The practice

Practice:

All of your IT, end to end. I set up and look after the systems a business runs on — computers, email and Microsoft 365 or Google Workspace, file storage, backups, the website, the network, the business systems, and the security over all of it. One person scopes the work, does the work, and answers your email afterwards. That is the whole company, and it is the point rather than a limitation.

Small businesses in the Fraser Valley. Offices, clinics, trades and contractors — businesses of about 2 to 30 people that depend on their systems and have no IT person of their own. I serve Abbotsford, Chilliwack, Mission and Langley, on-site where it matters and remote where it does not.

Background:

Building it properly since 2022. The practice began with a rack of hardware and the intention of understanding infrastructure from the inside rather than from a vendor’s documentation — domains and forests, hypervisors, firewalls, a private cloud, and eventually a full security platform. It is no longer a learning exercise. It is a small production estate that runs real systems, and every tool offered to a client runs on it first.

Education:

Bachelor of Computer Information Systems, with a concentration in security and software development. The programme covered both halves of the work this practice does — systems, networking and databases on one side, programming and software design on the other — with the security material running through both rather than sitting beside them.

Current work

Websites and care for local businesses. Sites the owners can update themselves, with hosting, domains, business email and renewals looked after.

Managed IT and security for small offices. Microsoft 365 or Google Workspace, updates, backups and multi-factor sign-in, checked every month.

An open-source security and management platform. It runs the practice’s own computers first, and its source and a list of what does not yet work are on the project pages.

Private AI on hardware the client owns, for businesses that want it: read-only by default, every change behind a human approval, and everything logged.

Open-source contribution:

The platform is built on other people’s work, and it names them. SigmaHQ’s detection rules under the Detection Rule License, MeshCentral for remote desktop under Apache-2.0, ClamAV for on-access scanning, and PHP, SQLite, Postgres and Go underneath all of it. Every archive ships a NOTICE file naming them. Publishing mine seemed like the reasonable thing to do in return.

Everything ships with its own list of failures. Each archive carries a status document that leads with what does not work before what does — the blocking that is still in beta, the mail gateway that has handled one domain, the missing migration framework, the installer bug. If you are going to publish something, the gaps should be in the box with it.

No licence key and no seat count. Download it, fork it, deploy it commercially, run it forever without me. That is a perfectly good outcome and it is what the licence is for.

Research interests:

Private language models on hardware people already own. A current high-spec laptop will run a thirty-five-billion-parameter mixture-of-experts model at conversational speed, entirely offline. For a small business that means capable private AI without a server room and without a subscription. I am working out where that holds up and where it does not.

Detection engineering. Behavioural detection that needs no prior signature — process lineage, credential access, mass-encryption patterns. Blocking at the moment of execution is in beta now: catching a binary as it runs without taking the machine down with it. The second half is the hard part and it is not solved.

Email authentication for small domains. Taking SPF, DKIM and DMARC to enforcement for businesses that have never looked at them, and what real protection looks like for mail that never passes through a gateway at all.

Why it is published:

These are tools I needed, not a product I set out to build. They were written for my own fleet and for client work, and they are built on other people’s open source. Publishing them costs me nothing and may save someone else the same work.

Free as in you can read it, change it, and keep it. A working framework someone can adapt is a better starting point than nothing, and it is the shape I would have wanted when I began. Whether anyone uses it is up to them.

It is more useful public than sitting on a disk. If someone downloads it, fits it to their own company and improves something, that improvement is there for the next person — which is how everything underneath it got built.

How I work:

Good service. You reach the engineer, not a queue, and you hear back within one business day.

Infrastructure that holds. Built new or upgraded from what is there — designed on paper first, documented as it goes, staged alongside the old system and cut over in a planned window, and tested by actually restoring the backup.

Work that pays for itself. Open source where a subscription is the wrong answer; Microsoft 365, Sophos or another enterprise platform where it is the right one. The recommendation is whichever fits, because I hold no reseller margin.

Documented so you are not dependent on me. Addressing plans, identity design, runbooks and versioned configuration, handed over as the work proceeds. Your own staff or another engineer can pick it up from the paperwork. If you need a help desk that answers at any hour, I will say so at the check-up and point you somewhere better suited.

Common questions

Where do you work?

I serve Abbotsford, Chilliwack, Mission and Langley and nearby communities. Work is on-site where it needs to be and remote where it does not, and you get a reply within one business day.

How do I get started?

Start with the free IT check-up: one visit and a one-page summary of what I find, whether the trouble is email, computers, backups, Wi-Fi, the website or the systems you run on. No obligation, and I change nothing on your systems during it.

Can you set up or replace our email, website, file server or point of sale?

Yes — that is most of the work. Email that bounces or lands in spam, a website you would rather not send people to, a file server nobody trusts, backups that have never been restored, a point-of-sale or inventory system living in spreadsheets, an old server someone else set up: each of those is a scoped build or upgrade. Whatever is hurting most goes first; otherwise I usually start with the website, then the web apps behind it, then the internal systems, so each new piece sits on something that already holds. If what you have only needs fixing rather than replacing, I will say so.

What is your pricing?

The check-up is free. A website is one price for the build and one yearly fee for hosting and care (what that covers). Everything else is scoped and priced in writing before it starts — a build or migration as a fixed-scope project, and ongoing looking-after sized to your actual office. Whatever the shape, the number is the number — no surprise line-items.

Will my data leave my network?

For private AI engagements — no. That is the entire point of the offering. Models run on hardware you own, prompts and uploaded files stay on your LAN, and you keep the audit log. I configure the stack, hand over runbooks, and operate only what you and I have explicitly contracted.

You are one person. What happens if you are unavailable?

Fair question — it is the one I would ask. Everything I build is documented and handed over as I go: diagrams, runbooks, admin access. Your own team or any competent engineer can pick it up cold. The tools I put in are ones you own outright, so nothing switches off because I am away for a week.

Do you support Mac, Windows, and Linux?

Yes to all three. Windows Server and Microsoft 365 are core skills; Linux runs most of the consulting work and every server I have racked for a client; and the Macs in an office are set up and looked after alongside the rest.

How does on-prem AI compare to per-seat AI subscriptions?

It depends entirely on how much your team actually uses it — the crossover moves a lot with headcount and volume. I will do that arithmetic with your real numbers at the check-up and show you the working, including the case where the subscription wins. What is not in doubt is the other half: on hardware you own, nothing you type leaves the building.

You also get customization (retrieval over your own documents, your own prompts and tools), full auditability, and no forced model deprecation. Trade-offs I am transparent about: hardware capital cost upfront, ops responsibility (which is what I provide as a service), and slightly more friction to upgrade to the latest frontier model. For most business tasks, mid-range open-weight models are sufficient.

Are you taking new engagements?

Yes. The check-up is always open. If I cannot start your build straight away I will tell you when I can in the first conversation, not after you have committed.

If you want that standard applied to your own setup, the first step is an hour of my time at no cost. I look at what you have, tell you plainly what is exposed and what to fix first, and the write-up is yours either way.