The things owners actually say on the first call.

Yes, and not because you're big. Because you're easy. The software that scans the internet doesn't know what your shop does. It tries every domain, every login, every mail server, all day. If yours is open, it'll find it. You're not a target. You're a match.

The Exposure Report is $497 flat, refundable in full for 14 days, and credited toward anything you hire us for within 30 days. Everything after that is quoted as a fixed price, item by item, before any work starts. No hourly. No surprise invoices.

No. You can buy just the site, just the security work, or both. Most people end up doing both, because by then we already know your setup and it costs less than hiring two shops for the same job.

Usually yes. WordPress, Squarespace, Wix, Shopify or a custom build. We can secure a site somebody else built, rebuild it, or leave it alone and only do the security around it. The Exposure Report tells us — and you — which one makes sense.

Not without your written OK. The Exposure Report is read-only: we look at your business the way anybody on the internet can look at it — your public records, what your website returns to a visitor, your listings. Nothing on your side changes. Any active testing is a separate job with its own signed authorization naming exactly what and when.

Yes, and it's one of the first things we check. By default email doesn't verify who sent it. Unless your domain publishes records saying who's allowed to send on its behalf, a stranger can put your business name on a message asking your customer or your bookkeeper for a payment. Three records fix it — the technical name is DMARC, and it's usually an afternoon of work. To be straight about the limit: it stops someone using your exact domain. It doesn't stop a lookalike domain, and it doesn't stop mail sent from your own account after somebody steals the password.

Good. Keep him. He handles your machines and your network. We handle what's public: the site, the domain, the listings, the email settings and the accounts. Tell us who he is and we'll stay out of his lane, or bring him on the call. If it turns out you don't need us for the security half, we'll say so.

This is the most common thing we hear. You can usually get the domain back through the registrar with proof that the business owns it. Ask us on the call and we'll walk you through it whether or not you hire us. As for us: every account we set up is in your name, on your card, from day one. You shouldn't have to trust that we'll still be here.

Sí, de principio a fin. Sam es hispanohablante nativo. La llamada, el informe, el contrato, el entrenamiento del personal y el soporte pueden ser en español. Not a translated page, and not a nephew helping out. Vea el sitio en español.