What this site runs on, and what it costs.
Visitors sometimes ask: this looks like a lot, what does it cost? The honest answer is about fifteen dollars a month, and the only reason that's surprising is that the managed platforms most people benchmark against are designed to make their real cost hard to read.
Every line of the AWS invoice that runs penumbra-tech.com.
Everything visible on this site (the marketing pages, the React SPA, the Node API, the MySQL database, the admin portal, the diagnostics dashboard, the Stripe integration, the contact form, the load-tested benchmark routes) runs on one small AWS server and a handful of supporting services. Here's what each piece costs.
Pricing pulled from AWS list (us-east-2), early 2026. Reserved EC2 pricing brings the largest line down to ~$5/month if you want to pre-commit a year.
The same feature set on Wix, Squarespace, Shopify, or WordPress.
Apples to apples is hard because none of these platforms ship a single tier that covers "auth + payments + scheduled jobs + custom admin dashboard + your own data model + first-party tracking" out of the box. The numbers below are the realistic running cost once you add the apps an actual small business ends up needing.
Wix Business (with bookings)
$32 base + ~$30–80 in app add-onsplus 2.9% + $0.30 per payment if you use Wix Payments; you do not own the database or DNS.
Squarespace Commerce Basic
$36 baseplus 3% transaction fee on every sale; limited custom code; you cannot self-host.
Shopify Basic
$39 base + apps usually $50–250plus 2.9% + $0.30 per payment; apps often have per-order fees that compound; theme work is its own line item.
WordPress (WP Engine startup)
$30 base + plugins $10–100+plus paid themes, plus a security plugin you actually trust, plus the maintenance hours when WP autoupdates break a plugin.
Managed platforms aren't expensive because the work is hard.
They're expensive because their pricing has two jobs: upsell you onto more of their services, and make it expensive for you to leave. Tiered plans, per-transaction fees, app marketplaces with their own per-order tax, "talk to sales" walls on anything custom, contractual data-export friction. It all looks like a discrete monthly subscription on the surface, and on the actual invoice it's a percentage of your revenue.
For most small businesses that's a fair trade for a while. You don't want to manage a server when you're learning what your product is. But once the product is working and the bill is climbing, the same managed platform that helped you launch is now the largest fixed cost on your books, and the platform tax is being applied to every order you take.
The fork in the road usually shows up around $100/month in platform fees. That's the moment when migrating to a setup like this one, that runs at ten percent of the cost and gives you the source code, starts paying for itself in six to twelve months of savings on top of whatever it actually unlocks for the product.
Mass platforms are mass targets. Being a small custom site is a security feature.
Big managed platforms run effectively identical software for millions of sites. That's economically efficient for them and operationally efficient for you, right until somebody finds a way in. Then it isn't. WordPress and its plugin ecosystem alone have had years where a single CVE quietly compromised hundreds of thousands of sites over a weekend. The pattern is not exotic; it's the business model of mass exploitation. One vulnerability, thousands of victims, attacker ROI through the roof.
When that happens, your site is in the blast radius regardless of how careful you have been. The platform's security posture is your ceiling. You can't patch what you don't control, you usually can't even verify what version of what runtime your tenant is running, and the first you hear about the breach is when your bank starts declining the cards your customers used last Tuesday.
A bespoke site running its own stack is a one-off target. Exploiting it costs an attacker the same effort as exploiting a single WordPress install, but the payoff is one site instead of fifty thousand. They go elsewhere. You also get to make security choices that aren't available on a shared tenant: rate limiters tuned to your actual traffic, CSPs scoped to your actual integrations, secrets managed your way, audit logs you can read, and an attack surface you can list on one page.
Bespoke isn't an upgrade to your security. It's a downgrade to your value as a target, and that's often the same thing in practice.
No platform tax. No vendor lock-in. The invoice comes from AWS.
You pay AWS, not a platform middleman
The invoice for hosting comes from Amazon directly, in your AWS account. No platform tax, no markup, no opaque tiers. You can audit every line.
You own the source
Everything that runs your site lives in a Git repository you control. No vendor lock-in. If you ever fire me, you can hand the repo to any other developer and they can keep going.
You own the data
Your MySQL database lives on disk you control. Nightly automated SQL dumps land in S3 or on the box itself. No "export" tier, no "download CSV" friction, no contract clause that says we own your customer list.
Cost scales with use, not feature flags
Need more horsepower? Bump the EC2 size and pay the difference. Need less? Bump it down. You are never paying for a feature tier you do not need, and there is no "talk to sales" pricing wall.
Worth a 30-minute conversation.
I can usually tell within a call whether moving you off the platform is going to pay for itself. If it isn't, I will say so. If it is, the typical shape is a four-to-six-week build sprint plus a one-page handover doc and a twenty-dollar-a-month AWS bill you own.