Founder-Led · Fixed Scope · It Finishes

A notice arrived, and it has a deadline.

It might be a processor notice, a fee on your statement, a demand letter about your cookie banner, or a failed scan. Monitoring will not answer any of those. You need someone who has done this before, working to your date. A certified security and PCI professional (CISSP · PCIP) with 30+ years of experience, including PCI Level 1 programs, leads the work. It suits brands that cannot justify a security hire or a full QSA engagement.

Talk to us

When the deadline is already set

Fixed-scope engagements

If you are holding a processor notice or a privacy demand letter with a deadline on it, monitoring is not what you need first. Each engagement has a fixed fee, is led by the founder, and ends when the work is done.

PCI Validation Readiness Sprint

A processor notice, a non-compliance fee on your statement, or a failed scan. We help you prepare the evidence for your submission; you decide and attest.

Which SAQ actually applies to how your store is built
Portal navigation and scan coordination
Findings checked by a person
Evidence packaged the way an assessor expects

Tracking Evidence Sprint

A privacy or wiretapping demand letter, usually with a 20–30 day window. Your counsel needs to know what was actually running, and when.

Every tracker across storefront, cart and checkout, with timing
Whether your consent banner blocks tags or only signals
A timestamped technical record of what ran, and when
The configuration fixes, applied

We report what was running and when. We do not interpret the letter, assess the claim, or advise on how to respond. That is your lawyer's work, and we will refer you to one.

Tell us what arrived

No deadline? Start on the free plan instead: see the plans.

Scoped Work

What we do

We price each one as a fixed-bid statement of work, or as block hours. Each ends with something you can hand to a developer, a bank or a lawyer.

Payment Page Security Review

Hands-on review of the scripts on your checkout page: against PCI DSS 4.0.1 Requirements 6.4.3 and 11.6.1 where they apply to you, or, on SAQ A, against its script-attack eligibility confirmation.

PCI Scope & SAQ Classification

We map your card data environment, recommend the SAQ type that appears to fit, and show where your scope can shrink as far as the standard allows. The choice and the attestation stay yours. Many stores scope in more than they need to.

Remediation Roadmap

A plan in priority order. Each finding says what could go wrong, how to fix it, and how much work the fix takes.

Incident Readiness Review

We review how you would detect, contain and report a card data incident: your logging, your alerting and your incident response plan, against the SAQ requirements.

Tracking & Consent Remediation

Which trackers fire before your banner is answered, whether your CMP actually blocks tags or only signals consent, and the configuration changes that stop it. Plus a timestamped technical record of what was running and when, which your counsel can use.

Policy & Documentation Review

PCI requires documented policies for a dozen-plus control areas. We review your existing documentation, flag gaps, and help you write policy language that maps each requirement to the control you run.

QSA Readiness Preparation

If you are approaching a formal QSA engagement or your bank has asked for a Qualified Security Assessor sign-off, we prepare your evidence package and brief your team.

Start an engagement

After the engagement

Keep watching after we leave

An engagement works through what is wrong today. It does not stop the next app update, theme deploy or new pixel from putting it back. Store Health watches for that, with a free plan. When we finish, we run a check. From then on, each weekly check compares your pages with the one before it and ranks what changed.

See the plans

A notice arrived, and it has a deadline.

Talk to us

Keep watching after we leave

See the plans