The Private Standard
Custody and exposure

The Exposure Review

A short, fixed study of who actually holds the organization's name, mail, accounts, and access.

An aged brass key and key ring on cream laid paper beside an oxblood leather folder and brass letter opener on a dark walnut desk, lit from the left with deep shadow to the right.
The thesis

Most operators run the business on an address they were given rather than a domain they own. There is no admin console, no enforced second factor, no way to end a session, no record of who signed in, and no control over the published settings that tell the world which mail is genuinely theirs. Nothing looks wrong until the day someone else writes to the client list using that address, and the correction is filtered as spam before it arrives. The Exposure Review establishes what the organization holds, what it only appears to hold, and what it would take to hold it outright.

What the work covers
  1. 01

    Custody of the name

    Who owns the domain, who holds the registrar login, where the mail is hosted, and whether the organization could recover any of it without the person who first set it up.

  2. 02

    Access and its record

    Who can sign in, from what, behind what second factor, and whether a departure or a compromise can be ended and evidenced the same day.

  3. 03

    What the world is told

    The published settings that let a recipient separate genuine correspondence from forged, and the path back to a client list after that trust has been damaged.

Two ways to commission it

The Exposure Review

One operator, one domain, one mail system, up to fifteen accounts. The fee is published because the scope does not move. It is not a deposit and not a retainer, and nothing the review finds changes what we are owed for it.

  • Registrar, domain, and mail custody traced to a named holder
  • Account and access inventory with second-factor status
  • Mail authentication reviewed as a recipient sees it
  • A written register: what is exposed, who can close it, and in what order
  • One hour with the principal to walk the register
Fee
$3,500
Duration
Ten business days
Admission
Open. No Diagnostic required.

One operator. One domain. One mail system.

Request The Exposure Review

The Exposure Review, Institutional

For firms, boards, foundations, cellars, brokerages, and representation offices where the estate is larger than one domain and the obligation runs to somebody else's information. Priced in a range because no two estates are the same size.

  • Everything in the Exposure Review, across multiple domains and entities
  • Vendor and third-party access mapping
  • Records custody and retention reviewed against the obligation
  • A departure and revocation procedure the organization can actually run
  • An incident and notification path reviewed with counsel
  • Delivered to the principal, and to the board where one sits
Fee
$15,000 to $30,000
Duration
Three to four weeks
Admission
Open. No Diagnostic required.

Organizations holding client files, resident records, donor data, or a represented party's information.

Request The Exposure Review

The Diagnostic is credited in full against the work that follows, because the Diagnostic is a plan for work we expect to do. A review that looks for exposure is credited against nothing. The reason is set out under Independence.

How this reads by discipline

The work does not change. The vocabulary does.

Law Firms

A firm holds privileged material on behalf of people who cannot verify how it is held. Custody is not an IT question here. It is a professional obligation.

  • The firm's mail runs on an address nobody at the firm administers.
  • A departing associate's access ends with a password change and a hope.
  • Client correspondence and forged correspondence look identical in a client's inbox.

Adds matter-file custody, the conflict of an outside vendor holding privileged material, and a notification path reviewed against the firm's professional responsibility obligations.

Cooperative & Condo Boards

A board holds owners' records under a duty it did not personally choose. When custody sits with a vendor or a predecessor, the duty stays with the board regardless.

  • The domain was registered by a managing agent or a former board member.
  • Board mail moves through personal accounts that leave with the term.
  • Nobody can say who still has access to the association's records.

Adds the managing-agent handoff, records custody across board turnover, and the separation between the association's own mail and the property systems that LRI Connect reviews.

Luxury Real Estate

Wire fraud in a transaction begins with a forged message that looks exactly like a real one. What the brokerage publishes about its own mail is what decides whether a client can tell.

  • Listing correspondence and wire instructions travel on consumer mail.
  • Agents forward client files through accounts the brokerage cannot revoke.
  • The brokerage cannot prove which of its addresses are genuinely its own.

Adds transaction-side correspondence, agent offboarding across a roster, and the custody of client files held outside the brokerage's own systems.

Foundations & Grantmakers

A foundation holds information about people who asked it for help. That record outlives the staff member who collected it, and it is the first thing a compromise would reach.

  • Grant correspondence and payment instructions share an unprotected mailbox.
  • Trustee access was granted years ago and never reviewed.
  • Donor and applicant records sit in accounts tied to one staff member.

Adds trustee and staff access separation, grantee data custody, and a records path reviewed against the foundation's reporting obligations.

Wine & Hospitality

A serious program's real asset is the client list and the allocation history behind it. Custody of that list is the business.

  • Allocation and client lists live in a mailbox the program does not administer.
  • Reservation and membership data moves through third-party systems nobody has mapped.
  • Departing staff retain access to the collector relationships they built.

Adds vendor and platform mapping across reservation, membership, and allocation systems. Where the subject is guest data in a hotel or restaurant setting, the work belongs to The Patron Measure instead.

Talent Management

A representation office holds information a client cannot afford to have public and did not choose to have stored. Discretion is the service being sold.

  • Deal correspondence runs on accounts tied to individual representatives.
  • A represented party's private information sits in shared inboxes.
  • The office cannot end access the day a representative leaves.

Adds per-representative access separation, custody of a represented party's private material, and a revocation procedure that closes the same day a departure happens.

Authorization

Nothing is examined without permission in writing.

Nothing is examined until two documents are signed. They fix what is in scope, what is excluded, when the work happens, and who at the organization is accountable for it. An acknowledgement on the application form is a condition of being considered. It is not authorization to begin.

  • Rules of Engagement

    Defines the systems in scope, the systems expressly excluded, the testing window, and the contacts on both sides.

  • Authorization letter

    Confirms the organization owns or lawfully controls every system named, signed by someone with the standing to say so.

Read how we conduct security work
Independence

A firm that builds cannot claim to be disinterested.

The Private Standard builds websites and installs systems. A review we perform can point at work we would be paid to do. An operator is entitled to know that before the review begins, so it is printed here rather than disclosed afterward.

The fee is settled on scope, not on findings. It is published in advance. A clean report and a difficult one cost the same, and neither is credited against anything we later build.

Every finding names the party who can close it. Where the operator, a registrar, a mail provider, or an existing vendor can close it, we say so and give the steps. Most of what we find is closed this way, at little or no cost, and the register is written so an operator can act on it alone.

The report does not quote remediation. If the operator wants us to do the work, that request comes after the report is delivered, under a separate written scope and a separate fee.

A recommendation that would put us in the work says so on its face.

This is a disclosed conflict, not an eliminated one. An operator who wants it eliminated should engage a reviewer who builds nothing, and we will say that plainly when asked.

What this is not

This is a documentary review of ownership, access, and mail authentication, conducted only under written authorization. It is not a penetration test, not a security certification, not a legal or insurance determination, and not a guarantee against compromise. Where the subject is guest data in a hospitality setting, the work belongs to The Patron Measure. Where the subject is an association's records or a property's public website, it belongs to LRI Connect.

Begin

The Exposure Review
can be commissioned directly.

Request The Exposure ReviewBoth commissions

Or read The Site of Record