Technical Details

01

Business email: deliverability, not convenience

We use a dedicated email provider, not the email bundled with web hosting. One reason: so your email reaches the inbox, not the spam folder.

Most website packages include email from the same hosting server (cPanel). The problem is that the sending reputation there absorbs whatever happens on that server — traffic spikes, attacks on the website, or other tenants on a shared server misbehaving. Once the IP reputation is damaged, even a correct configuration does not help: email still gets flagged as spam.

Our email provider runs a separate mail server whose reputation is managed specifically for sending email. Its infrastructure is certified ISO 27001, ISO 27017, ISO 27018, ISO 27701, and SOC 2 Type II, and states GDPR and HIPAA compliance — the standards large companies use to assess partners. Paid plans support IMAP and Exchange ActiveSync, so email, calendar, and contacts sync to your phone in one step.

On your domain we set up three authentication records: SPF (which servers may send on your behalf), DKIM (a digital signature proving the email was not altered in transit), and DMARC (what receivers should do when someone spoofs your sender). All three appear on your dashboard as a green status and are re-checked automatically every day.

Hosting plans that promise "unlimited" email usually only win on storage space, not on actually landing in the inbox. The sending IP is still shared with hundreds of other domains on the same server, so if one of those tenants gets compromised and used to send spam, that IP's reputation takes the hit, and your email pays for it too. More on why this happens and how to check it in our article.

• Business email: 5 GB per mailbox, IMAP, ActiveSync
• SPF, DKIM, DMARC set up and monitored daily
• Email marketing (if used later) is sent from a separate subdomain so your main domain reputation is not affected
• "Unlimited" mailboxes on a hosting plan is about storage space, not a guarantee your email reaches the inbox

Why email can go to spam, and how we prevent it

02

Domain and DNS: Cloudflare, DNSSEC, and what stays yours

DNS for every client domain is managed on Cloudflare. DNSSEC is on by default. Your domain can leave with you when the contract ends.

Cloudflare provides automatic SSL, a CDN, basic DDoS protection, and a free WAF — and, more importantly for you, one place of management we can audit across all clients. DNSSEC digitally signs your domain answers so visitors cannot be silently redirected to a fake server (DNS spoofing). Most providers leave it off; we turn it on for every client domain.

.com domains are bought at Cloudflare Registrar at cost, with no markup. Cloudflare does not sell .id and .co.id, so we register those through BiznetGio (a PANDI-accredited registrar) and point the nameservers to Cloudflare — same benefits, different place of registration. If you already own a domain, the registration does not move; only the nameservers point to Cloudflare, and we audit every existing record first so nothing goes down during the switch.

Optima holds the Cloudflare zone while the contract runs — the setup is too involved to manage yourself, and that is what you pay for. When the contract ends: a domain you registered yourself remains yours as before; a domain we registered on your behalf can be bought back, and we unlock it for transfer to your account.

03

Website: managed on our servers, the copy is yours

The website is built with Next.js, hosted on Vercel, and its content lives in a database — not hard-coded. If you leave, you receive an HTML copy you can host anywhere.

Because page content lives in a database, text or information changes happen in the database without a redeploy — which is why we do not cap text revisions. Every deployed change can be rolled back to the previous version within seconds, so a revision never risks breaking the live site.

What we sell is a managed service, not access to the infrastructure. Your website and email run on servers we manage — not cPanel — so you cannot add mailboxes or change DNS yourself; that is done through us. In return, everything that runs is visible on your dashboard.

Vercel and Supabase, the two services your website and data run on, have each been audited by independent parties for SOC 2 and ISO/IEC 27001. Data in Supabase is encrypted at rest and in transit. Worth knowing too: those certifications are theirs and cover their infrastructure. Optima itself has not gone through those audits.

When the contract ends, you receive a copy of the site as static HTML: every information page (Home, About, Services, Contact, and others) that can be moved to any hosting, including the cheapest. Said plainly up front: it is a frozen snapshot of the site content at export time, and features that depend on our systems — contact form, dashboard, chatbot, other add-ons — stop working once separated. It is still far better than being locked in with no way out.

• Next.js + Tailwind on Vercel; content in Supabase
• Tested at 360 px width and on reference devices before handover — our QA standard, not a guarantee of perfection on every device
• Instant rollback to the previous version
• Infrastructure certified for SOC 2 and ISO/IEC 27001 (Vercel's and Supabase's)

Vercel security · Supabase security

04

Basic SEO and AI readiness (GEO)

Beyond Google, the site is prepared to be read and cited by AI assistants. Two technical parts: a robots.txt that allows AI crawlers, and an llms.txt file.

Search is shifting toward AI assistants. ChatGPT, Claude, and Perplexity run their own crawlers (GPTBot, ClaudeBot, PerplexityBot) that obey robots.txt — if that file blocks them, or does not address them, your business is unlikely to ever be mentioned when people ask an AI. We allow them explicitly and include llms.txt: a short file that helps AI understand which pages on your site matter.

The basic SEO itself covers initial keyword research and competitor mapping, a sitemap, meta tags, heading structure, and Organization/LocalBusiness schema so Google and AI recognize your business identity without guessing from text. Name, address, and phone are kept consistent between the site and Google Business Profile. This site uses all of the above itself — you can check /robots.txt and /llms.txt.

05

Google Business Profile: you own it, we manage it

Your Google account is the primary owner of the profile; Optima is added as a manager. That is not our own policy — it is an official Google requirement.

Google third-party policy requires every client to retain ownership or co-ownership of their Business Profile at all times, and requires managers like us to hand over full control within 7 working days when asked. If we violated it, Google could suspend our account. So the "you are primary owner, we are manager" arrangement gives two things at once: we can post updates, reply to messages, and maintain the listing without holding your login; and you can remove our access anytime from your own panel, with no dispute process.

A complete setup means: duplicate listings are checked and merged first, primary and secondary categories are chosen carefully, attributes and hours filled in, logo and photos uploaded, messaging enabled, and the business type (physical location or service-area) determined up front so the map and service area are right. The verification method is chosen by Google, not us, so it may be phone, postcard, or video.

• You need your own Google account, ideally with 2-step verification
• We reply to messages that arrive through the listing; public reviews and comments we do not reply to

06

Client dashboard: how the status is pulled

One shared checking engine examines every client daily and stores the result. The dashboard shows the latest result rather than re-checking on every open.

Every day at 03:00 WIB, our system checks your domain: SPF, DKIM, DMARC, and MX records via DNS; DNSSEC and domain expiry via RDAP; HTTPS, redirects, and SSL certificate validity; and domain reputation via Google Safe Browsing. Results are stored and shown in three colors: green healthy, yellow needs attention (for example a domain expiring within 30 days), red a problem — and every red alerts our team before you need to ask.

You sign in via a link sent to your business email, no password. The modules shown follow your active add-ons: core-package clients see domain, email, and Google profile; clients with add-ons see their extra modules — chatbot quota, lead counts, ad performance — on the same page.

See a live dashboard demo · Full tour of the client dashboard

07

Paid ads: how the budget and fees are calculated

The top-up goes in full as ad spend; our 15% management fee is billed separately, on its own invoice line, with no VAT.

If you turn on the Paid Ads add-on, you top up a chosen amount (minimum Rp1,500,000; we recommend Rp3,000,000 so the ad algorithm has enough time to learn). That amount goes in full into your own Google Ads/Meta Ads account, not a shared account, our 15% management fee is then billed separately on its own invoice line with no VAT (Optima is not a VAT-registered business), so it is clear what goes to the ad platform and what becomes our revenue. Inside the ad account, Google and Meta collect their own 11% VAT from the balance, so roughly 90% of the amount becomes actual ad delivery.

The first three months of every campaign are a learning phase, the platform's algorithm needs time to gather data before results stabilize, with normal daily variance of around Rp100,000. We send a performance review every week, without waiting for you to ask. Ad creative (headline, image, copy) is reviewed and approved via Telegram before the first campaign goes live.

Unused budget becomes universal credit in your account, usable for the next top-up or other add-ons, never refunded as cash.

Full explanation: how the ad budget works

08

Payment, warranty, and if it is late

All payments go through Mayar (QRIS), self-service, with no manual invoicing. The site's go-live is guaranteed within 7 business days; if a monthly subscription is late, service is switched off in stages, not deleted outright.

The setup fee is paid once after the needs interview is complete and the total is clear; work starts as soon as payment is confirmed. We guarantee your site goes live within 7 business days of the interview finishing and us receiving your complete materials, if we miss that, we refund the setup fee. The monthly subscription covers genuinely recurring costs, domain renewal, email, hosting, dashboard, and is where add-ons are billed; an annual option of Rp1,990,000 (equivalent to 10 months) is available so you do not have to pay every month. There is no minimum commitment on the core package; paid ads carry a 3-month minimum per campaign because ad algorithms need time to learn.

If a monthly subscription is late, it is switched off in stages from the due date, not all at once on day one: on day 0 your dashboard shows a red status and a warning banner appears on the site; on day 7 the website is switched off while email keeps working; on day 14 email is switched off too; on day 30 the contract is treated as ended, the exit clause applies, and we stop renewing your domain. No data is deleted throughout this ladder, once paid, everything comes back on. Grace periods and post-expiry renewal fees follow each registrar's own policy, not numbers we set ourselves.

Payment is by QRIS through Mayar, self-service with no manual invoicing. For transactions above Rp10,000,000, for example a large ad top-up or a combined annual package with add-ons, contact us directly rather than using the site's automatic payment button.