A one-person studio, run like an operation.

A containerized web app for tracking studio operations — KPIs, client metrics, and pipeline. Built it because spreadsheets stopped scaling. REST API for programmatic updates, JSON persistence on a mounted volume, CSV import and export, and a container healthcheck so it restarts itself when it stops answering.

Fig. 2 — State lives on a mounted volume rather than inside the container, so the image stays disposable and a rebuild never costs data.

A defensive account- and domain-security service covering the digital assets the studio manages. It is the closest thing in my own business to the email security and incident work I did in-house at a health insurer — same disciplines, smaller blast radius.

Access

MFA on every managed account, passkeys or security keys for admin logins — plus least-privilege role cleanup, removal of stale users, and replacing shared logins with individual access.

OAuth

Review and revocation of risky third-party app connections; verification of recovery contacts and backup codes.

Email auth

SPF, DKIM and DMARC audit and configuration — DMARC staged from p=none through quarantine to reject once legitimate senders are confirmed, so the domain cannot be spoofed.

Monitoring

Recurring breach-exposure checks and review of login and admin activity, summarized in a monthly written report.

Response

A documented account-takeover incident-response procedure, with hardening checklists and audit-report templates behind it.

Training

Phishing-recognition training for client staff — recognition material only; the service does not send live lures.

Tooling

Python utilities I wrote for the recurring checks — breach exposure and email-authentication verification.

The third time I have built one of these — after the employee lifecycle system at a health insurer and client onboarding at an MSP. A documented, repeatable seven-stage process every engagement runs through, so onboarding does not depend on me remembering it.

01 Profile

Master reference record for the engagement — kept current as the single source of truth.

02 Discovery

Prep checklist, call script, structured notes, and a written action plan — so discovery produces a decision, not just a conversation.

03 Build

Website project scope, milestones and delivery.

04 Brand

Brand assets, voice, and style reference.

05–07

Proposals, project media, and agreements — each stage with its own template so nothing is improvised per client.

A written audit methodology paired with an implementation training guide, so the deliverable is not just a report but the ability to act on it. Same instinct as the work-from-home training I built and delivered at a health insurer — the handoff matters more than the document.