A clinical canine massage therapist works inside a legal framework: before she lays a hand on a dog to treat a problem, the dog's vet has to have examined it and consented. Her website has to explain that framework to owners who have never heard of it, show what a session involves and what it costs, and take an enquiry that includes the things she needs to know about the dog. Severn Clinical Canine Massage Therapy, a one-person practice based in Upton upon Severn that treats dogs at a veterinary clinic and in their own homes across Worcestershire, Herefordshire and Gloucestershire, needed exactly that site, and needed it built so that a sole trader's obligations under data-protection law were met properly and once. The build ran the formal way round. Foundations before code.
We already held the practice's domain. The engagement began in May 2026 with a written specification, then the paperwork the specification said must come first: a services and processor agreement, signed in counterpart on the last day of May, recording what the site does with personal data and on whose instructions; the practice's own registration with the Information Commissioner, obtained with our help, because a privacy notice cannot go live with a placeholder where a registration number belongs; and a compliance pack written for her rather than for us: a record of processing, a legitimate-interests assessment, a transfer risk assessment, a screening decision, a recovery procedure and the accessibility audit record. The state of the domain's records was captured and filed before anything was changed. Only then was there code.
What the practice has now
A single page, by the therapist's own choice, with the content in anchored sections: who she is and how she came to the work, what the therapy is and the signs owners notice first, what a first appointment involves, why the vet signs off first and a downloadable consent form published as a tagged, accessible document, the services, the owners' own words, a gallery, the questions people ask before booking, and the form. Beside it a privacy notice, an accessibility statement, a terms page and a not-found page, and in every footer the disclosure a sole trader using a trading name is required to make, with her registration number. The fonts are self-hosted. No cookie needs consent, so there is no banner, and there are no analytics. The page's own security policy allows no inline script or style and reports any violation to an endpoint of the site's own, and the headers it serves were graded A+ before launch. It is hosted on a free tier in a UK region, and a build that fails deploys nothing, so a bad commit leaves the live site as it was.
The form asks about the owner and the dog, validates on the way in, carries a hidden field that only a bot would fill, refuses a message with more than three links, and checks the submission with a spam check before anything is sent. What passes is relayed to the therapist's own mailbox with the enquirer as the reply address, and the message itself is stored nowhere on the way. What is kept is an audit trail: one row for every outcome the form can reach, eight in all, recording when, what happened and a salted hash in place of any address, never the message, kept for twelve months and pruned monthly. An alert mails out, to an address off the site's own domain, the moment the server starts returning errors, so that a failure is something we are told about rather than something a visitor discovers for us. A health endpoint answers only when the server-side code is actually running, and two external monitors fetch the page and the endpoint every five minutes.
Mail that was never put at risk
The practice's own email already lived on the domain before the project began, and nothing in the build was allowed to touch it. Every change to the zone was additive: the form's sending records went on a subdomain of their own, so that two services could never collide on one policy record, and each addition was compared with the filed baseline, from the public resolvers and from the authoritative nameservers alike, until the diff read four additions and nothing else. The first message through the new path was judged by the authentication headers of what actually arrived, all three checks passing, before a real enquiry was trusted to it.
The cutover, on a Wednesday morning in late August, edited four web records and nothing else. The two address records for the old host were repointed, and the two for the newer address family were deleted rather than repointed, because the new host publishes none and a browser that finds one prefers it; left in place they would have kept most visitors on the retired host while looking green to anyone testing over the older family. The seven mail record sets were diffed against the pre-cutover baseline, which was kept as the rollback artefact, and all seven were unchanged. Both hostnames carried valid certificates within the hour, and the public resolvers had moved inside twenty minutes.
The audit was the gate
The specification made a clean accessibility audit the condition on which the switch could happen, not a check at the end. It was run against every page: the automated tools, a contrast measurement that resolves each element's effective background through its transparent ancestors rather than trusting the palette, and the ten manual checks, including screen readers on desktop and phone, reflow at 320 pixels, four-hundred-percent zoom, text spacing, reduced motion and the form's error handling. It finished with full marks for accessibility on every page, no violations, no contrast failures and no known limitations, and the published statement says so. Everything it found was fixed before launch. The one thing every emulated check missed was found by the therapist on her own phone: a single long email address that would not break, holding the page a few pixels wider than the screen so that it panned sideways. It was fixed the same day, and the instrument that would have caught it, an in-page probe that enumerates element edges across the common phone widths, is now part of the audit.
— On gates —The audit was not a check at the end. It was the condition on which the switch was allowed to happen.
Held for her benefit
The domain is registered through our account, and the agreement records that it is held at all times for the practice's benefit. The account is hardened to a written list, checked before launch and annually after it: transfer lock on, renewal automatic, two-factor authentication on, the billing contact an address off the domain, so that an outage of the domain cannot lock out the people fixing it. The public registration record is checked on the same cadence, and against the registry's own data rather than a rendered page, so that "no name is displayed" is evidenced rather than inferred. That check established, early on, that the suppression lives at the registry and not in any account setting, a correction carried into our own site's specification the same day. On request, at any time, the domain transfers to a registrar account of her choosing.
What the practice has, then, is a site that explains its own legal framework in plain words, takes an enquiry without keeping anyone's details, runs within a free hosting tier, passed an audit that was allowed to stop the launch, and sits on a domain that is hers in every sense except the registrar's spelling. The old hosting the domain once pointed at has gone.