How I work

How an engagement works

Whether it is private email for a household or a platform for a business, every engagement follows the same shape. The aim is simple: you always know what you have, who can reach it, and what happens next.

01An introduction

Most work begins with a referral. The first step is a conversation, by phone or in person, to understand what you have in place and what you would like it to look like. There is no obligation and no charge for it.

02A careful look at what's there

Before changing anything, I map the current picture: domain registrations, where your email and website actually live, who holds each account, and who is paying for what. Inherited arrangements often turn up forgotten accounts, renewals about to lapse, or access held by people who have long since moved on.

You receive a plain-English summary of what I found, with anything urgent flagged first.

03A written proposal

I then set out what I recommend in writing: the scope, the approach, a clear monthly fee, and what each of us is responsible for. Nothing begins until you have agreed it.

04Your own infrastructure

Each client is set up on their own dedicated server, under its own account, hosted in the UK. Your systems are never shared with anyone else's, so a problem elsewhere cannot reach you. Domain registrations remain in your name.

05How access is handled

• The least access necessary. I hold administrative access to the infrastructure. Your own passwords are yours.
• Strong authentication on every account I manage, and administrative actions are logged.
• No reading of your correspondence. If a problem ever means I need to look at something of yours, I tell you first and explain afterwards exactly what I did.
• Nothing discussed elsewhere. I don't name clients or describe their arrangements to anyone.

06Ongoing care

Once things are running, I keep them that way: security updates applied promptly, monitoring for intrusion and failure, encrypted backups held separately from the server they protect, and renewals tracked so nothing lapses unnoticed.

07Documented to be handed on

Everything is written down: what exists, where it lives, and how to reach it. Emergency access arrangements are lodged with someone you nominate. If you move to another provider, or something happens to me, the handover is straightforward rather than a forensic exercise.

It is the same principle behind busfactor, which I released as open source.

08If something goes wrong

I respond quickly, contain the problem, find out exactly what happened, and tell you plainly, including what has changed so it doesn't happen again. Some of that work is written up, anonymised, in my security research.

09Ending an engagement

There is no lock-in. If you decide to move on, I hand over everything: accounts, credentials, documentation and data. Once you have confirmed the handover is complete, your data is securely deleted from anything I control.

If you have been referred, or think this might suit you, get in touch and I will reply personally, usually within a working day.