How We Handle Client Access

The short version

Cleaning a hacked site or reviewing a server's configuration needs real access, so we treat that access as something you lend us for a defined job, not something we keep. Nothing is accessed before the scope is agreed in writing, every account we use is ours alone and time-limited, every session is logged, and you remove the access when the work is done.

Before we touch anything

• A signed scope of work lists the exact systems we're allowed to access, what we'll do there, and who on your side approves changes.
• An external audit needs no access at all. We only ask for hosting, SFTP or database access when the work requires it, and we say why.
• We connect from a fixed, dedicated IP address. We send it to your named approver so you can allow only that address, and we start once you confirm in writing.
• We ask you to create an individual account for us with the minimum role the job needs, and multi-factor authentication where your systems support it. We don't use shared admin logins or your staff's accounts.

While we work

• We record every working session: start and end time, the account and IP address used, the system, the purpose, and the material changes made.
• We only connect from the agreed IP address and from managed devices. If our address has to change, we stop and wait for you to approve the new one.
• On a hacked site, we preserve the existing logs before cleaning, so the evidence of how the attacker got in isn't destroyed by the fix.
• Credentials you share with us are kept in an encrypted password manager, never in email threads or documents.

When the work is done

• We ask you to disable or delete our account and remove our IP address from your allowlist, and we check with you that it's done.
• We revoke our own credentials and delete the secrets you shared with us, as set out in our agreement.
• You receive a report of what was found and changed. Relevant session records are kept for the retention period in our agreement, so either side can check later what happened and when.

Questions to ask any security provider

Whether you work with us or someone else, ask before you hand over access: Who exactly will log in, and from where? What will they change, and who approves it? How are my passwords stored? How do I take the access back afterwards, and how will I know it's gone? A provider who can't answer these clearly shouldn't have your admin password.

Verify who we are

West Oakbridge is operated by CDKenda, LLC, a US company in Albuquerque, New Mexico. Our registered office is listed in our privacy policy, and you can reach us at contact@westoakbridge.co or through our LinkedIn company page. Security reports about our own systems go through our vulnerability disclosure policy and /.well-known/security.txt. If you need anything else to complete your vendor checks before granting access, ask us and we'll provide it.