The first two weeks follow the same pattern for every client. By the end, we know what you run, you know what we found, and both of us have a written plan.
Before we start
- A signed service agreement and data processing agreement (DPA).
- One named contact on your side who can approve changes, and a backup contact for holidays.
- A 45-minute kickoff call to walk through what you run, what has broken before and what worries you.
Access: least privilege, in your name
We never ask for shared administrator passwords. Instead, please:
- create an individual account for each Quiet Harbor engineer in your cloud console, hosting panel and code repository, with the narrowest role that lets us do the work;
- add our engineers’ SSH public keys — we send them through the file exchange and read the fingerprints out on a call;
- require multi-factor authentication on every account you create for us.
Never send passwords or private keys by email or chat. If a secret has to travel, use a one-time link from our file exchange or your password manager’s sharing feature.
Accounts stay in your name. If we stop working together, you remove our access and nothing else has to change.
Week 1: inventory and baseline
| When | What happens |
|---|---|
| Days 1–2 | Access checks. We confirm we can see everything we need — and change nothing yet. |
| Days 2–4 | Inventory: servers, domains, certificates, databases, backups, scheduled jobs, third-party services and who pays for each of them. |
| Days 4–5 | Baseline monitoring: uptime checks on public endpoints, resource agents on servers, certificate and domain expiry checks. Alerts go to us only at this stage. |
Week 2: risk map and plan
We rank everything we found by how likely it is to go wrong and how much it would hurt. The usual top findings are backups nobody has restored, a single server everything depends on, domains renewed on someone’s personal card, and secrets committed to a repository.
At the end of week two you receive:
- the inventory, as a document in your own repository;
- a risk map with the five most urgent items and why they are urgent;
- a written plan and a fixed price for the stabilise phase.
The assessment is yours to keep whether or not you continue with us.
What we need from you
- Primary and backup contact, with how to reach them in an emergency.
- Accounts for our engineers, as described above.
- A short list of what matters most to your customers — the pages or features that must not break.
- Preferred maintenance windows and any dates to avoid (launches, seasonal peaks).
- Any existing documentation, even if it is out of date. Old docs tell us what used to be true, which is useful too.