Security

Least privilege, requested per engagement

I ask for the minimum access the scoped work needs, in writing, so there’s a record of what was granted and why. If the scope grows, I ask again rather than stretching access I already have.

Credentials live in a password manager

Every credential you give me goes into a password manager and nowhere else. I don’t keep credentials in chat, email, notes, or AI tools, and I’ll ask you not to send them that way either. If you don’t already have a secure way to share them, I’ll suggest one.

Separate accounts, per client

Wherever your systems allow it, I work from an account you own, created for me, and specific to your organization, so you can see what I did and shut it off without touching anything else. I don’t share accounts between clients.

Multi-factor authentication on everything

Every account involved in your work has multi-factor authentication turned on, including my own email, password manager, and code hosting accounts.

Your code stays in your repositories

I work in your repositories and your cloud accounts, under your ownership. I don’t mirror your code into repositories I control. Local working copies live on an encrypted machine and are deleted when the engagement ends.

Access ends when the engagement ends

At the end of an engagement I send you a written handoff listing every system I had access to, so you can revoke all of it, and I confirm once I’ve removed anything on my side. You can revoke access at any point before that, and I’d rather you err on the side of doing so.

If something goes wrong, you hear it from me first

If I ever believe a credential or client data has been exposed, I tell you the same day I learn of it, with what I know and what I’ve done about it.

Questions, or a vendor security questionnaire you need filled out: john@mainphaseconsulting.com.