Greenstar Technology Service Network

What we would do first

    What changes

      Talk to us

      Warren Green · (347) 456-6453 · [email protected]

      See everything we build for New York professional firms and studios

      For New York professional firms and studios

      Optimize your firm's outreach

      A client's mail server checks your SPF, DKIM and DMARC before it trusts a message from you. An expired certificate puts a warning page in front of your website. We check what any client or prospect sees from outside and fix it with you. We also look after the network closet.

      Send us a domain See a sample readout
      A small office at night, blue cables rising from the network rack in the corner into a ceiling of glowing threads, city lights in the window
      Specimen · 4 domains read Oct 16, 6:30 AM · 3 urgent · 4 dated

      Your office

      The closet nobody opens until the internet stops

      A technician kneels with a laptop showing monitoring graphs beside an open floor-standing network rack spilling tangled blue cables

      Monitoring · network and uptime

      Each port checked every minute

      We watch the switch, the firewall, the Wi-Fi and the internet line, and keep a written map of what plugs in where. Disks and links are checked every minute too. A failing port or a full disk alerts us within the minute. Whoever answers has seen your closet.

      Greenstar · 1:52 AMexample-studio.example: render node unreachable since 1:50 AM. Internet line, firewall and file server are up; switch port 7 keeps dropping and reconnecting. Nothing for you to do tonight: the second node is finishing the render, and the port goes on the next visit.
      An architect at a large monitor showing a 3D building model, a small server glowing on the desk beside it, foam massing models and drawings by the keyboard, exposed brick behind

      Build · storage and remote access

      We restore your backup every month to prove it

      For a design studio: render nodes, shared project storage and remote access to the model from the office or home. For a law or accounting firm: the document store, the retention it has to keep and a VPN that does not leak a client file. The restore runs on a spare machine, and we write down how long it takes.

      A small office at night, blue cables rising from the network rack in the corner into a ceiling of glowing threads, city lights in the window

      Integration · the inventory

      See your domain as a client's IT team does

      Anyone can see when your certificate expires, whether your mail proves it is you and when your registration runs out. Inside, we match each device to its port, each account to its owner and each license to its renewal date. We keep both in one inventory, the one a security questionnaire, an insurer's application or a bid asks for.

      • Certificate expiry, SPF, DKIM, DMARC and registration read from public records each morning
      • Anything we cannot see from outside is marked unverified
      • We never hold your registrar, DNS or host logins. Every change is made with you in your own accounts.

      The domain check

      A studio's certificate has six days left

      A client's security questionnaire, an insurer's scan and anyone forging your mail all start with your domain's public records. Each record has a date or a setting anyone can read. We start there and work inward. Follow one fictional studio through the five steps.

      Public DNS and certificate logs · example-studio.example1 / 5
      Certificate · 6 days to expiryoutside-in check · run Oct 16, 6:30 AM · 41 seconds

      What the internet shows of example-studio.example

      Certificate
      www.example-studio.example expires Oct 22 · no newer certificate in the public logs, 24 days past the usual renewal point
      Registration
      Expires Nov 23 · transfer lock on · auto-renew and contacts not visible from outside (unverified)
      Mail
      MX at a known hosted-mail provider · SPF present, 12 lookups (more than 10 is an error) · DKIM: no key found at the common selector names · DMARC policy none
      Website
      HTTP redirects to HTTPS · chain complete · no client portal or remote-desktop login among the names read
      Firm
      NYS DOS filing active · the address for service of process on file matches the office
      Count
      5 issues: 1 urgent, 2 dated, 2 open.

      Read October 16, 2026, 6:30 AM, from public sources only: DNS, the certificate transparency logs, the registrar's public record and the state's filing. This is the view an insurer's scanner or a client's IT team gets. We logged into nothing of yours.

      Your systems · last 90 days6 components · checked every minute

      Switch port 7 caused the only outage

      updegradeddown Website100% Mail100% File server100% Render node99.89% Backup90 / 90 Internet line99.99% 90 days agotoday Sep 19, 1:50 AM · render node down 2 h 10 min · switch port 7 dropped 11 times, then held

      Diagnosis: the render node dropped at 1:50 AM on Sep 19 while the internet line, firewall and file server stayed up. The switch log shows port 7 dropping eleven times before it held. The fault is the port or its patch cable; the node and carrier are fine. Nobody lost work: the second node finished the overnight render. The line's one degraded day was four minutes of announced carrier maintenance.

      Work order · openWO-2093 · opened Oct 16, 7:05 AM

      Four fixes in one visit

      Certificate
      Renewal automated at the host; it renews itself about two-thirds of the way through each certificate's life, and we check it from outside every morning
      Due
      Oct 18 · four days before the certificate expires
      Mail
      SPF rewritten to 6 lookups, two unused services removed · the provider's DKIM key published under its selector · DMARC reports sent to a mailbox we read, then the policy moved from none to quarantine on Oct 30
      Registration
      Auto-renew on, from your registrar account · a second contact added · the date watched anyway
      Switch port 7
      Patch cable replaced, the render node moved to port 9, port 7 shut and labeled
      Access
      Change window Oct 17, 7:30 AM, before anyone is in · your office manager notified

      We open it straight from the readout and the switch log. Every registrar, DNS and host change is made in your own accounts while you are on the call. Greenstar holds none of those logins. It is due four days before the certificate expires.

      Re-check · passedre-run Oct 18, 9:12 AM · 38 seconds

      Re-check passed and a test restore took 14 minutes

      A technician kneeling at an open network rack, a laptop showing the monitoring graphs
      Certificate
      New certificate, renews itself · next renewal expected Dec 16 · watched daily
      Mail
      SPF 6 lookups · DKIM key found under the provider's selector, a test message signed and verified · DMARC reports arriving; policy moves to quarantine Oct 30
      Registration
      Auto-renew on and two contacts on file, confirmed in your registrar account with you
      Backup
      Restore test: three project folders from last night's set opened on a spare machine in 14 minutes; checksums matched
      Switch
      Port 9 steady since the change, zero errors on every check · port 7 shut and labeled

      We keep this re-check on file for the next security questionnaire. Last night's backup was restored this morning and timed.

      Closet map · currentrevision Oct 18 · one page, on the inside of the closet door

      The map on the inside of the closet door

      Internet line
      Fiber handoff on the closet wall · watched: line up, latency, packet loss, the carrier's maintenance notices
      Firewall
      Rack unit 1 · watched: WAN state, VPN tunnels, firmware, a nightly copy of its configuration
      Switch
      24 ports, rack unit 2, every port labeled · watched: link state and errors per port, PoE budget
      Access points
      Four, ceiling-mounted, named by room · watched: clients, channel, uplink
      File server
      A NAS in rack unit 4, project storage and the document store · watched: disk health, capacity, snapshot schedule
      Offsite backup
      Nightly to a second location · watched: last success, size, and the monthly restore test
      Report
      First business day of each month: uptime per component, what changed, what comes due next (certificate, registration, licenses, the insurer's renewal questionnaire)

      The map is one page. One copy hangs on the closet door and one goes in your file. You can hand the monthly report to your insurer or attach it to a bid. Your clients can check its public lines themselves and get the same answer.

      Left alone, the certificate expires on a Saturday and clients' browsers show a warning page. The registration lapses and the website and mail stop together. With no DMARC policy, anyone can send email as your firm and forged invoices reach your clients. Each is a public date or setting. We read them daily and you hear before a client does.

      Sample readouts

      Four domains and what each one needs

      Four fictional firms, read October 16, 2026: a 14-person architecture studio, a 22-person accounting firm, a 9-person law firm and a 31-person interior design studio. Lines run in this order: urgent, dated, open, watching and not covered. We count issues and give no grade. Each issue names the step that clears it.

      greenstar · domains · example-studio.example

      example-studio.example

      Architecture studio · DUMBO · 14 people · 2 locations · domain registered 2014

      1 urgent2 dated2 open2 watching
      • UrgentTLS
        The certificate for www.example-studio.example expires Oct 22. No renewal shows in the public logs; from the evening of that date every browser shows your clients a warning page instead of your work. Step: renewal automated at the host this week, then checked from outside every morning.certificate transparency logs · read Oct 16, 6:30 AM

        The record. Certificate for example-studio.example and www.example-studio.example · issued Jul 24 by a free certificate authority · not valid after Oct 22, 11:59 PM UTC · no newer certificate for either name in the public logs.

        What it means. No renewal has run with six days left, which points to a certificate renewed by hand; from the evening of Oct 22 the site shows a warning page instead of the studio's work.

        What we'd automate. The expiry read from outside every morning; inside 20 days with no newer certificate issued, an alert to us and a work order with the host's renewal steps already on it.

      • DatedDNS
        Domain registration expires Nov 23. Auto-renew is off in your registrar account. Once it expires, the registrar can switch off the website and all mail together, on the expiry date or in the weeks after. The only contact on the account left the firm. Step: auto-renew on from your registrar account, a second contact added, the date watched anyway.registrar record · your registrar account, read with you · Oct 16

        The record. Registrar record: created 2014 · expires Nov 23 · transfer lock on · contacts redacted for privacy. Your registrar account: auto-renew off · one contact, the personal email of an office manager who left in 2021.

        What it means. The renewal notices go to an inbox nobody reads, so a missed payment can stop the website and every @example-studio.example address at once.

        What we'd automate. The expiry date read every morning; if it has not moved forward 30 days out, an alert to us and a reminder to whoever holds the registrar account.

      • DatedDMARC
        DMARC policy is none. Moves to quarantine Oct 30. Today anyone can send mail as @example-studio.example, and the domain gives receiving servers no preference about it, so many deliver forged mail. Step: two weeks of aggregate reports to a mailbox we read, so nothing legitimate is caught, then the policy tightened on the date above.DNS TXT record · read Oct 16

        The record. _dmarc.example-studio.example TXT "v=DMARC1; p=none" · no report address, so no reports are sent anywhere · unchanged since the record was first read.

        What it means. A message forged in the studio's name carries no request from the studio to refuse it, and nobody is told it happened.

        What we'd automate. A weekly summary of every service sending as the studio and whether it passes; the move to quarantine on Oct 30 happens only once that list is clean.

      • OpenSPF
        The SPF record makes 12 lookups; more than 10 is an error. Past the limit the record fails evaluation, so some of your own mail is treated as unauthenticated. Step: the record rewritten to six lookups, two services nobody uses anymore removed.DNS TXT record · read Oct 16

        The record. One SPF record, six include entries · 12 DNS lookups when expanded, against a limit of 10 · two of the includes belong to a newsletter tool and a scheduling service the studio stopped using.

        What it means. A receiving server that needs more than 10 lookups stops and returns an error, so mail from the services listed late in the record loses its pass.

        What we'd automate. The record re-counted every morning; any change that takes it back over 10 lookups is an alert the same day.

      • OpenDKIM
        DKIM: no key found at the common selector names. A DKIM key cannot be seen from outside unless we know its selector name, so this is unverified, not failed. Step: your mail provider's DKIM key published under its selector, then confirmed by a test message to us that arrives signed.DNS · read Oct 16

        The record. Looked up: s1, s2, k1, default, mail, dkim, selector1, selector2 and the other selector names hosted-mail providers use by default · no key answered under example-studio.example.

        What it means. The studio may sign its mail under a selector we did not try, or not at all; from outside the two look the same, so the line stays unverified.

        What we'd automate. The provider's DKIM key published under its selector from your DNS account, a signed test message checked on arrival, and the key read every morning after that.

      • WatchingMX
        Mail hosted at a known provider; the MX records resolve and match. Checked every morning against the provider's published hosts.DNS MX records · read Oct 16

        The record. MX: two records, priority 1 and 5, both on the hosted-mail provider's published hosts · unchanged for 90 days · resolved Oct 16, 6:30 AM.

        What it means. Mail addressed to the studio goes to its provider and nowhere else.

        What we'd automate. A morning comparison with the provider's published hosts; a changed or added MX record is an alert the same morning, because that is how mail is quietly redirected.

      • WatchingHTTPS
        HTTP redirects to HTTPS; the site answered every minute for 90 days. The chain is complete; only the expiry above is wrong.our monitor · checked every minute · last Oct 16, 6:29 AM

        The record. http://example-studio.example answers with a permanent redirect to https://www.example-studio.example · certificate chain complete · 129,600 checks in 90 days, all answered.

        What it means. The site is up and served securely; only the expiry date above is wrong.

        What we'd automate. The minute-by-minute check stays on; two missed checks in a row text us, five text your office manager.

      • Not coveredPortal
        No client portal or remote-desktop login among the names we can see. A login on a name with no public certificate would not show from outside, so this line lists what was read.public DNS and the certificate logs · read Oct 16, 6:30 AM

        The record. Names read: the domain, www, the mail hosts, and every name in the certificate logs · none is a client portal, a remote-desktop gateway or a VPN login.

        What it means. Nothing we can see under the studio's name invites a login from the internet; a login on a name we cannot see stays outside this readout.

        What we'd automate. The names re-read every morning; a new one that looks like a login is a line on the next day's readout.

      sample-cpa.example

      Accounting firm · Midtown · 22 people · 1 location · domain registered 2009

      2 urgent1 dated3 open
      • UrgentBackup
        The offsite backup has not finished since Oct 10. Six nights of client files and tax workpapers exist only on the server in the office. Step: the storage credential the job uses renewed today, the backup run by hand tonight, then one client folder restored on a spare machine to prove it.your backup job log · read Oct 16, 6:30 AM

        The record. Job "Offsite nightly" · last success Oct 10, 1:12 AM · six runs since, each failed at 1:00 AM with "storage target rejected credential" · 1.8 TB protected · local snapshots on the server current.

        What it means. A failed disk, a burst pipe or ransomware on that server tonight would take six days of client work with it.

        What we'd automate. One failed night is an alert to us the next morning instead of a discovery on the sixth; the credential's own expiry date goes on the readout a month ahead.

      • UrgentTLS
        The certificate on portal.sample-cpa.example expired Oct 14. Clients uploading tax documents now see a browser warning, and the ones who cannot get past it email their documents instead. Step: the certificate reissued today from the portal service's custom-domain settings, set to renew itself, then checked from outside every morning.certificate transparency logs · read Oct 16, 6:30 AM

        The record. portal.sample-cpa.example is an alias for a hosted client-portal service · its certificate issued Jul 16, not valid after Oct 14 · no newer certificate in the public logs · www.sample-cpa.example is on its own certificate, valid to Dec 26.

        What it means. The firm's website looks fine; the page clients actually use to send their documents is the one showing the warning.

        What we'd automate. Every name we can see under the domain checked for expiry each morning, not only www; inside 20 days with no newer certificate issued, an alert to us and a work order.

      • DatedFirewall
        The office firewall stops getting security updates Dec 7. The maker has set an end-of-support date for the model; after it, a flaw found in it stays open. Step: a replacement sized for 22 people, its rules and VPN users carried over, installed on a weekend before the date.the maker's end-of-support notice · your firewall · read Oct 16

        The record. Small-office firewall, installed 2018 · latest firmware for its line · the maker's end of security updates for the model: Dec 7 · 41 rules, 6 VPN users.

        What it means. It keeps passing traffic after that date, but it stops being fixed, and it is the one box between the internet and the client files.

        What we'd automate. End-of-support dates for every device in the closet kept on the readout, so a replacement is a planned weekend, not an emergency.

      • OpenDMARC
        No DMARC record is published. Anyone can send mail as @sample-cpa.example, and at an accounting firm that mail asks clients to send documents or payments somewhere else. Step: a DMARC record published with reports to a mailbox we read, then tightened to quarantine once every real sender passes.DNS TXT record · read Oct 16

        The record. _dmarc.sample-cpa.example: no record · read Oct 16, 6:30 AM.

        What it means. Receiving servers have no instruction from the firm about forged mail, so each decides for itself, and many deliver it.

        What we'd automate. A weekly summary from the reports of every service sending as the firm; the move to quarantine goes on the readout as a dated line once that list is clean.

      • OpenSPF
        Two SPF records are published; receiving servers treat that as an error. The firm's own mail and the invoices its billing service sends both lose the check. Step: the two merged into one record from your DNS account, five lookups.DNS TXT record · read Oct 16

        The record. sample-cpa.example TXT "v=spf1 include:_spf.mail-provider.example ~all" · sample-cpa.example TXT "v=spf1 include:send.billing-service.example -all"

        What it means. The standard allows one SPF record per domain; with two, a receiving server stops and returns an error instead of a pass.

        What we'd automate. The merged record read every morning; a second record appearing, which is what usually happens when a new service is set up, is an alert the same day.

      • OpenRemote
        remote.sample-cpa.example points to a server outside the office that nobody at the firm can account for. The name suggests a remote-desktop login. Step: the previous vendor asked what it is; then the login retired or put behind a second sign-in step, and the name removed if nothing uses it.public DNS · read Oct 16

        The record. remote.sample-cpa.example A 198.51.100.17 · not the office's internet line, which is 203.0.113.42 · no other name we can see points there.

        What it means. A login open to the whole internet under the firm's name is a common way into a small office; we have read its DNS record only, and have not connected to it or tested it.

        What we'd automate. Every name we can see under the domain listed each morning with an owner and a purpose beside it; a name nobody owns stays on the readout until someone claims it.

      specimen-law.example

      Law firm · Lower Manhattan · 9 people · 1 location · domain registered 2017

      5 watching
      • WatchingDMARC
        DMARC policy is reject, and its reports are read every week. In the last 30 days every message the firm sent passed, and the reports show the forgeries rejected.DNS TXT record and aggregate reports · read Oct 16

        The record. _dmarc.specimen-law.example TXT "v=DMARC1; p=reject" with reports to a mailbox we read · last 30 days: 4,812 messages from the firm's mail provider, all passing SPF and DKIM; 37 from servers the firm does not use, all rejected.

        What it means. Receivers that honor DMARC refuse mail that forges the firm's own domain; a look-alike domain is outside what DMARC covers.

        What we'd automate. The weekly reports read for new senders; a real service that starts failing, such as a new billing tool, is a line before anyone notices bounced invoices.

      • WatchingTLS
        The certificate renews itself; the next renewal is expected Dec 8. The last four renewals each ran on time.certificate transparency logs · read Oct 16, 6:30 AM

        The record. specimen-law.example and www.specimen-law.example · issued Oct 9 · not valid after Jan 7 · each of the last four certificates issued about two-thirds of the way through the life of the one before.

        What it means. Nothing to do; this is a certificate looking after itself.

        What we'd automate. The daily read stays on; if a renewal is ever missed, the alert comes 20 days before expiry, not on the day.

      • WatchingDNS
        Registration paid through March 2029, with the transfer lock on. Auto-renew is on in the firm's registrar account, and both contacts on it are people still at the firm.registrar record · your registrar account · read Oct 16

        The record. Registrar record: created 2017 · expires March 2029 · transfer lock on · contacts redacted for privacy. Your registrar account: auto-renew on · contacts: the managing partner and the office manager, both at firm addresses.

        What it means. The domain cannot lapse quietly or move to another registrar without the firm knowing.

        What we'd automate. The record read every morning; a changed name server, expiry date or lock is an alert the same day.

      • WatchingBackup
        The latest restore test: three matter folders back in 9 minutes. The nightly offsite backup has finished 90 nights out of 90.your backup job log · read Oct 16 · restore test Oct 4

        The record. Job "Offsite nightly" · last success Oct 16, 1:08 AM · 90 of 90 nights · restore test Oct 4: three matter folders, 6.2 GB, opened on a spare machine in 9 minutes, checksums matched · next test Nov 3.

        What it means. The backup has been proven by restoring it, which is what a client's security questionnaire asks.

        What we'd automate. The monthly test scheduled, timed and written into the monthly report; a failed night is an alert the next morning.

      • WatchingVPN
        The one published login, vpn.specimen-law.example, asks for a second sign-in step. The firewall behind it runs current firmware, and its configuration is copied off the box every night.public DNS · your firewall · checked every minute · last Oct 16, 6:29 AM

        The record. vpn.specimen-law.example A 203.0.113.58, the office's internet line · 9 VPN users, each with a second factor · firewall firmware the latest for the model, installed Sep 27 · configuration copied nightly, last Oct 16, 2:00 AM.

        What it means. The only door the firm publishes to the internet is up to date and needs more than a password.

        What we'd automate. New firmware applied in a change window within a week of release; a VPN user without a second factor, or a new rule that opens a port, is an alert the same day.

      • Not coveredPortal
        Client files go through a hosted document service on the vendor's own domain. Its certificate and logins are the vendor's to keep, so it sits outside this readout.public DNS and the certificate logs · read Oct 16, 6:30 AM

        The record. Names read: the domain, www, vpn, the mail hosts, and every name in the certificate logs · none is a client portal · client share links point to the vendor's own domain.

        What it means. The vendor's own security report is what a questionnaire should cite for that service.

        What we'd automate. The vendor's security report kept in the firm's file beside the readout, and its contract renewal date on the calendar.

      placeholder-design.example

      Interior design studio · Chelsea · 31 people · 2 floors · domain registered 2011

      1 dated2 open3 watching
      • DatedBackup
        The monthly restore test is due Oct 19. The last one took 3 hours 40 minutes. One project folder, pulled back from the offsite copy over the office line; after a lost server the studio would wait most of a day for its drawings. Step: active projects kept on a fast local copy as well, then the test re-run and timed against a one-hour target.your backup job log · read Oct 16 · last restore test Sep 19

        The record. Restore test Sep 19: one project folder, 48 GB, from the offsite copy in 3 h 40 min, checksums matched · nightly backup 90 of 90 · local copy: none · next test due Oct 19.

        What it means. The backup works; it is the time to get files back that does not.

        What we'd automate. Each test timed against the target; a restore slower than the target stays a dated line until a test beats it.

      • OpenDMARC
        DMARC is at quarantine, but its reports go to an address that no longer takes mail. The policy works; nobody can see what it catches. Step: the report address moved to a mailbox we read, and the first week's report checked for real senders landing in junk.DNS TXT record · read Oct 16

        The record. _dmarc.placeholder-design.example TXT "v=DMARC1; p=quarantine; rua=mailto:[email protected]" · that domain no longer publishes a mail server.

        What it means. If a service the studio added this year fails the check, its mail is likely landing in junk folders and no one is told.

        What we'd automate. A weekly summary from the reports: who sends as the studio, what passes, what is quarantined.

      • OpenSwitch
        Port 14 on the second-floor switch is logging errors on the link to an access point. Wi-Fi on that side of the floor drops for a few seconds at a time. Step: the cable tested and re-terminated at the next visit, replaced if it fails.your switch · checked every minute · last Oct 16, 6:29 AM

        The record. Switch 2, port 14 · uplink to the access point by the materials library · 1,284 errors in 7 days, none the week before · link dropped and renegotiated 6 times, twice at 100 Mb/s.

        What it means. A damaged cable or a loose jack, not the access point; the designers on that side feel it as stalled uploads and dropped calls.

        What we'd automate. A port whose errors climb three days running opens a work order with the port, the room and the cable label on it.

      • WatchingDKIM
        DKIM key found at a common selector; mail from the studio arrives signed. A test message to us verified on Oct 13.DNS · read Oct 16

        The record. s1._domainkey.placeholder-design.example · 2048-bit key published · test message Oct 13: signature valid and aligned with the From address.

        What it means. A receiving server can confirm that mail signed by the studio came from it and was not altered.

        What we'd automate. The key read every morning; a provider key rotation that was never published is an alert the same day.

      • WatchingSPF
        The SPF record makes 8 lookups, under the limit of 10. One or two more services could push it over, so each new one is counted before it goes in.DNS TXT record · read Oct 16

        The record. One SPF record, four include entries · 8 DNS lookups when expanded · unchanged since Aug 17.

        What it means. The studio's mail passes, with little room left.

        What we'd automate. The record re-counted every morning, and any service the studio adds counted before its include is published.

      • WatchingUptime
        The website answered 129,580 of 129,600 checks in 90 days. The twenty missed minutes were all on Sep 2, in the host's announced maintenance window.our monitor · checked every minute · last Oct 16, 6:29 AM

        The record. https://www.placeholder-design.example · 129,580 answered, 20 missed, all between 2:10 and 2:30 AM on Sep 2 · the host's maintenance notice for that window on file · median response 0.4 s.

        What it means. The site was down for twenty minutes at night, once, and the host said it would be.

        What we'd automate. Two missed checks in a row text us; a host's maintenance notice is matched to the gap so it is not reported as an outage.

      Sample domains, none of them real. Tap one to see its lines. Dates follow today's date.

      Contracts and questionnaires

      What agencies and clients check before hiring you

      A bid asks about your firm's standing and, where the contract sets M/WBE goals, its certification. A client's security questionnaire and an insurer's application ask whether your mail is authenticated and your backup tested. The readout already holds those answers.

      City and state contracts

      City and state RFPs in your discipline

      The city buys architecture, engineering, legal and accounting services through requests published in the City Record and run through PASSPort. DDC fills its pool of design firms in periodic rounds that go from qualifications to a shortlist to proposals. The School Construction Authority requires a consultant to be prequalified by the time of award, for three years at a time. State agencies advertise solicitations of $50,000 or more in the New York State Contract Reporter. They choose architects and engineers on qualifications, under State Finance Law §136-a. We read the notices every day and pick out the ones in your discipline.

      • Open RFPs and RFQs with their due dates
      • The security questionnaire and insurance each one asks for
      • Who was selected and how

      Certification

      Primes look for certified subconsultants

      Many City services contracts set M/WBE participation goals for the prime to meet. SBS certification counts toward City goals. State goals count only firms certified by Empire State Development. We watch each certification you hold, its categories and renewal date, and the solicitations that set goals in those categories.

      • Your certification's renewal month
      • Subconsultant goals on each open RFP
      • Your directory profile updated from your own account

      Questionnaires and insurance

      Fill in the questionnaire from your readout

      Clients now send security questionnaires before they sign. Cyber-insurance applications ask the same things: who holds the admin accounts, whether mail is authenticated, when the backup was last restored and whether remote access is protected. The readout and monthly report answer each one, in writing and dated.

      • Questionnaires answered from the readout
      • The insurer's renewal application filled from the monthly report
      • Each admin account listed with whoever holds it

      What we read

      What anyone can look up about your domain

      Each line on a readout names its source and the time we read it. Every source below is public except your office, which we read with you.

      How it starts

      Send us a domain

      1. Readout. Send one domain or all of them. Within one business day you get what the internet shows of your firm and the step that clears each line.
      2. Scope. In writing: what we would monitor, what we would connect, who on your team gets which alert, and the date it starts.
      3. Build and run. Closet mapped, monitoring on, each line fixed from your own accounts. Then we keep it running and send a monthly report.

      Or email [email protected]