Getting started

Your business.
Your software.
Your accounts.

The handoff happens before we begin. You create the accounts and keep control. We receive delegated access and handle the technical setup.

Five short sections. Most owners work through them over a few sittings. Nothing is sent to us, and your checklist stays in this browser.

Your progress

Take it one step at a time.

No steps marked yet. Start anywhere.

0% complete

Progress saves in this browser only when JavaScript is available. No account, backend, or personal information.

01 / Your Domain & Identity

Start with your name.

Your domain is the address customers know. Register it—or keep it—in an account your business controls before anything goes live.

Your business email comes first.

DNS changes can interrupt email if existing records are removed or replaced. Before touching nameservers, identify the service that runs your business mailbox and preserve its MX, SPF, DKIM, and DMARC records.

You do not need to transfer your domain registration to Cloudflare. Keeping it at your current registrar is fine. You also do not need to give us your registrar password, recovery codes, or authentication codes.

Detailed setup: domain and registrar
  1. Register a new domain, or keep the one you have

    A new domain can be registered with any reputable registrar, including Cloudflare Registrar. An existing domain can stay exactly where it is. Moving a registration is optional and is not part of this project.

  2. Keep the account and billing in your name

    The registrar account should belong to the business. Use an email address you will keep, keep the renewal date and payment method current, and decide whether auto-renew is appropriate. You pay the registrar directly.

  3. Protect the account before you share access

    Use a unique password, enable multifactor authentication, keep an independent recovery email and phone number, and store recovery codes somewhere safe. You are responsible for these credentials.

  4. Prepare DNS without breaking email

    Write down which provider runs your business mailbox and which records it uses. When a domain is added to Cloudflare, existing DNS records are imported for review. Do not delete mail records or change nameservers until that review is complete.

  5. Let us configure the records

    Once the domain is in your Cloudflare account, invite us with the access described in the next section. We will review the records, connect the domain, and document what changed. You keep ownership of the domain and the account.

Your domain checklist 0 of 4

02 / Development Accounts

The accounts behind the work.

These are the working accounts for your project. You create them, own them, and pay for them. We receive the access needed to build and maintain the result.

Before you invite anyone

Use the account details in your engagement email. This project's repository is owned by the GitHub account hmarquardt. We do not publish an invitation email address here; if you do not have the invitation identity, ask Hank before sending an invitation.

Never send passwords, multifactor codes, recovery codes, payment card details, or private API tokens. Invite the account; do not hand over the keys to it.

Development account 01

GitHub

Required Free to start

GitHub stores your source code and its full change history. It is also where automated tests and deployments run. A client-owned organization keeps the code under your business, not inside a consultant's personal account.

What it is for
Source code, changes, automation, and project history.
What it costs
Free includes unlimited public and private repositories and 2,000 Actions minutes a month for private repositories. Paid plans are optional.
Access we need
Enough to create and manage repositories, configure Actions, and maintain project settings. Never your password or MFA.
Step-by-step GitHub setup
  1. Create your account and verify your email

    Sign up at github.com/signup using a business email you control. Verify the address so repository and security notices reach you.

  2. Enable two-factor authentication

    Use an authenticator app or passkey, add a backup method, and store your recovery codes somewhere safe. GitHub strongly recommends 2FA and may require it for code contributors.

  3. Create an organization you own

    In GitHub, open your profile picture, then Settings → Organizations → New organization. Choose the free plan unless you already need paid features. Name it for your business. For a substantial project, the organization keeps repositories, teams, and billing together. For a small first project, a personal account can work, but the account must still be yours.

  4. Invite Hank

    Open the organization, then People → Invite member. Use the identity from your engagement email. If we will create repositories and configure organization-level automation, invite us with the Owner role. If you prefer tighter access, invite us as a member and grant Admin access to the project repositories instead. We will confirm which is needed during scoping. Invitations expire after seven days.

  5. Keep independent owner access

    You remain an organization owner, and at least one other trusted person should be an owner for continuity. We never need to be the only owner, and you can remove our access whenever you choose.

GitHub checklist 0 of 5

Development account 02

Cloudflare

Required Free plan available

Cloudflare hosts websites and applications and can provide DNS, HTTPS, databases, file storage, and supporting services. Production runs in your Cloudflare account, with you as the owner.

What it is for
DNS, HTTPS, hosting, databases, file storage, and deployment infrastructure.
What it costs
A Free plan is available. Workers Paid starts at $5 USD a month per account and includes 10 million requests and 30 million CPU milliseconds; usage beyond that is billed. Database and storage usage can add charges.
Access we need
Permission to manage Workers, DNS, databases, storage, and deployment settings. You keep billing and member control.

Do not buy Workers Paid yet. We will determine the right plan and usage expectations during scoping. You add the payment method and pay Cloudflare directly.

Step-by-step Cloudflare setup
  1. Create your account and secure it

    Sign up at dash.cloudflare.com/sign-up. Verify your email, then enable two-factor authentication and save the backup codes. Keep the account in the business's name.

  2. Add the domain and review imported records

    In the Cloudflare dashboard, choose Add a site, enter your domain, and select the Free plan to start. Cloudflare scans and imports your existing DNS records. Review them before changing nameservers—especially MX, SPF, DKIM, and DMARC records that keep business email working.

  3. Update nameservers at your registrar

    Cloudflare assigns two nameservers. Add both at your registrar. If DNSSEC is enabled, turn it off at the registrar before the change and re-enable it in Cloudflare after the domain is active. Your registration stays with your registrar; nothing needs to be transferred.

  4. Decide on billing when the project requires it

    The Free plan covers DNS and basic services. Workers Paid starts at $5 USD a month for the account and includes 10 million requests and 30 million CPU milliseconds a month; overages are billed at published rates. D1 database and R2 storage usage may add charges. Add a payment method only when the approved scope calls for it.

  5. Invite Hank with project-level permissions

    In the dashboard, open Members → Invite members. Use the email from your engagement correspondence. For most projects, grant a policy scoped to the whole account with the Administrator role—full account access, but not member management or billing-profile control. If you prefer tighter access, use a scoped policy with Workers Platform Admin and Domain DNS. Keep yourself as Super Administrator - All Privileges.

  6. Keep ownership and deployment credentials separate

    You retain member management and billing. We create scoped API tokens only where automation requires them and store them as repository secrets. Never send a Global API Key or your account password.

After the handoff, we create and configure Workers, databases, storage buckets, custom domains, HTTPS, deployment tokens, and CI/CD. We document what exists and how it is deployed.

Three different kinds of email

A conventional business mailbox (such as Google Workspace or Microsoft 365) is separate from Cloudflare. Cloudflare Email Routing can forward or process incoming mail, but it is not a mailbox. Applications can also send their own transactional email. We will keep your business mailbox and your application email separate and explicit.

Cloudflare checklist 0 of 6

Development account 03

OpenRouter

Optional Pay as you go

Some AI-enabled projects need access to model APIs. OpenRouter is one provider that puts many models behind a single API. It is not required if your project does not use AI or uses a different provider.

What it is for
Access to AI model APIs for features we agree to build.
What it costs
Prepaid credits, with usage that varies by model and token count. OpenRouter charges a small fee when you purchase credits. You pay OpenRouter directly.
Access we need
Organization or project access sufficient to create and manage API keys. You retain ownership and billing.
Step-by-step OpenRouter setup
  1. Create your account and protect it

    Sign up at openrouter.ai/sign-up, verify your email, and enable two-factor authentication under Settings → Preferences → Security.

  2. Create an organization if the project needs one

    Go to Settings → Preferences. In the Organization section, choose Create Organization and follow the setup. Organizations are separate from personal accounts and share a credit pool; they currently support up to 10 members. A personal account may be enough for a small pilot, as long as you control it.

  3. Add your own payment method or credits

    Open Settings → Credits and add credits with your own payment method. Auto top-up is optional. Model prices vary, so review current pricing before approving a production feature.

  4. Set a sensible budget and alerts

    In the workspace, open Guardrails and create a guardrail with a budget limit that resets daily, weekly, or monthly. Requests are rejected when the limit is reached. In Settings → Notifications, enable the low-balance alert and, for each key, the API key spend-limit alert. Alerts warn you; budgets stop spending. A very low hard limit can interrupt a working application, so choose it with the project's expected usage in mind.

  5. Invite Hank as an organization admin

    In the organization's member settings, invite the identity from your engagement email with the Admin role. Keep yourself as an administrator and keep control of billing. If you use a personal account instead, share only the keys and access the project requires.

OpenRouter checklist 0 of 4

03 / Additional Services

A few more accounts, when needed.

Depending on the project, you may need another provider for payments, email, scheduling, customer records, messaging, or another business system. We identify those during scoping—not in advance.

You ordinarily own these production accounts and establish billing directly with the provider. Whether we need access depends on the integration. We will name the exact services, permissions, and costs before any work begins.

  • Payments Card payments, invoices, and payout reporting. StripeSquare
  • Business email A conventional mailbox for you and your team. Google WorkspaceMicrosoft 365
  • Scheduling Appointments, availability, and reminders. Calendly
  • Customer records A CRM for contacts, leads, and follow-up. HubSpot
  • Messaging SMS notifications and customer communication. Twilio
  • Other business systems Industry software or APIs your workflow already depends on. Named during scoping

Costs & your responsibilities

You control the provider subscriptions, payment methods, renewals, usage budgets, spending limits, account security, and the decision to continue or cancel each service. We do not make financial decisions for you or configure spending limits automatically.

Alerts

Alerts notify you when usage or a balance crosses a threshold. They help you act early, but they do not prevent an overage by themselves.

Hard spending limits

A hard limit blocks requests once the cap is reached. That can protect your budget—and can also interrupt a working application. Choose limits with expected usage in mind.

Alerts and budgets are useful together: alerts give you time to decide, and a reasonably sized hard limit prevents a surprise. No control eliminates all possibility of overage.

Additional services checklist 0 of 1

04 / Backups & Continuity

Plan recovery before you need it.

If an application stores customer records, bookings, documents, or other persistent data, a backup plan belongs in the design—not in a later emergency.

Our conceptual baseline comes from the backup design we use for our own CFLab environment. The exact implementation is sized to each project, but the principles are consistent:

  • Automated backupsScheduled copies run without someone remembering to do them.
  • Rolling retentionRecent copies are kept on a defined schedule, not just the latest one.
  • Protected backup storageBackups live separately from production, so deleting or replacing production data does not delete the copy.
  • Integrity verificationBackups are checked so a corrupt or incomplete copy is caught before it is trusted.
  • Documented restorationThe recovery steps are written down and available to you, not held only in someone's memory.
  • Periodic restoration testsA restore is demonstrated on a schedule. An untested backup is only a hope.
“A backup is not operational until a restore has been demonstrated.”

Backups are not guaranteed business continuity.

A standard backup design covers common problems such as an accidental deletion, a bad deployment, or a corrupted record. It cannot promise that every event is survivable. A Cloudflare-wide outage, loss of the provider account, catastrophic provider failure, or a coordinated attack may exceed the design.

We will not promise a particular recovery time, recovery point, retention period, or service guarantee unless we agree to it separately in writing.

Initial backup setup is part of the technical work we handle after the handoff. Ongoing monitoring, maintenance, restoration assistance, and any contractual service levels are established separately from this guide.

Backups checklist 0 of 1

05 / Ownership & Changing Developers

You're Never Locked In.

You can work with another developer whenever you choose. Ownership makes that possible; planning makes it clean.

A developer transition should not require moving accounts away from a consultant. Your domain, code, hosting, and billing are already yours. The work is handing over the operational knowledge and closing the access that is no longer needed.

  1. Invite the replacement developer

    Add them to the relevant services with the access they need. Keep your own owner access throughout.

  2. Provide repository and operational documentation

    Share the code repository, deployment notes, environment inventory, backup and restore procedures, and the location of credentials—never the credentials themselves in plain text.

  3. Confirm the new developer can build and deploy

    Have them run the build, tests, and a deployment before the previous developer steps away. Access is not the same as a working handoff.

  4. Transfer maintenance and operational responsibilities

    Make it explicit who watches backups, renewals, alerts, security updates, and support requests from this point forward.

  5. Remove the previous developer's memberships

    Remove their account from GitHub, Cloudflare, OpenRouter, and any other service where they had access. Confirm the removal took effect.

  6. Rotate keys, tokens, secrets, and integrations

    Replace deployment tokens, API keys, CI/CD secrets, webhooks, and OAuth connections that the previous developer created or could use. Removal from an account does not automatically invalidate a credential they already hold.

  7. Verify production and automation still work

    Test the live site or application, the deployment pipeline, scheduled jobs, backups, and any integrations. Fix or document anything that breaks during the transition.

Removing access is not the same as revoking every key.

Account membership and credentials are different things. A former collaborator may still hold a personal access token, deploy key, API token, OAuth authorization, webhook signing secret, or an integration they created. Review each provider's token and integration settings, then rotate what remains valid.

This guidance is available from the beginning on purpose. You should know how a transition works before you need one.

Ownership checklist 0 of 1

Questions before you start?

You do not need a technical brief. Tell Hank what you have, what you are unsure about, and what the project needs to accomplish.

Ask Hank a question

hank@aismallbizguru.com