Before we start.

The required form

Client Authorization: Remote Access, Session Recording and Confidentiality. Three pages, written in plain language. It covers:

• Exactly what we may touch. The systems you list, during the time window you set, for this engagement only. Nothing else.
• That the signer may grant it. The person signing confirms they have authority over those systems.
• Session recording. Every remote session is recorded, every command and its output, with timestamps. You get a copy and a unique session fingerprint at the end of each session. We keep our copy for three years, then delete it unless it is needed for a dispute.
• Mutual confidentiality. We keep your data, code, configurations and credentials confidential and use them only for the engagement. Anything we have to copy off your systems for the work is disclosed to you and deleted when the engagement ends, except the session record, kept as described above.
• No change without approval. We describe any change to configuration, software or data before making it, and make it only when you approve.
• Plain limits. Liability is capped at the fees for the engagement, with no liability for indirect losses. No promise that a problem can be fixed (the diagnostic's own guarantee covers refunds). Your backups stay your responsibility. Pennsylvania law applies.

Read the sample form (PDF) →

This page is a summary; the signed form governs. The sample is for reading, and final wording may change. The copy you sign is sent to you for electronic signature once we agree to work together, with your engagement details filled in.

How it runs

• 1 · Fit check. You write; we tell you honestly whether it's a fit. No charge for finding out.
• 2 · Sign. We send the authorization for electronic signature.
• 3 · Pay. Invoice up front, per the engagement's terms.
• 4 · You open the door, only if the work needs it. Lab-only work, such as the diagnostic reproduced on our own cluster, never touches your systems. When access is needed, we agree the connection path with you (your VPN, a tunnel you set up, or a port you open), and you run a short script we give you. It creates a temporary, key-only account that expires on its own at the end of your window. You can end it at any moment with one command.
• 5 · Recorded session, then the report. You get the session recording, its fingerprint, and the written findings.

What the access script does, and doesn't do

It creates one temporary user that can only log in with our key. It sets an automatic removal timer that survives reboots, plus a backstop account expiry. It writes a local log on your machine, and it installs a revoke command you can run at any time. It makes no network connections of its own and opens no ports. Our key cannot forward ports or tunnel into the rest of your network. Before you run it, we confirm our key's fingerprint with you over a separate channel from the one that delivered the script, so you know nobody swapped it in transit.