Technical Details

01

Business email: deliverability, not convenience

We use a dedicated email provider, not the email bundled with web hosting. One reason: so your email reaches the inbox, not the spam folder.

Most website packages include email from the same hosting server (cPanel). The problem is that the sending reputation there absorbs whatever happens on that server — traffic spikes, attacks on the website, or other tenants on a shared server misbehaving. Once the IP reputation is damaged, even a correct configuration does not help: email still gets flagged as spam.

Our email provider runs a separate mail server whose reputation is managed specifically for sending email. Its infrastructure is certified ISO 27001, ISO 27017, ISO 27018, ISO 27701, and SOC 2 Type II, and states GDPR and HIPAA compliance — the standards large companies use to assess partners. Paid plans support IMAP and Exchange ActiveSync, so email, calendar, and contacts sync to your phone in one step.

On your domain we set up three authentication records: SPF (which servers may send on your behalf), DKIM (a digital signature proving the email was not altered in transit), and DMARC (what receivers should do when someone spoofs your sender). All three appear on your dashboard as a green status and are re-checked automatically every day.

• Business email: 5 GB per mailbox, IMAP, ActiveSync
• SPF, DKIM, DMARC set up and monitored daily
• Email marketing (if used later) is sent from a separate subdomain so your main domain reputation is not affected

02

Domain and DNS: Cloudflare, DNSSEC, and what stays yours

DNS for every client domain is managed on Cloudflare. DNSSEC is on by default. Your domain can leave with you when the contract ends.

Cloudflare provides automatic SSL, a CDN, basic DDoS protection, and a free WAF — and, more importantly for you, one place of management we can audit across all clients. DNSSEC digitally signs your domain answers so visitors cannot be silently redirected to a fake server (DNS spoofing). Most providers leave it off; we turn it on for every client domain.

.com domains are bought at Cloudflare Registrar at cost, with no markup. Cloudflare does not sell .id and .co.id, so we register those through BiznetGio (a PANDI-accredited registrar) and point the nameservers to Cloudflare — same benefits, different place of registration. If you already own a domain, the registration does not move; only the nameservers point to Cloudflare, and we audit every existing record first so nothing goes down during the switch.

Optima holds the Cloudflare zone while the contract runs — the setup is too involved to manage yourself, and that is what you pay for. When the contract ends: a domain you registered yourself remains yours as before; a domain we registered on your behalf can be bought back, and we unlock it for transfer to your account.

03

Website: managed on our servers, the copy is yours

The website is built with Next.js, hosted on Vercel, and its content lives in a database — not hard-coded. If you leave, you receive an HTML copy you can host anywhere.

Because page content lives in a database, text or information changes happen in the database without a redeploy — which is why we do not cap text revisions. Every deployed change can be rolled back to the previous version within seconds, so a revision never risks breaking the live site.

What we sell is a managed service, not access to the infrastructure. Your website and email run on servers we manage — not cPanel — so you cannot add mailboxes or change DNS yourself; that is done through us. In return, everything that runs is visible on your dashboard.

When the contract ends, you receive a copy of the site as static HTML: every information page (Home, About, Services, Contact, and others) that can be moved to any hosting, including the cheapest. Said plainly up front: it is a frozen snapshot of the site content at export time, and features that depend on our systems — contact form, dashboard, chatbot, other add-ons — stop working once separated. It is still far better than being locked in with no way out.

• Next.js + Tailwind on Vercel; content in Supabase
• Tested at 360 px width and on reference devices before handover — our QA standard, not a guarantee of perfection on every device
• Instant rollback to the previous version

04

Basic SEO and AI readiness (GEO)

Beyond Google, the site is prepared to be read and cited by AI assistants. Two technical parts: a robots.txt that allows AI crawlers, and an llms.txt file.

Search is shifting toward AI assistants. ChatGPT, Claude, and Perplexity run their own crawlers (GPTBot, ClaudeBot, PerplexityBot) that obey robots.txt — if that file blocks them, or does not address them, your business is unlikely to ever be mentioned when people ask an AI. We allow them explicitly and include llms.txt: a short file that helps AI understand which pages on your site matter.

The basic SEO itself covers initial keyword research and competitor mapping, a sitemap, meta tags, heading structure, and Organization/LocalBusiness schema so Google and AI recognize your business identity without guessing from text. Name, address, and phone are kept consistent between the site and Google Business Profile. This site uses all of the above itself — you can check /robots.txt and /llms.txt.

05

Google Business Profile: you own it, we manage it

Your Google account is the primary owner of the profile; Optima is added as a manager. That is not our own policy — it is an official Google requirement.

Google third-party policy requires every client to retain ownership or co-ownership of their Business Profile at all times, and requires managers like us to hand over full control within 7 working days when asked. If we violated it, Google could suspend our account. So the "you are primary owner, we are manager" arrangement gives two things at once: we can post updates, reply to messages, and maintain the listing without holding your login; and you can remove our access anytime from your own panel, with no dispute process.

A complete setup means: duplicate listings are checked and merged first, primary and secondary categories are chosen carefully, attributes and hours filled in, logo and photos uploaded, messaging enabled, and the business type (physical location or service-area) determined up front so the map and service area are right. The verification method is chosen by Google, not us, so it may be phone, postcard, or video.

• You need your own Google account, ideally with 2-step verification
• We reply to messages that arrive through the listing; public reviews and comments we do not reply to

06

Client dashboard: how the status is pulled

One shared checking engine examines every client daily and stores the result. The dashboard shows the latest result rather than re-checking on every open.

Every day at 03:00 WIB, our system checks your domain: SPF, DKIM, DMARC, and MX records via DNS; DNSSEC and domain expiry via RDAP; HTTPS, redirects, and SSL certificate validity; and domain reputation via Google Safe Browsing. Results are stored and shown in three colors: green healthy, yellow needs attention (for example a domain expiring within 30 days), red a problem — and every red alerts our team before you need to ask.

You sign in via a link sent to your business email, no password. The modules shown follow your active add-ons: core-package clients see domain, email, and Google profile; clients with add-ons see their extra modules — chatbot quota, lead counts, ad performance — on the same page.

07

Payment, and if it is late

All payments go through Mayar (QRIS), self-service, with no manual invoicing. If a monthly subscription is late, service is switched off, not deleted.

The setup fee is paid once after the needs interview is complete and the total is clear; work starts as soon as payment is confirmed. The monthly subscription covers genuinely recurring costs — domain renewal, email, hosting, dashboard — and is where add-ons are billed. There is no minimum commitment on the core package; paid ads carry a 3-month minimum per campaign because ad algorithms need time to learn.

Reminders go out 14, 7, 3, 2, and 1 day before the due date. If it passes unpaid, we switch the domain off in DNS — the site and email become unreachable, but no data is deleted; once paid, everything comes back on. Grace periods and post-expiry renewal fees follow each registrar policy, not numbers we set ourselves.