What we do
The whole list, in plain English.
You can hire us for one side or both. Most people end up doing both, because by then we already know your setup and it costs less than hiring two shops for the same job.
Getting found.
Your website
- Built to load fast on a phone with two bars
- Readable for a customer with bad eyes or a keyboard instead of a mouse — that's the WCAG 2.2 AA standard, and it's also what stops accessibility lawsuits
- Works whether somebody else built the old one or we start clean
- You own the domain, the host and every account, from day one
Google and the map
- Your Google Business Profile claimed, filled in, and defended
- Hours, service area, photos, and the categories that decide whether you show up when somebody nearby searches
- Apple Maps and Bing too — they're free and most shops skip them
- Honest review requests. We will never write one for you, and nobody legitimate will
Photo and video
- Victor comes to your shop and shoots the real thing
- Your space, your staff, the work as it actually looks
- Not a stock library three of your competitors already used
The words and the look
- What your homepage says in the first eight seconds
- Logo, colour and type that hold up on a sign, a truck and a screen
- Written in English, Spanish, or both
Staying yours.
Email nobody can fake
- By default, email doesn't check who really sent it. That's how a stranger sends your customer an invoice with your name on it.
- Three records on your domain fix it. The technical name is DMARC; it's usually an afternoon of work.
- Straight about the limit: this stops someone using your exact domain. It doesn't stop a lookalike domain, and it doesn't stop mail sent from your own account after someone steals the password.
A second step on every login
- Email, banking, payroll, the point of sale, the website, the domain registrar
- Rolled out for your whole staff, not just you
- Recovery codes written down somewhere that isn't a sticky note on the monitor
Backups we've actually opened
- Set up off your host and versioned
- Then we restore one in front of you and time it
- A backup nobody has ever restored is a rumour, not a backup
The rest of the block
- Patching your site and cutting the admin accounts nobody uses
- Locking the registrar so the domain can't be moved out from under you
- Phishing training your staff won't hate — one hour, real examples from your industry, English or Spanish, no fake shame emails
- A one-page plan for the day something goes wrong: who to call, in what order, and where the numbers live when your email is down
- A list of every outside app connected to your business and what each one can see
What we won't tell you.
We won't promise you a spot on page one of Google, a revenue number, or that you'll never get hit. Nobody can make a business unhackable, and anyone who says otherwise is selling something.
We're not a 24-hour operation. We're two people. If you need somebody watching a screen at 3 a.m., we'll tell you that up front and help you find them.
We work from published guidance rather than a checklist we invented — the CIS Controls for the security side, WCAG 2.2 for the accessibility side. Those are standards we work to, not certifications we hold. Nobody certifies anyone for this, whatever a vendor tells you.