Engineered from the ground up to stay up.
A Drupal hosting platform design that placed survivability as a core requirement. Self-healing infrastructure, an accelerated edge, rapid scaling, and built-in disaster recovery ensure continued operation of your site no matter the challenges.
Recovery measured in seconds.
All Ironstar Enterprise production environments are served simultaneously from two distinct data centres. Not as an expensive add-on with added complexity, but as an out-of-the-box default that just works
5-minute RPO. 5-minute RTO.
Leveraging a comprehensive, fully-automated Kubernetes control plane, the Ironstar platform is built to automatically self-heal. Even from complete data centre failure.
Not an add-on. Always-on.
Maximum data loss window during recovery from a primary-data centre failover scenario. Continuous WAL replication into a hot standby at least 20km away.
Maximum time to restore service after a primary-data centre loss. Automated promotion of the standby replica with no human in the loop to slow things down.
Self-healing infrastructure. For every customer. No exceptions.
When any single component fails — an app instance, a network path, a database replica — the platform detects it within seconds and rebalances live traffic onto the remaining instances automatically. No human in the loop. Nothing for you to do.
This isn't a feature added on top — the platform was built from the ground up around it. Every layer assumes failure as the normal case and is designed to absorb it. Replacement infrastructure launches and self-registers automatically.
Six application instances across two zones share user traffic. Stateful services (database, memcache) run paired across zones; ssh and cron run as singletons.
Built-in Content Delivery Network
Deploying and configuring a CDN for your Drupal site has never been easier. Simply install the Fastly and Ironstar Drupal modules and you're done. Gain immediate access to instantaneous tag-based cache invalidations. Automatically served cached content
Reduce your Drupal hosting bill with eye-watering cache hit rates
Cached responses serve from the closest Fastly server. Visitors see rich pages in less than a second, anywhere in the world.
If the edge serves the request, the origin doesn't. Customers see dramatically lower compute and bandwidth costs at the same — or higher — traffic levels.
Traffic spikes — campaigns, news cycles, scraping bots — are handled at the edge before they reach your web servers. Serve traffic spikes with record page load times and no added cost.
Configure 'stale-if-error' to serve cached content during planned maintenance and unplanned interruptions. If your web server is unresponsive, the cached page is server and users never notice.
Burst-capacity. Without bill shock at the end of the month.
Auto Scaling adds web-server capacity within seconds when demand spikes — and pulls it back when traffic settles. Every site gets an included balance of burst hours, so short-term surges are absorbed without paperwork or added cost.
Sub-second response
Web-server demand is sampled continuously. When metrics breach scale-up thresholds — request queue depth, CPU saturation, response latency — capacity is provisioned automatically.
Ready in seconds
New web servers are online and serving traffic within seconds. After an hour, or when usage drops back down, excess servers are removed automatically.
Predictable monthly billing
Burst capacity within the included allowance never trigger extra billing, so you can gain the benefits of auto-scaling without the uncertainty and bill shock.
Every maintenance release is a live test of the platform's resilience.
We ship maintenance releases several times a month. Systems are taken offline, replaced, and rebalanced — all while serving live traffic. Maintenance windows are scheduled in the early morning to minimise potential disruption, but the platform's design means visitors don't notice anything happened.
This is how we know the resilience design works in practice — not from synthetic drills, but from the continuous evidence of replacing live infrastructure under production load. The result: we consistently exceed our internal SLO of 99.999% uptime, including during maintenance.
Frequently Asked Questions
Synthetic probes from six regions hit a representative URL in production every minute. A site is counted as down when three or more locations fail to receive a HTTP 2xx response within 2 seconds.
Over a calendar year, 99.999% allows for approximately 5 minutes of downtime. We consistently exceed this target, including across maintenance windows. About once a year, we perform some kind of specific maintenance work that might require a short outage, which is why our contractual guarantee is 99.99% and our internal target is 99.999%
Yes. Every subscription runs on the same fault-tolerant fabric with automated detection, traffic rebalancing, and replacement provisioning. Plans for smaller sites offer a 99.9% uptime and will always replace failed hardware in the same data centre within that time. Higher-level, Enterprise plans have a 99.99% uptime and use active replicas for faster failover.
5-minute RPO and RTO are contractual guarantees on Enterprise plans in the Production/Live environment. This is achieved by having replicas distributed and online across two different data centres. Customers on these plans don't have to opt-in, but instead it is built into their service at no added cost.
Plans with an Auto Scaling subscription include up to 12 non-contiguous hours per month of operation at up to 2× purchased capacity, at no additional charge. Usage and remaining balance will visible in your console; alerts fire well before any potential overrun. You will be able to decide if your environment can exceed this limit by purchasing additional coverage hours.
New web-servers provision generally within 30-45 seconds once scale-up thresholds have been crossed. The triggers are based on different dimensions like the amount of available CPU and memory capacity, available PHP workers, and historical trends. Scale-down is gradual to avoid trimming during transient dips.
Fastly's edge cloud platform powers our content delivery and web application firewall. We ship deep integration via the Fastly and Ironstar Drupal modules, and you can control much of the Fastly configuration using the Ironstar Console. Single-button options are available specifically tailored for Drupal sites, so you don't need to be a CDN expert to benefit.
Very rarely. Maintenance is conducted between 2am and 5am to minimise disruption and the platform's design typically means visitors don't notice anything. Because our infrastructure runs across data centres and redundant cluster nodes, we perform upgrades in segments and re-balance workloads to standby infrastructure to minimise impact.
Automated backups are enabled for both database and files at least once per day. Backups happen "out of band" so they don't impact your site's performance, and are stored across three remote locations. Once a backup is taken, it cannot be modified which provides excellent protection against ransomeware attacks.
This is possible only on certain plan levels, and we ask that you give us notice in advance so that we can work with your testers to monitor the process and contribute our findings to your reports after the tests are completed.
Let's start a conversation.
Tell us what you're running, where it hurts, and where you'd like to be. We'll listen, ask good questions, and tell you honestly whether we're the right fit.