Useful before you ever talk to us

Every staff account has its own login — no shared passwords. Two-factor authentication is on for email and financial systems. Backups run automatically, and a restore has been tested in the last 90 days. Software and phones update automatically, including antivirus. Staff know how to spot a phishing message and where to report it. Leavers lose access to every system on their last day. Wi-Fi for guests is separate from the network your data lives on. You know where your critical data is stored and who can reach it. There is a written one-page plan for "the day something goes wrong". Admin accounts are used only for admin work, never daily email.

The domain is owned by the business, not by a former contractor. You can state, in one sentence, who the site is for and what it must achieve. Every page has one primary action a visitor can take. Content is written for readers, not for search engines. Contact details, location and operating hours are easy to find. The site loads in under three seconds on a mid-range phone. Forms are short, labelled and tested on mobile. HTTPS is active and the padlock shows on every page. Analytics tell you what visitors try to do, not just how many arrived. Someone is named as the owner of keeping content current.

Someone re-types data from one system into another. Reports are assembled by hand from spreadsheets. Follow-ups depend on people remembering, not systems reminding. Approvals travel by chat or paper. Invoices or receipts are processed manually.