Choose by the system your site has to talk to. Orbit Media Studios suits manufacturers and B2B companies that need a lead-focused site and a team with long tenure; Adage Technologies fits associations, museums and arts groups whose site runs on membership, ticketing or commerce platforms; Blueshoon is a development partner for brands with an established site or store; and Firebelly Design is the choice for nonprofits and cultural organizations that want brand and accessible web work together. The answers below cover three issues worth settling in the contract: Chicago’s cloud tax, outages at the big infrastructure providers and emergency framework patches.
How much does Chicago tax website hosting and software subscriptions?
Fifteen percent, for now. Chicago’s Personal Property Lease Transaction Tax, often called the cloud tax, covers the nonpossessory lease of a computer, which the city reads to include paid remote computing and software such as SaaS, platform and infrastructure services. The rate on those charges was 7.25% in 2020, 9% from 2021 and 11% from January 2025, and it has been 15% since January 1, 2026; a 2027 city budget proposal released in October 2026 would raise it to 20%, though the City Council had not adopted it by mid-November. Providers are expected to collect the tax, new businesses with under $25 million in gross receipts and fewer than five years of operation can apply for an exemption, and Illinois itself does not tax custom or remotely accessed software, so ask your designer to bill design work separately from hosting and licenses.
What happens to a website when Cloudflare or AWS goes down?
It can go dark even if its own server is fine. On November 18, 2025, a database permissions change at Cloudflare filled a Bot Management configuration file with duplicate entries, the oversized file crashed its proxy software, and sites behind Cloudflare returned errors from 11:20 UTC until core traffic largely recovered around 14:30, with every service normal by 17:06; a second incident on December 5 broke about 28% of its HTTP traffic for 25 minutes. A month earlier, on October 19 and 20, a race condition in the DNS automation of Amazon’s DynamoDB disrupted the AWS us-east-1 region for about 14 hours. Ask your designer which providers sit in front of and behind your site, what visitors see when one of them fails and whether a static fallback page or a second region is worth the cost.
Does a React or Next.js site need emergency patches?
Sometimes within hours. On December 3, 2025, the React team disclosed CVE-2025-55182, a flaw rated 10.0, the top CVSS score, that let unauthenticated attackers run code on servers using React Server Components; it affected versions 19.0, 19.1.0, 19.1.1 and 19.2.0 of the react-server-dom packages and frameworks built on them, Next.js among them, and was fixed in 19.0.1, 19.1.2 and 19.2.1, with related denial-of-service and source-code-exposure flaws listed in an update on January 26, 2026. Apps that render React only in the browser were not affected, but any agency building on a server-rendered JavaScript framework should say how fast it applies security releases and whether that work is covered by the maintenance fee.
