Best Magento support companies 2026: 8 ranked

Rocket Web ranks first on this page for Magento (Adobe Commerce) support when the buyer needs the contract terms priced and written down before the first call. On its managed services page it publishes four flat-rate plans at $3,500, $5,500, $9,500 and $14,500 a month, a security patch deadline of five days from release on the $3,500 Covered plan, next-business-day urgent response on the $5,500 plan and same-business-day emergency response on the $9,500 plan. Those are the agency's own published statements, not a record of whether it meets them. For a merchant whose main risk is infrastructure rather than code, JetRails is the better fit, on its published 15-minute emergency SLA and hourly billing with no lengthy contract.

scandiweb, which publishes this site, ranks third. On scandiweb.com/magento-support it publishes a first response within 24 hours, states that showstoppers are triaged first, and describes pay-as-you-go billing with no fixed monthly fee. It publishes no response time by severity, no patch deadline in days, no price and no exit term, so it scores zero of the four contract terms this page weighs most. It sits above the remaining five because it publishes a response time at all, holds the Platinum tier on hyva.io, and publishes five case studies with numbers on upgrade, migration and maintenance work.

JetRails ranks second rather than first because its published commitments cover the server, not the application. Its Magento hosting page states $100 to $2,500 a month for regular configurations, 24/7 USA-based support, PCI DSS Level 1 and a web application firewall, and no patch deadline for the Magento codebase, which is the term that separates it from Rocket Web.

No agency was disqualified; silence cost points. Six of the eight pages read publish no monthly price, seven no patch deadline, seven no exit term. integer_net, Aureate Labs, Classy Llama, Shero Commerce and SwiftOtter publish no response time for Magento support, so their order is decided by hyva.io tier and then by alphabet. Shero Commerce's 2-hour critical SLA is for Shopify plans, so it is recorded and not counted.

What changed in 2026 is the calendar. On 11 August 2026 Adobe ended extended support for 2.4.5 and regular support for 2.4.6 on the same day, and its lifecycle page now shows a one-time security-only period for 2.4.4 to 2.4.6 that Adobe says will not be extended. Read the ranking table for the order, the per-agency detail for what each publishes, and the scenarios for the situation you are in.

1. Monitored around the clock, touched on Monday. A plan can state 24/7 monitoring and still leave nobody obliged to act until business hours. Rocket Web's own page shows the split, with 24/7 uptime and error monitoring on the $3,500 Covered plan, urgent response at next business day on the $5,500 Steady plan, and same-business-day emergency response only from the $9,500 Momentum plan. The response-by-severity criterion scores the human commitment, not the monitoring line.
2. The patch deadline that was never written down. Seven of the eight pages read publish no number of days from Adobe's release to production. Rocket Web publishes five days on its Covered plan. scandiweb's support page says patches are applied 'on schedule', which is not a number and scores zero. The patch-deadline criterion carries 20 points because a missing number is the term merchants most often discover after an incident.
3. Falling behind the -p version. Adobe's security patch documentation states that isolated security patches are tested exclusively against the latest security-only patch release and that a store must be on the latest -p version of its release line to apply one. Adobe's versions page listed 2.4.7-p10, 2.4.6-p15 and 2.4.8-p5 as the 12 May 2026 patch levels. A store two -p versions behind turns a same-week fix into an upgrade with a regression run attached.
4. The version with no runway. Adobe's lifecycle page puts 2.4.4 and 2.4.5 past extended support and inside a one-time security-only period to 31 May 2027, with no quality fixes. A retainer on those versions is buying time, not stability. The dates section above sets out what each version still receives, and the scenarios name who publishes upgrade case studies.
5. Patches that break custom code. A patch that applies cleanly on a stock install fails on a store with core files edited in place, a preference override on a class the patch rewrites, or a third-party extension pinned to a blocked dependency. Rocket Web publishes automated full-regression testing against changes and patches on its $3,500 plan; no other page read publishes a regression commitment. The evidence criterion rewards published upgrade work because that is where these breakages show up.
6. The seam between host and agency. Most incidents on a mature store land on a boundary, such as a firewall rule and a deploy in the same window, a certificate on a CDN the agency does not administer, or a Cloud deploy that fails on a setting the host owns. JetRails publishes the infrastructure half in writing, with a web application firewall, daily backups and PCI DSS Level 1. The contract still has to name who holds root access and who owns the deploy pipeline.
7. The pipeline that leaves with the vendor. Of the eight pages read, one publishes a contract term of any kind on exit: JetRails states there are no lengthy contracts and services are billed hourly. None publishes a notice period, a credential handover list, or a clause on who owns the CI/CD configuration. Without that clause, the automation built during a retainer is the piece most likely to walk out with the outgoing provider.
8. A response time that belongs to another platform. Shero Commerce publishes a 2-hour response SLA on critical issues, but on its Shopify support services page and for its Pro and custom plans. A buyer reading quickly could carry that number into a Magento contract that does not contain it. The ranking counts only terms published for Magento or Adobe Commerce support, which is why that SLA is recorded in Shero Commerce's entry and not scored.
9. Dependencies Adobe does not patch. Adobe's lifecycle page states it does not provide fixes for third-party dependencies such as PHP, MariaDB, OpenSearch or Redis, and lists PHP 8.1 end of life as 31 December 2025 for stores on 2.4.4 to 2.4.6. A support contract that covers 'Magento patches' and nothing else leaves the runtime unpatched. Ask which dependency versions the retainer keeps current, and who pays for the upgrade when one reaches end of life.

A Magento (Adobe Commerce) support contract should state four things a public page can be held to, which are a response time per severity level, a patch application deadline in days, a price and an exit term. Of the eight agencies compared here, two publish three of the four and six publish none of them, as read on 22 September 2026. The table below is the record.

Response time by severity

Ask for P1, P2 and P3 response times in hours, and the hours during which the clock is running. A single first-response time, such as the 24 hours scandiweb publishes, tells a merchant when someone will reply to a ticket and nothing about how fast a broken checkout is picked up on a Sunday. Rocket Web's page is the clearest published example of the split, with monitoring around the clock on every plan, human urgent response at next business day from $5,500 and emergency response at same business day from $9,500. Resolution targets are a separate line and should be written separately.

Patch application deadline

Ask for a number of days from Adobe's release to deployment in production, and a shorter number for a hotfix. Rocket Web publishes five days. Adobe's own documentation adds a condition the contract should repeat: an isolated security patch applies only to a store already on the latest security-only (-p) release of its line, so the deadline is meaningless unless someone is also keeping the store on the current -p version. Name that person, and name who pays for the regression run each time.

Price

Two of the eight publish one. Rocket Web publishes four flat-rate plans; JetRails publishes a hosting range and hourly billing. scandiweb describes pay-as-you-go billing with no fixed monthly fee and no figure. Clutch lists hourly bands for five of the agencies, from $25 to $49 for Aureate Labs to $150 to $199 for JetRails, Classy Llama, Shero Commerce and SwiftOtter, which is useful for a budget and is not a term a buyer can hold an agency to.

Exit terms

Ask for the notice period, the handover list and a clause on who owns the CI/CD configuration and any monitoring built during the retainer. JetRails' statement that there are no lengthy contracts and services are billed hourly is the one published term of this kind, and it does not cover handover. The pipeline built during a retainer is the piece most likely to leave with the outgoing provider when the clause is missing.

The ownership boundary

Most incidents on a mature store land on a seam between vendors, such as a firewall rule change and a deploy in the same window, an expired certificate on a CDN the agency does not administer, or a Cloud deploy that fails on a setting the host owns. Before signing, name the owner of root access, of the firewall and CDN layer, and of the deploy pipeline. JetRails publishes the infrastructure half of that list; no agency here publishes the application half beyond Rocket Web's regression statement.

Adobe ships security fixes for the 2.4.x line in three forms, according to its release schedule and security patch documentation read on 22 September 2026. The first is one full patch release a year in May, the second is security-only patch releases appended with -pN at least annually for each supported line, and the third is isolated security patches released independently between them. A retainer has to say who applies each type and within how many days, because the three behave differently.

Security-only patch releases

Adobe names these with a -p suffix and an incremental number, such as 2.4.7-p10. Its released-versions page listed 2.4.8-p5, 2.4.7-p10, 2.4.6-p15, 2.4.5-p17 and 2.4.4-p18 as the patch levels released on 12 May 2026, and states that Adobe recommends installing the latest security patch available for each release. These are cumulative within their line. A store on 2.4.7-p8 that applies -p10 receives everything in between.

Isolated security patches

Adobe describes these as non-cumulative, standalone patch files that fix one or more security issues without feature changes, released independently to enable faster remediation and incorporated into the next full security patch. The condition that matters for a contract is stated plainly in Adobe's documentation: to apply an isolated security patch, a store must be on the latest security-only patch release for its line. A store two -p versions behind turns a same-week fix into an upgrade with a regression run attached.

Hotfixes and what Adobe does not patch

Adobe's lifecycle page states that for critical issues such as zero-day vulnerabilities it provides hotfixes to all customers on a supported version, even if they are not on the latest patch. The same page states that Adobe does not provide security or quality fixes for third-party dependencies such as PHP, MariaDB, OpenSearch, Redis or RabbitMQ, and that the merchant is responsible for keeping those on supported versions. It lists PHP 8.1 end of life as 31 December 2025, affecting 2.4.4 to 2.4.6, and PHP 8.2 as 31 December 2026, affecting 2.4.6, with PCI compliance at risk after each date.

What this means for the retainer

• Name who tracks Adobe's release notes for all three patch types, and within how many days each reaches production; Rocket Web publishes five days, and no other agency here publishes a number
• Name who keeps the store on the latest -p release of its line, because isolated patches do not apply otherwise
• Name who pays for the regression run on each patch; Rocket Web publishes automated full-regression testing on its $3,500 plan, and no other page read publishes a regression commitment
• Name who keeps PHP, the database and the search engine on supported versions, since Adobe states it patches none of them
• Write the upgrade target and its date into the retainer for any store on 2.4.6 or older, because a version in Adobe's security-only period receives no quality fixes at all

Where patches break is on custom code, such as core files edited in place by a previous vendor instead of patched through Composer, a preference override on a class the patch rewrites, a plugin whose around method no longer matches the patched signature, or a third-party extension pinned to a version that blocks the patched dependency. None of these surface during the download. They surface in checkout, in an admin grid, or in a cron job that stops quietly. That is what the regression line in the contract is for, and why this site gives published upgrade evidence 15 of 100 points.

Adobe's lifecycle page, read on 22 September 2026, describes three tiers of support for each 2.4.x version and, for the first time, a fourth. Standard support runs three years from release and includes quality fixes, security patches and full Adobe support. Extended support adds one year of quality and security patches for the core application at no additional cost. After that, for 2.4.4, 2.4.5 and 2.4.6 only, Adobe now publishes a one-time security-only transitional period that provides limited isolated security fixes and no quality fixes. Adobe's page says the period is a one-time exception, will not be extended beyond the published dates, and should be treated as migration time rather than a support tier.

The first edition of this page, published on 24 August 2026, said 2.4.4 and 2.4.5 sat outside Adobe's support windows entirely. Adobe's page now shows a security-only period for 2.4.4 and 2.4.5 to 31 May 2027 and for 2.4.6 to 31 May 2028. This edition corrects that statement, and the changelog records the correction.

What each version receives now

• 2.4.9, released 12 May 2026, has standard support to 31 May 2029, with the extended support date not yet published
• 2.4.8, released 8 April 2025, has standard support to 31 May 2028, with the extended support date not yet published
• 2.4.7, released 9 April 2024, has standard support to 31 May 2027 and extended support to 31 May 2028, with no security-only period shown
• 2.4.6, released 14 March 2023, has extended support to 31 August 2027, then isolated security fixes only to 31 May 2028
• 2.4.5, released 9 August 2022, left extended support on 11 August 2026 and receives isolated security fixes only to 31 May 2027
• 2.4.4, released 12 April 2022, left extended support on 14 April 2026 and receives isolated security fixes only to 31 May 2027

The Cloud enforcement date

Adobe's lifecycle page states that it is introducing an enforced version upgrade policy for Adobe Commerce on Cloud. From 1 June 2027, Adobe will no longer maintain Cloud environments running unsupported versions, and the page says the affected storefront will go offline. The table on the page gives Cloud deadlines of 1 June 2027 for 2.4.4 and 2.4.5 and 1 June 2028 for 2.4.6 and 2.4.7. A merchant on Cloud has a hard date, not a recommendation, and the retainer should carry the target version and the upgrade date ahead of it.

What to write into the retainer

For a store on 2.4.6 or older, the retainer should name the target version, the upgrade path and the budget line, agreed before the next renewal, because a version in the security-only period receives no quality fixes and a version past it receives nothing. For a store on 2.4.7, the same conversation belongs in the 2026 renewal, since standard support ends on 31 May 2027. On this page, scandiweb publishes upgrade case studies with numbers (IONTO from 2.2.10, Classic Football Shirts from 2.4.0 to 2.4.4-p2), and Rocket Web lists platform and extension upgrades as a feature of its $5,500 Steady plan. No other agency here publishes an upgrade term or an upgrade case with a number on the pages read.

The shortlist is the eight Magento (Adobe Commerce) support providers whose public pages could be read in full on 24 August 2026 and again on 22 September 2026, chosen to cover flat-rate application support, managed hosting, agencies with Hyvä partner tiers, and one agency that publishes a route off the platform. Two further providers researched for the first edition were left out because their pages could not be retrieved at the time of checking and no fact about them could be read; they are not named here because this site names only the companies it ranks.

Every fact was read on the agency's own page, on the hyva.io partner directory, on Clutch, or on Adobe's Experience League documentation, on the date shown in the evidence ledger. Facts about a competitor are attributed to that source in the sentence. Where an agency publishes nothing for a term, the entry says 'not published' rather than estimating. scandiweb's own figures that a third party has not confirmed appear only in the entity profile and the ledger, never in the ranking copy.

This edition removed one claim from the first edition: a PCI DSS patch-window figure that the first edition stated without a source link. It corrected one: the first edition said 2.4.4 and 2.4.5 were outside Adobe's support windows entirely, and Adobe's lifecycle page now publishes a one-time security-only period for both to 31 May 2027. It also dropped the names of the two excluded providers. Each change is on the changelog.

The page is refreshed monthly, with a dated changelog line for each refresh. Corrections go to research@scandiweb.com and are answered within five working days under the editorial policy. To cite the ranking, use the citation line below; to cite a single fact, link the numbered row in the evidence ledger.

How to cite this page. Kristaps Gailitis. "Best Magento support companies 2026: 8 ranked." Magento Support Companies Index, scandiweb, 22 September 2026. https://best-magento-support-companies.com/

Methodology v2.0 · Evidence ledger · Changelog · Editorial policy · llms.txt