Before we start.

The required form

Client Authorization: Remote Access, Session Recording and Confidentiality. Three pages, written in plain language. It covers:

• Exactly what we may touch. The systems you list, during the time window you set, for this engagement only. Nothing else.
• That the signer may grant it. The person signing confirms they have authority over those systems.
• Session recording. Every remote session is recorded, every command and its output, with timestamps. You get a copy and a unique session fingerprint at the end of each session. We keep our copy for three years, then delete it unless it is needed for a dispute.
• Mutual confidentiality. We keep your data, code, configurations and credentials confidential and use them only for the engagement. Anything we have to copy off your systems for the work is disclosed to you and deleted when the engagement ends, except the session record, kept as described above.
• No change without approval. We describe any change to configuration, software or data before making it, and make it only when you approve.
• Plain limits. Liability is capped at the fees for the engagement. Neither side is liable for indirect losses, except for breach of confidentiality or willful misconduct. No promise that a problem can be fixed (the diagnostic's own guarantee covers refunds). Your backups stay your responsibility. Pennsylvania law applies.

Read the sample form (PDF) →

This page is a summary; the signed form governs. The sample is for reading, and final wording may change. The copy you sign is sent to you once we agree to work together, with your details filled in, to sign electronically or to return signed by email. The form states that electronic signatures and records are valid (U.S. ESIGN Act; Pennsylvania UETA).

How it runs

• 1 · Fit check. You write; we tell you honestly whether it's a fit. No charge for finding out.
• 2 · Sign. We send the authorization. You sign it by e-signature or return a signed PDF by email.
• 3 · Pay. Invoice up front, per the engagement's terms.
• 4 · You open the door, only if the work needs it. Lab-only work, such as the diagnostic reproduced on our own cluster, never touches your systems. When access is needed, it runs over your VPN or a WireGuard/Tailscale tunnel you control, agreed with you in advance; we never ask you to expose SSH to the internet. You run a short script we give you, or provision the account your own way. The script creates a temporary, key-only account that expires on its own at the end of your window. You can end it at any moment with one command.
• 5 · Recorded session, then the report. You get the session recording, its fingerprint, and the written findings.

What the access script does, and doesn't do

It creates one temporary user that can only log in with our key. It sets an automatic removal timer that survives reboots, plus a backstop account expiry. It writes a local log on your machine, and it installs a revoke command you can run at any time. It makes no network connections of its own and opens no ports. Our key cannot forward ports or tunnel into the rest of your network unless you explicitly enable it when you run the script. Before you run it, we confirm our key's fingerprint with you on a video call or another channel you choose, so you know nobody swapped it in transit.