, and third-party fees.
• Cleaning up a site that was compromised before onboarding finished; this is quoted separately.

Your responsibilities

• Give us and keep in place the access we need: a Drupal administrator account, the code repository, and server or hosting access (SSH or the hosting control panel).
• Keep the site on hosting that can run a supported version of Drupal and PHP, and on Professional and Growth, allow a staging environment (we can set one up on your hosting).
• Keep your own backups through your hosting provider. Our backup verification checks them but does not replace them.
• Tell us before anyone else changes the site's code, server or modules, so we do not overwrite each other's work.

Ownership of the work

Code and configuration we write for your site become yours once the invoice covering them has been paid. Our own tools, scripts and reusable components stay ours, and you get a permanent licence to use any that remain in your site. Patches to Drupal core or contributed modules are released under the GPL like the rest of Drupal, and we may contribute them back to the community, without any of your confidential information.

Ending the plan

• You can cancel or change plans as the Terms of Service describe; a cancellation takes effect at the end of the billing period you have paid for.
• When the plan ends, we remove our access, hand over any credentials, documentation and monitoring we set up for you, and recommend you change the passwords you shared with us.
• Unused and carried-over hours lapse when the plan ends.

Questions

Write to info@camfsolutions.com.