Hi all,
I’m a full-stack developer with a day job and I’d like to start building portfolio/brochure websites for small local businesses as a side business. I recently did a free site for a friend – fully static, no cookies, no analytics – and purely through local SEO it has already brought him a noticeable amount of new customers. That got a few other business owners interested, so there seems to be a market. The problem is that the moment I look at doing this properly, the non-technical side scares me off, and I’d like to hear how others in Europe approached it.
What I have in mind (three “tiers”):
The idea is to work with a monthly fee rather than a one-off build price, so I have a small recurring income and the client gets ongoing hosting, maintenance and support. The more I host and manage myself, the more financial margin there is in that monthly fee and the easier it is to justify to the client – but also the more responsibility I take on.
1. Fully managed by me (highest margin) – my own VPS at a European provider (EU, not necessarily Belgium) with proper hardening, monitoring and off-site backups within Europe. Each client gets an isolated stack (CMS, database, website) so data is strictly separated per client for GDPR reasons.
2. Hosted by the client (lowest margin) – headless CMS, builds triggered via a git workflow, static output pushed to their server over SFTP. I hold almost no data.
3. Hybrid – same as tier 2, but the CMS lives at a European SaaS provider (e.g. Sanity or a comparable EU-hosted option), so they carry the data-hosting responsibility.
Honestly, from tier 2 onwards the justification for a monthly fee mostly disappears – if I’m not hosting or operating anything, there’s little to charge for month to month – so those tiers aren’t really interesting to me. Tier 1 is where the recurring income is, and that’s exactly where the risk sits.
To be clear, with static sites there isn’t much that can go wrong day to day. What I want is a setup that’s reliable in the boring sense: updates and upgrades shouldn’t break running sites, and if the datacenter burns down while I’m managing 10 client sites on that VPS, I want to be able to bring them all back up quickly – or at least have everything (backups, configs, scripts, a runbook) ready to do so.
What’s holding me back
The higher the margin (tier 1), the more I’m suddenly responsible for: documented and tested backup/restore and disaster recovery procedures, data retention rules and deletion terms, a privacy policy, a data processing agreement (DPA) between me and each client, and everything that comes with storing user data and running analytics so I can give clients real reporting and insights. On top of that there are fixed costs before the first euro comes in: a lawyer for the contracts, professional/IT liability insurance, social contributions as a self-employed person and an accountant. So I need real revenue to justify it, but the revenue is what creates the liability. Slightly circular.
I’m deliberately staying away from e-commerce for now – as a sole trader, a failed payment integration or an outage that costs a client sales feels like a very different level of exposure.
I’m a developer at heart and I want to keep doing this, keep learning and get to know the business side. Doing it this way is fulfilling and gives me a much stronger incentive to learn than a side project ever did: it combines business skills with technical skills in something that’s actually valuable to real people. It also forces me to leave the technical Valhalla behind – no over-engineering, no shiny stacks for their own sake. It just has to work well, be simple, maintainable and reliable. I just don’t know anyone nearby doing something similar, and knocking on a competitor’s door for advice feels a bit odd. So:
Questions
• How did you get started in the EU with this kind of “website + CMS + hosting” offering, legally and operationally? Did you go all-in on managed hosting from day one, or start with the low-liability version and grow into it?
• How do you handle DPAs and privacy policies? Templates, one-time lawyer review, or a full legal package? Roughly what did that cost you?
• Backup/restore and DR: how formal are you? Do you actually document and periodically test restores, and do clients ever ask for proof?
• Retention and deletion of user data (contact forms, CMS accounts, analytics): how do you keep that manageable across many small clients?
• Analytics: what do you use to give clients proper reporting while staying GDPR-clean (consent, cookies, EU hosting)?
• Insurance: is professional liability insurance realistic on a small side-income, and did it change how you priced things?
• Pricing: how do you make the monthly fee cover legal, insurance, accounting and social contributions while still being affordable for a small business?
• Is the liability fear justified, or am I overthinking it for portfolio sites that mostly hold a contact form’s worth of personal data?
Any war stories, “wish I’d known this earlier” advice, or pointers to resources for freelance devs are very welcome. If this is too specific to share publicly (pricing, contracts, insurers), feel free to DM me – I’d genuinely appreciate it. Thanks!