Start from the four terms
A Magento (Adobe Commerce) support contract turns on four things, which are a response time per severity level, a patch application deadline in days, a price and an exit term. Any agency can publish all four without anyone's permission, and most do not. Of the eight agencies compared on this site, read on 22 September 2026, Rocket Web publishes three (two response levels, a five-day patch deadline, four plan prices), JetRails publishes three (a 15-minute emergency SLA, a hosting price range, hourly billing with no lengthy contracts), scandiweb publishes one (a 24-hour first response with no severity split), and the other five publish none. Begin the shortlist with what is published, because it is the only thing you can compare before a sales call, and because an agency that publishes a term has already decided to be held to it.
Check the version before the vendor
The store's Magento version decides what kind of support you are buying. Adobe's lifecycle page, read on 22 September 2026, puts 2.4.4 and 2.4.5 past extended support and inside a one-time security-only period to 31 May 2027 with no quality fixes; 2.4.6 in extended support to 31 August 2027, then security-only to 31 May 2028; 2.4.7 in standard support to 31 May 2027; 2.4.8 to 31 May 2028; and 2.4.9 to 31 May 2029. A store on 2.4.6 or older is buying an upgrade with a support retainer attached, and the vendor question becomes who publishes upgrade work. On this site that is scandiweb, whose IONTO case describes an upgrade from 2.2.10 under a retainer and whose Classic Football Shirts case describes 2.4.0 to 2.4.4-p2, and Rocket Web, whose $5,500 Steady plan lists platform and extension upgrades as a feature. A store on Adobe Commerce on Cloud also has Adobe's enforcement date: from 1 June 2027, Adobe states it will stop maintaining Cloud environments on unsupported versions.
Separate monitoring from response
Every plan says 24/7 somewhere. Read what the 24/7 attaches to. Rocket Web's page is the clearest published example, with 24/7 uptime and error monitoring on the $3,500 Covered plan, human urgent response at next business day from the $5,500 plan, and same-business-day emergency response from the $9,500 plan. A store can be monitored around the clock, alerted at 2am on a Sunday, and have nobody contractually obliged to touch it until Monday. Write two lines into the contract, monitoring coverage and out-of-hours human response by severity. JetRails publishes a 15-minute emergency response SLA for infrastructure as an enterprise add-on; no agency on this site publishes an out-of-hours application response time.
Decide the hosting boundary
Decide whether hosting and application work sit in one contract or two, and then name the owner of root access, of firewall and CDN configuration, and of the deploy pipeline. A split works when those names are written down. JetRails publishes the infrastructure half, with a web application firewall, daily backups, PCI DSS Level 1, and Redis, Varnish and CDN tuning. If you split, the application agency's contract has to state that its response time still applies when the incident turns out to be on the server, and vice versa.
Ask for evidence of maintenance work
A case study about a launch tells you about a launch. Ask for one about an upgrade, a patch cycle or a migration, with a client name and a number, because that is the work a support retainer ends up doing. On this site, scandiweb publishes five such cases; the seven other agencies publish build or marketing results or none. Treat every case as the agency's own write-up and one project's result, and ask for a reference on a store like yours.
Check the tier on a third-party page
An Adobe partner tier on an agency's own site is that agency's statement; Adobe's directory needs a partner login, so this site records every Adobe tier as self-stated. The hyva.io partner directory is public and lists scandiweb and integer_net under Platinum, Aureate Labs under Gold and Classy Llama under Silver as of 22 September 2026. Rocket Web states a Hyvä Silver partnership that the directory did not show. A tier tells you the agency has met a partner program's bar; it says nothing about the four contract terms.
The shortlist questions
- What response time do you commit to per severity level, and during which hours does the clock run
- Within how many days of Adobe's release do you deploy a security patch to production, and who keeps the store on the latest -p release so isolated patches apply
- What is the monthly price, what does it include, and what is billed on top
- What is the notice period, what is handed over at the end, and who owns the CI/CD configuration
- Who owns root access, the firewall and CDN layer, and the deploy pipeline
- Which dependencies (PHP, database, search) does the retainer keep on supported versions, since Adobe patches none of them
- Which upgrade or migration have you delivered under a retainer, for whom, and with what result
Take the answers as contract schedules, not as web copy. An agency that publishes a term has made the first move; the contract makes the second. The ranking on this site is a record of who has made the first move, with the source and date for each, and the contract terms guide sets out how to write the second.