Approach
Evidence first, then decisions, then changes.
We agree the scope before requesting access, record the findings and decisions, and check the results before handover.
How an engagement runs
Conversation
We discuss your systems, the concern and what must keep working, then agree the next step in writing.
Scope and access
A one-page scope with deliverables, schedule and price. Access is read-only to begin with, granted to a named identity you can disable at any moment.
Review
We inventory what exists and test what can be tested without changing it. Every finding carries its evidence: a configuration, a log line, a screenshot, a reproduction.
Decisions
Findings become decisions you make, written down with the reason, the cost and the order. What you decide not to do is recorded too.
Implementation
Changes land in version control and are reviewed before production, each with a documented recovery step that is tested where feasible. Access is widened only for the task at hand and returned afterwards.
Verification and handover
We check that the change did what the decision said, record the result, and hand over documentation that someone else could operate from.
Operation
Under a retainer, the same log continues month by month: what was patched, what alerted, who gained or lost access, what it cost, what to change next.
How we handle access and changes
- Secrets never travel in chats, tickets or files.
- Credentials are kept in an approved secrets store and exposed only to the services that need them. Suspected exposure triggers the agreed incident and credential-replacement process.
- Read-only before read-write.
- We look before we touch. When a change is needed, the permission is scoped to that change and expires with it.
- Recovery planned before change.
- We document rollback or recovery steps and test them where feasible. Where a change cannot be reversed, we explain the risk and agree the recovery plan before proceeding.
- Plain language.
- Reports are written for the owner who signs, not only the engineer who operates, in English or Spanish as agreed.
- Review and verification.
- The scope identifies who reviews significant changes and what checks are required before handover.
What you keep
You keep the deliverables agreed in your scope: the inventory, findings, decision and change records, and operating instructions. Retainers also include the agreed periodic reviews. They are written so that another provider, an auditor or a buyer can pick them up without us.