Email and admin access
Who has admin rights, which logins are shared, and whether two-step sign-in is on for every account.
01 — Who it’s for
For anyone taking cards or sharing passwords
The Wi-Fi password is on the wall, three people share one admin login, and nobody is sure the backups actually work. You take card payments and keep customer details, and one phishing email could lock you out of everything.
The Security Check-up is a fixed-price review sized for businesses with 1 to 50 staff. Nothing is attacked or tested intrusively: it works from limited access and a short questionnaire, and ends with a report you can act on. It is not a penetration test, not a HIPAA risk assessment and not a certification.
02 — What you get
What the check-up reviews
Domain email records
SPF, DKIM and DMARC checked, so it is harder for others to send email pretending to be you.
Backups
Whether backups exist, where they are kept and whether they can actually be restored.
Devices and Wi-Fi
Updates, screen locks and Wi-Fi basics, checked by questionnaire.
Website certificate
Your site’s HTTPS certificate and its renewal checked.
Ranked top-10 fixes
A plain-English report with the ten fixes that matter most, in order, and how to do each one.
03 — Packages and prices
Packages, limits and turnaround
1 to 10 staff
Security Check-up
$595fixed
- Email accounts and admin access
- Two-step (multi-factor) sign-in
- Domain email records
- Backups
- Device and Wi-Fi basics, by questionnaire
- Website certificate
- Plain-English report with a ranked top-10 fix list
- Limits
- No intrusive testing; written authorization required
- Turnaround
- 5 business days
11 to 50 staff
Security Check-up
$895fixed
- The same review, sized for 11 to 50 staff
- Plain-English report with a ranked top-10 fix list
- Limits
- No intrusive testing; written authorization required
- Turnaround
- 5 business days
Quarterly
Re-check
$195/quarter
- Re-review against your last report
- Limits
- Same scope as the check-up
- Turnaround
- 5 business days
Add-on
Penetration test
Quotedin writing
- Authorized testing of systems you own
- Scope agreed and signed before anything is touched
- Limits
- Signed written authorization required
- Turnaround
- Agreed in the proposal
The check-up is not a penetration test, not a HIPAA risk assessment and not a certification. It finds and ranks problems; fixes can be quoted separately or handed to your IT provider. Open for Business bundle: Brand Kit, Website Starter and a Security Check-up (1 to 10 staff) for $4,250 fixed.
Prices in US dollars. Fixed packages under $1,000 are paid upfront; from $1,000 it is 50% to start and 50% on delivery. Monthly plans are billed in advance on the 1st, with 30 days’ notice to cancel and no long contract. Every limit is written into your proposal, unused allowance doesn’t roll over, and work beyond a limit is offered as an upgrade or quoted at $95 an hour in 30-minute blocks before it starts.
Founding terms, until 31 January 2027
The first five paying clients get 50% off the first month of one monthly plan, or 15% off one fixed package. After delivery you're asked for a short debrief and an optional case study that you approve before anything is published. The discount stands if you say no.
04 — How it works
From questionnaire to fix list
Brief
Tell us how many people work there, which email and file tools you use, and anything that worries you.
Propose
You get a written proposal with scope, price and roles, plus a written authorization to sign. Under $1,000, so it is paid upfront.
Make
You fill in a short questionnaire and grant limited access in your own accounts. Nothing intrusive is run.
Deliver
The plain-English report and ranked top-10 fix list within 5 business days. A quarterly Re-check is optional.
05 — Specialist roles
The line-up for this work
- Security ArchitectPlans the review and ranks the risks for your business.
- Senior SecOps EngineerChecks logins, admin access, two-step sign-in and email records.
- Secrets & Credential Hygiene EngineerFinds shared and reused passwords and sets out how to fix them.
- Data Privacy OfficerReviews how customer data is kept and who can see it.
- Compliance AuditorChecks findings against common small-business baselines, without certifying anything.
- Penetration TesterPen test add-on only: authorized testing, scoped in writing.
Your proposal names the roles for your actual brief, coordinated by an Engagement Lead, and the founder stays your single point of contact.
06 — Questions
Straight answers
Is this a penetration test?
No. The check-up runs no intrusive testing. A penetration test is a separate add-on, quoted in writing, and only run with your signed authorization.
Will this make us compliant or certified?
No. It is not a certification and not a HIPAA risk assessment. It shows where you are exposed and what to fix first. Certifications are issued only by accredited auditors.
What access do you need?
Limited, view-level access to your email and domain accounts where possible, granted in your own systems so passwords aren’t shared by email, plus the questionnaire. You sign a written authorization first.
Do you fix the problems too?
The report explains each fix in plain English. Larger fixes can be quoted separately, or handed to your IT provider.
We’ve already had an incident. Can you help?
Say so in your brief. Replies come within two business days, so for an active emergency contact your insurer, your bank and your providers first.