Procurement: what to buy
Vendor-listed prices read from each pricing page on 2026-09-09, at annual billing where it is cheaper. Every line is self-serve — no sales cycle, no minimum term.
| Vendor | Plan | Unit price | Qty | Annual |
|---|---|---|---|---|
| Vercel | Pro | $20 / member / mo | 3 | $720 |
| Hosting, CI/CD, WAF with 40 custom rules and 100 IP blocks, bot management, DDoS mitigation, SSO-gated preview deploys. Viewer seats are free, so stakeholders review at no cost. | — | |||
| Sanity | Growth | $15 / seat / mo | 5 | $900 |
| Headless CMS. Growth is required rather than optional — the Free tier ships only Administrator and Viewer roles, with no Editor role, which fails basic separation of duties. Includes private datasets, 25K documents, scheduled drafts and 90-day history. | — | |||
| Cloudflare | Pro | $20 / domain / mo, billed annually | 1 | $240 |
| OWASP core managed ruleset, rate limiting, bot fight mode, authenticated origin pull, DNS. $25/mo if billed monthly — pay annually. | — | |||
| Cloudflare | Advanced Certificate Manager | $10 / mo | 1 | $120 |
| Certificate authority and validity-period control. The line that turns "who controls your certificate" from an awkward answer into a documented one. | — | |||
| GitHub | Team | $4 / user / mo | 4 | $192 |
| $0 if an existing SmartData organisation has seats. Required for branch protection and required reviews on security-relevant changes. | — | |||
| Cloudflare Access | Zero Trust Free | — | 50 users | $0 |
| Gated staging for client reviewers without buying them Vercel seats. Free to 50 users. | — | |||
| Cloudflare DNS | Free | — | 1 | $0 |
| Replaces the current DNS Made Easy subscription — an additional saving not counted here. | — | |||
| Pagefind | Open source | — | 1 | $0 |
| On-site search. Static index built at deploy time, so there is no query-time third party in the CSP at all. | — | |||
| Total annual software — Hardened | $2,172 | |||
The Standard build omits Cloudflare ACM: $2,052. HubSpot is unchanged and already owned — forms, tracking and the newsletter API carry across untouched.
The one input that changes these numbers
Does the security review require a signed BAA for the marketing site? sdata.us handles no PHI, so it should not — but SmartData is a claims processor and reviewers default to demanding one. A BAA moves the build to Compliance-grade, replaces two self-serve subscriptions with sales-led contracts, and adds weeks to procurement. Answer this first; everything else on this page holds either way.