Sites & products
Everything I've built.
Training platforms, a hosting business, regulated SaaS products, and content destinations. Every one of them running on infrastructure I designed, monitor, patch, back up, and get paged for.
For how the infrastructure itself works, read the deep divesOperations & training
The work that comes directly out of fifteen years of incident response.
Incident Command · Training
Incident Commander HQ
A training platform and field guide for production incident command. ICS principles adapted to software operations, severity triage, escalation decision trees, stakeholder communication, and blameless postmortem workflows.
Deep dive · incidentcommandhq.com
AI SOC · SOAR · NDR · Self-healing NOC
The fleet control plane
The AI security operations centre, autonomous response engine, network detection rollout, self-healing incident responder, distributed AI worker pool and terminal committee that run everything else on this page.
Read the deep dive
Security & response
Detection that someone actually reads, and a response engine allowed to act on it without being allowed to improvise.
Security & Response
The AI SOC
Everybody has detection. Nobody has anybody to read it. That is not a problem you hire your way out of, and it is not a problem you buy another product to fix.
Read the deep dive
Security & Response
Autonomous Response
The AI never writes a command. It picks a number off a list, so the worst a hostile input can do is make it pick a different approved action.
Read the deep dive
Security & Response
NDR Rollout
The value was never inbound attack detection. It was being able to prove whether data left.
Read the deep dive
Reliability & automation
The machinery that keeps the fleet standing between incidents, and the parts of it deliberately not allowed to act alone.
Reliability & Automation
The Self-Healing NOC & War Room
A 200 means something is listening. It does not mean the site is up. That gap is where an outage sits quietly while every dashboard stays green.
Read the deep dive
Reliability & Automation
Backups Built For The Day You Are Already Compromised
Everyone has backups. The question worth asking is whether the thing that just encrypted your fleet can also reach them, and for most people the honest answer is yes.
Read the deep dive
Reliability & Automation
The Fleet Worker Pool
Any machine can do any job, a stranger's code runs somewhere with no home to go back to, and the list of what a machine can do is not allowed to lie about it.
Read the deep dive
Reliability & Automation
The Terminal Brain
A committee of models reads over your shoulder in a live production shell. The watching tier cannot type. Not switched off, not configured down. There is no code path that types.
Read the deep dive
Hosting & infrastructure business
Managed hosting where the product is the operational discipline, not the disk space.
Managed Hosting · Web Design
HitDirector
Website design plus managed hosting, run to the standard of the Fortune 500 platforms I used to keep online. Incident response instead of ticket triage, monitoring that reaches a senior engineer, and daily verified backups in isolated storage.
hitdirector.com
Managed Hosting · Flat rate
WebHostNOC
The same infrastructure, packaged for small businesses as one flat all-in price: we design it, build it, host it, and keep it running. No tiers, no upsells.
webhostnoc.com
Platforms & Products
How the hosting is actually run
Most hosting sells you disk space and wishes you luck. This sells the part nobody advertises, which is somebody answering at two in the morning.
Read the deep dive
Regulated platforms
Single-tenant products carrying the most sensitive data tiers, built to GLBA, IRS Pub 4557 and ESIGN/UETA.
Tax · GLBA / IRS 4557
CPA client portal platform
A productized client-intake and document portal for accounting firms (SSN, EIN, banking and tax records) deployed single-tenant on a dedicated host per firm, with per-tenant encryption keys held off the application box.
Deep dive · live at fasttax.us
Telemedicine · PHI
White-label telehealth portal
Patient onboarding, intake, video visits, consent packets and role-based access, with one core codebase and per-tenant branding. Realtime media runs on its own host and its own TURN infrastructure.
Deep dive · live at weightlossplusrx.com
E-signature · ESIGN / UETA
SignFlow
A self-hosted electronic signature service producing PAdES-style signed PDFs, so the audit trail and the signed artifact both stay inside the tenant boundary instead of being rented from a vendor.
Read the deep dive
Products & autonomous workers
The same agent pattern the fleet uses for security, pointed at ordinary product problems. A worker renders the real page in a real browser, a model reads what came back, and a human keeps the final say.
Product · Autonomous worker
Website Checkup
Give it a URL and it renders the site in a real Chromium browser, then grades nine dimensions: design age, mobile, SEO, accessibility against WCAG via axe-core, legal, UX flow, speed, broken links and security. An unattended worker polls for pending audits and does the run, so the report is produced rather than promised.
hitdirector.com/website-checkup
Product · Agent verification
The Leander Local Guide
A local events guide where nothing gets published on trust. A worker renders each venue's own website and asks a model pool whether the recurring event actually happens there, then posts an approve or reject with its reasoning. Same worker design as the site auditor, a completely unrelated problem, which is the point.
leanderlocalguide.com
Content & side projects
Sites running on the same fleet, same monitoring, same backups.
Curious how any of it actually works?
The Work section has thirteen deep dives. Architecture, the decisions behind it, and the things I got wrong the first time.
Read the deep dives