Onboarding

Tell me about the store.

21 short questions, about 10 minutes. I read the answers before the kick-off call, so the call goes to the decisions instead of the basics.

No passwords or keys here. Access is set up after the kick-off call: invitations to a named account wherever possible, anything secret only as a 1Password share link or a one-time link. The security page lists exactly what is needed per platform.

The store Work email * Taken from your payment, so the answers land on the right file. Store URL * Platform * Version and theme Whatever you know; I confirm it in the code. Orders a month Sets how carefully releases are staged and when deploys can happen. Markets, languages and currencies

Code and hosting

Read-only access is enough for the audit. Nothing is accessed before the signed NDA and DPA.

Where the code lives * No repository? A zip of the code without .env files works for the audit. Hosting and deployment * e.g. Adobe Commerce Cloud, Hypernode, Cloudways, Kinsta, own server at Hetzner. Is there a staging environment? * Who holds the access today * If an agency or freelancer still runs the store, I will suggest how to word the hand-over. Previous or current agency or developer

What matters Top three priorities for the next three months * Known issues or recent incidents Key integrations Analytics and monitoring Read access to analytics helps me measure before and after. Anything I should not touch

Working together Who approves releases * One named person; nothing goes to production without their go. Preferred channel Where requests should live When deploys are fine Anything else

Stored with your audit file, covered by the NDA and DPA you signed. Privacy

Answers receivedThank you

I read these before we talk.

A copy with the same two steps is in your inbox.

1 · Kick-off call, 45 minutes: pick a time if you haven't yet

Pick a time

2 · Prepare access (set up on the call, not before)

Hosting: a viewer role on the hosting or deployment panel, or the name of the person who deploys today.
Analytics: viewer access to GA4 or your analytics tool, so the before and after can be measured.

Anything secret: never by email or chat. Invitations to a named account need no password at all. For anything that is a secret (SFTP, SSH keys, API keys), use the secure drop: sealed in your browser with my public key, readable only on my machine, deleted with all access when the audit is delivered.

Share something secret now Exact steps per platform

Tell me about the store.

This questionnaire opens from the link in your payment email.

I read these before we talk.