The security big companies are held to, sized for a small business.
If your business keeps client records, takes payments or has a login, attackers don’t care how big you are. We lock down your website, logins and email to the current OWASP and NIST standards, then hand you a plain-English summary of what’s in place, ready for your insurer, your IT advisor or the customer asking for a security questionnaire.
Every job gets a fixed price in writing before we start.
Businesses with something worth protecting.
Some of these come with rules you have to follow. We handle the technical side; your written policies and paperwork stay with you and your advisor.
Every layer, tested.
- Logins that a stolen password can’t openPasskeys (Face ID, Touch ID, Windows Hello) or an authenticator app as a second step. Passwords follow NIST’s 2025 rules: long instead of fussy, and checked against the hundreds of millions of passwords known from data breaches, without the password ever leaving your server.
- Sessions that end on their ownSign-ins time out after inactivity and after a set number of hours, and one button signs a lost phone out everywhere. Repeated wrong passwords pause that account, wherever they come from.
- A security log, with alertsEvery sign-in, failed try, password change and data export is logged for a year. You get an email when someone signs in from a new device, turns off two-step sign-in or keeps guessing passwords.
- A website that doesn’t leakHTTPS everywhere, strict security headers, private files blocked, bot checks on every form, and forms that can’t be used to send spam in your name.
- Email nobody can fakeSPF, DKIM and DMARC on your domain, so fake invoices sent “from” you get flagged or bounced.
- Backups and a written summaryNightly backups, secrets encrypted at rest, and a short report mapping what we set up to OWASP’s Top 10 and ASVS checklists: what’s covered and what’s still on you.
Tested on our own back office first.
Our CRM, ads dashboard and help center, where our clients’ details live, run on every layer above: passkeys, breached-password checks, session limits, a year-long security log and alerts. We built it, broke it on purpose, and fixed what we found before offering it to anyone else.
- Built to OWASP Top 10:2025 and ASVS 5.0, the current web application checklists
- Passwords per NIST SP 800-63B-4, finalized in 2025
- Card payments through Stripe’s hosted checkout, never on our servers
- A public security contact at /.well-known/security.txt, the internet standard for reporting problems
What we won’t tell you
That you can’t be hacked. Nobody honest can promise that. Our job is to make you a hard target, catch problems fast and keep good backups.
That you’re now “compliant.” HIPAA, PCI DSS and the Safeguards Rule cover your whole business, not just the website. We’re not auditors. We set up the technical safeguards and document them so your compliance advisor has what they need.
This page isn’t legal advice.
From first call to locked down.
- Free 20-minute callWhat you run, who signs in, what data you hold and any rules you answer to. We run the free checkup on your site too.
- A fixed quoteA written list of what we’ll set up, what it costs and how long it takes. No surprises later.
- We set it up and test itEvery layer is tested before it goes live, then we walk you and your team through passkeys and the log.
- Your security summaryA short written report of what’s in place. Add a care plan and we keep watching it every week.
Good to know.
What does it cost?
It depends on what you have: a brochure site with a contact form is a small job, a store or a client portal with staff logins is a bigger one. After the free call you get a fixed price in writing, and nothing starts until you approve it.
Does this make us HIPAA, PCI or FTC compliant?
No website project can do that on its own, because those rules cover your whole business: policies, training, vendors and paperwork. We cover the technical safeguards those rules ask about, like multi-factor sign-in, encryption, monitoring and backups, and document them for your advisor. This isn’t legal advice.
Do you work on WordPress, Shopify or Squarespace sites?
Yes. On hosted platforms we switch on the strongest options they offer, such as two-step sign-in for every account, email protection and tighter form settings, and we tell you plainly where the platform sets the limits. Sites we build ourselves get every layer on this page that applies to them.
What’s a passkey?
A way to sign in with your face, fingerprint or phone instead of typing a code. It only works on the real website, so a fake look-alike page can’t trick it out of you. iPhones, Macs, Windows and Android all support it, and it usually takes about a minute to set up.
Do we have to change our passwords every 90 days?
No. Current NIST guidance says forced regular changes make passwords weaker, because people just add a number. Use a long password, keep two-step sign-in on, and change it only if there’s a sign it leaked.
What happens after setup?
The log and alerts keep running on their own. If you’d like us to keep an eye on it, the care plan ($49/mo) adds a weekly security scan, updates, backups and a monthly report.
Report a security issue with our sites.
If you think you’ve found a security problem on syndicatemarketing.co, stusyn.com or any of our apps, email hello@stusyn.com with “Security report” in the subject. Tell us the page, what you found and how to see it. Please don’t access other people’s data or disrupt the sites while you look. We reply within one business day and fix confirmed problems as fast as we can.
Make your business a hard target.
Talk it through on a free 20-minute call, or check your current site first.