Founder-Led · Fixed Scope · It Finishes

Something landed, and there's a date on it.

A processor notice. A fee on your statement. A demand letter about your cookie banner. A failed scan with a deadline attached. Monitoring is the wrong answer to any of those — you need a person who has done this before, working to your date. Led by a certified security and PCI professional (CISSP · PCIP) with 30+ years and PCI Level 1 experience, for brands that cannot justify a security hire or a $15,000+ QSA engagement.

Talk to us

When something already landed

Bounded engagements

If you are holding a processor notice or a privacy demand letter with a deadline on it, monitoring is not what you need first. These are fixed-fee, founder-led, and finish.

PCI Validation Readiness Sprint

A processor notice, a non-compliance fee on your statement, or a failed scan. We take it from there to a submission you can defend.

Which SAQ actually applies to how your store is built
Portal navigation and scan coordination
Findings validated by a person, not a raw report
Evidence packaged the way an assessor expects

Tracking Evidence Sprint

A privacy or wiretapping demand letter, usually with a 20–30 day window. Your counsel needs to know what was actually running, and when.

Every tracker across storefront, cart and checkout, with timing
Whether your consent banner blocks tags or only signals
A timestamped technical record of what ran, and when
The configuration fixes, applied

We report what was running and when. We do not interpret the letter, assess the claim, or advise on how to respond — that is your lawyer's work, and we will refer you to one.

Tell us what landed

No clock on it? Start with a free check instead — see the plans.

Scoped Work

What we actually do

Priced as a fixed-bid statement of work, or as block hours when you want the work done rather than described. Every one of these ends with something you can hand to a developer, a bank, or a lawyer.

Payment Page Security Review

Hands-on assessment of your checkout page against PCI DSS 4.0.1 Requirements 6.4.3 and 11.6.1, the new script integrity and monitoring requirements that took effect March 2025.

PCI Scope & SAQ Classification

We map your card data environment, confirm the correct SAQ type, and scope down your compliance obligation as much as the standard allows. Most SMBs over-scope themselves unnecessarily.

Remediation Roadmap

A prioritised, actionable plan, not a generic checklist. Every finding comes with an explanation of the risk, a concrete fix, and an estimate of the effort involved.

Incident Readiness Review

We assess your ability to detect, contain, and report a card data incident. Covers logging, alerting, and your formal incident response plan against SAQ requirements.

Tracking & Consent Remediation

Which trackers fire before your banner is answered, whether your CMP actually blocks tags or only signals consent, and the configuration changes that stop it. Plus a timestamped record of what was running and when — the artifact your counsel needs and cannot produce themselves.

Policy & Documentation Review

PCI requires documented policies for a dozen-plus control areas. We review your existing documentation, flag gaps, and help you produce audit-ready policy language.

QSA Readiness Preparation

If you are approaching a formal QSA engagement or your bank has asked for a Qualified Security Assessor sign-off, we prepare your evidence package and brief your team.

Start an engagement

After the engagement

Keep watching after we leave

An engagement fixes what is wrong today. It does not stop the next app update, theme deploy or new pixel from putting it back. The platform watches for that — one product on your storefront, one on your payment page, each with a free tier. Harder to skim, easier to attest.

See the plans

Something landed, and there's a date on it.

Talk to us