Tech Setup & Recovery Infrastructure.

If Code Red is pre-deployed: under 30 minutes for site live on mirror, 24–72 hours for transactional rails (payments, email) reconnected. Cold from zero with no prior infrastructure: 7–14 days for site live, 30–60 days for full transactional rebuild. The whole point of Code Red is the prep, not the response — if there is no prior deployment, we cannot collapse that timeline.

For most restricted categories, yes. Cloudflare hosts cannabis, peptides, supplement, vape, adult retail, and online pharmacy traffic without action under standard ToS. They have terminated for adult content with minor concerns and for certain DDoS-target sites; they do not terminate for category alone in most verticals. For categories where Cloudflare is structurally unreliable (Russian-jurisdiction adult, certain ext combat-sport content) we route through alternative DDoS providers.

Most restricted-market operators do not. Bulletproof hosting trades resilience-against-takedown for higher cost, slower performance, and worse uptime. The right answer for most categories is tier-1 hosting on a provider that tolerates the category, with a Code Red mirror on a different stack as the fallback. True bulletproof hosting is for the small set of categories where every tier-1 provider terminates on category alone.

For some categories, yes — Shopify accepts CBD with COA, accepts adult-tolerant retail with restrictions, accepts most supplement categories, and accepts vape hardware. They reject most peptides, all anabolic steroids, all RC, most kratom, and adult content with explicit nudity. For operators where Shopify works today but might not next year (peptides, kratom, advanced cannabis SKUs), we maintain a parallel WooCommerce or self-hosted instance kept synchronised so migration is days rather than months.

Yes — data-residency in the architecture (EU customer data on EU infrastructure, etc.), DPA paperwork with vendors, and the technical scaffolding for SAR and erasure requests. Legal advice is your counsel; the infrastructure that lets your counsel sign off on the policy is us.

Yes — standard urgent timeline is 7–14 days from notice to fully migrated, depending on database size and integration complexity. With a pre-deployed mirror, hours. Without one, the bottleneck is usually transactional rails (payments, email) rather than the site itself.

Generic devops shops optimise for uptime and cost in environments where the host, the registrar, the CDN, and the payment processor are all stable assumptions. In restricted markets, those are variables. The architecture has to assume that any single vendor in the stack might terminate next quarter, and the cost of being wrong is the business going dark for weeks. Our work is calibrated to that assumption from day one, which generic devops shops rarely are.