The rules I work by.

What I check

The public surface: pages anyone can open, the technical hints they expose (security headers, certificates, publicly reachable files), public DNS records (SPF, DKIM, DMARC, MX, DNSSEC, CAA, MTA-STS), and public login or booking pages viewed the way a visitor would view them — without logging in.

What I never access

• Passwords, login sessions, staff accounts, or admin panels
• Patient, client, or payment data — including anything behind a login
• Email mailboxes or message contents
• Anything requiring an active attack: no exploitation, no fuzzing, no denial-of-service, no credential guessing

How consent works

1. We talk first. That conversation is free and obligates you to nothing.
2. If you're interested, I send a short scope message by text or email. It names your exact domain, the date window, and what will and won't be checked.
3. Only after you reply with an explicit yes does any check run. A delay or “maybe” means no check until it's a clear yes.
4. Every fix is quoted and approved in writing before anything is changed on your site or DNS.

If a web agency manages your site, I either get their authorization for the affected checks, or I keep the review to public information only. Your call.

How your data is handled

• Reports contain your domain and technical findings only — no patient or client data is ever collected, because none is ever accessed.
• Reports and scan results are stored locally, kept confidential, and only shared with you or, with your OK, your web person or agency.
• I ask before naming any business in a case study or testimonial, and I never publish a client's findings without written permission.
• You can ask me to delete your report and working notes at any time.

What the review is — and isn't

A safety review is a non-invasive assessment. It is not a penetration test, not a compliance certification (PIPEDA/PHIPA or otherwise), and not a guarantee that your site is secure. Findings are best-effort, based on what is visible from the public side, and may include false positives. Anything I can't confirm is labelled Needs validation rather than presented as fact.

Contact

Questions about any of this? Call or text 905-616-5021. Ask for the scope message in advance if you'd like to see exactly what a consent looks like before we ever meet.