External Vulnerability Scan
Internet-facing systems only. We identify exposed services, known vulnerabilities, and misconfigurations visible from the outside. Ranked findings with a short written report and clear fix order.
- Good for a first look, insurance questionnaires, or confirming exposure
- Requires written authorization before any scanning begins
- No exploitation, no internal testing, no social engineering
- Deliverable: ranked findings, severity, and recommended fix order
Security Hygiene Audit
Review of MFA, email security, backups, admin access, and basic policy gaps. You receive a written gap list suitable for insurers or customer security forms.
- Scoped and authorized
- Not a penetration test or SOC 2 attestation
- Practical recommendations you can act on
Static App Testing
Authorized review of mobile application code, packages, and configurations without running the app. We look for common issues in Android and iOS builds, hard-coded secrets, insecure configurations, and other static findings. Ranked with clear remediation guidance.
- Requires written authorization and access to source, packages, or builds as agreed
- Static analysis only — we do not run or dynamically test the app
- Deliverable includes prioritized findings and practical fixes
Data Removal
We search people-search and data-broker sites for your personal information, prepare the removal requests, and submit them only after you approve. Optional follow-up monitoring for new listings is available.
- You review the full pack before anything is sent
- Optional monitoring available
Ongoing Hygiene Retainer
Scheduled external checks against authorized domains. Findings are delivered to you. You are alerted if something material changes between runs. Monthly or quarterly options.
- Written authorization required
- Clear reporting cadence
Remediation Review
You apply the fixes. We re-scan or re-check and confirm what is closed and what remains open. Available only after a prior scan or audit with us. Short closed/still-open note delivered to you.
Email Authentication & DNS Setup
SPF, DKIM, and DMARC set up correctly for your domain, then a guided move to DMARC enforcement so others can’t easily send mail that looks like it came from you.
- SPF/DKIM/DMARC setup, per domain
- Guided DMARC enforcement rollout (p=none → quarantine → reject) over 30–90 days
- Optional monthly DMARC monitoring and report
- You keep ownership of your accounts; we use delegated access, never shared passwords
- Backup and rollback plan before every change; nothing changes without a signed authorization
Secure Website Building & Migration
Small, fast websites built with security in mind, or a rebuild/migration off a hosted site builder. Our own site is the first case study: we moved it off Squarespace to a static site on Netlify.
- HTTPS and security headers set from day one
- Privacy-friendly analytics; no advertising pixels on clinic or dental sites
- Accessibility work targeting WCAG 2.2 AA (a target, not a guarantee of legal compliance)
- You own the code and content once the project is paid in full
Pricing
Projects typically start at $349, plus applicable Washington sales tax. Every engagement is quoted after a short scoping call. Projects under $1,000 are paid in full before work starts; $1,000 and up take a 50% deposit to schedule, with the balance due on delivery. Monthly plans are billed in advance and can be canceled with 30 days’ notice.