You are about to hand someone the keys to your business online
That is a real thing to ask, and most companies gloss over it. Here is exactly what we hold, who decided it, and what happens if it ever goes wrong.
Paul spent thirteen years finding out how businesses got taken
Twenty years in the Army. Thirteen more at the Department of Defense as a cyber crime investigator — digital forensics and threat intelligence. GIAC, CEH and CompTIA certified.
His actual job was working out how it happened, after it happened. Not theory. Not a certification he sat for a weekend. Thirty-three years of the real thing, most of it on cases where the stakes were considerably higher than a booking calendar.
So when he says this is the smallest access that still does the work, that is someone who spent a decade cleaning up after the alternative. He designed our access model before we took a single client, and he reviews every tool we build before it touches your data.
People with his background do not usually end up at three-person companies. We know exactly how unusual it is that he is here, and we built the whole business around it rather than mentioning him in a footer.
| We read this, to measure | We change this, to fix |
|---|---|
| Google Search Console | Your robots.txt |
| Google Analytics | Your structured data |
| Google Business Profile | Your Business Profile fields |
| Your server or CDN logs | That is the complete list |
We never touch your content, your design, your pricing or your SEO strategy. If you have an SEO person, we tell them what to change rather than doing it ourselves.
Never in an email, never in a spreadsheet, never in anyone's notes. Every access is logged, and you can revoke all of it in about a minute without telling us first.
Each account gets the narrowest role that still does the job. Nobody here has admin on anything they do not need it for.
Anyone who leaves loses access the same day, not that week. Every account is in the company name, never a personal one.
From day one, before our first client.
Most companies our size carry general liability only. It covers someone tripping over a cable in an office we do not have. It does not cover a breach of credentials we are holding for you — which is the only risk that actually exists here.
Two of them. What we do if we are breached, and what we do if you are.
Who is told, in what order, how fast, and what gets shut off first. Written by someone who spent thirteen years watching other people improvise it badly.
Ask any company you are considering these two questions: do you carry cyber liability, and can I see your incident response plan? Most will not have an answer to either.
The honest version of why this matters.
A marketing company holding your Google credentials is a soft target — small, trusted by dozens of businesses, and usually thinking about marketing rather than security. That is exactly the shape of thing Paul spent his career investigating. It is the reason he is a founder here rather than a consultant we call when something breaks.