Toronto web design, web apps, and cybersecurity help

Most small-business websites are slow, built on a pile of plugins, and quietly leaking data to a dozen third parties. Yours does not have to be. I build sites that load in under a second, work on a five-year-old phone, and are readable by a search engine without executing a line of JavaScript.

That last part matters more than it used to. A page whose content only appears after the browser runs a script is invisible to most AI assistants, and slow to be indexed by Google. Every site I build ships its words in the HTML, where a crawler can see them on the first pass.

The work starts with a conversation about who you are trying to reach and what you want them to do. Then structure, then copy, then design — in that order, because a beautiful page that says nothing converts nobody. You get a site you can update, hosting that does not surprise you with a bill, and no dependency on me to keep it running.

When an off-the-shelf tool nearly fits but not quite, the gap usually gets filled with spreadsheets and manual work. A custom web application closes it — a booking system, an internal dashboard, a customer portal, a workflow that only your business has.

I build these the way I build my own products. TypeScript in strict mode, so a whole category of bug never reaches you. Every input validated on the server, because everything from a browser is untrusted. Object-level authorization on every query, so one customer can never read another's data. Automated tests and continuous integration, so a change on a Friday does not become a phone call on a Sunday.

Security is decided at design time. Before code, there is a threat model: what an attacker would want, where they would try, and what stops them. That work is boring, unglamorous, and the reason the applications I ship do not end up in a breach notification. You can see exactly what that looks like — GoRich, below, is built to OWASP ASVS Level 2 and its threat model is public.

Technology gets sold to people and then abandoned by the people who sold it. When the laptop slows to a crawl, the printer stops talking to the network, or the photos from ten years ago are somewhere and nowhere, there is often no one obvious to ask.

I do that work for people in Toronto and the GTA: setting up a new machine properly the first time, untangling a home network, getting backups running so that a dead drive is an inconvenience rather than a catastrophe, and advising on what hardware is actually worth buying — which is frequently less than you were about to spend.

No jargon, no condescension, no upsell. If the honest answer is that your five-year-old laptop needs sixty dollars of memory rather than a replacement, that is the answer you will get. You will also understand what was done and why, because the goal is for you to need me less over time, not more.

Almost nobody is targeted personally. Almost everybody is caught in something automated — a password reused on a site that got breached, an account with no second factor, a phone that backs up everything to somewhere you never chose. The fixes are well understood and unglamorous, and most people never get shown them.

I sit down with you and put them in place. A password manager, set up and actually used. Two-factor authentication on the accounts that matter, with recovery codes stored somewhere you will find them. Devices configured so a stolen laptop is a lost laptop rather than a lost identity. And a clear-eyed look at which apps and services are monetising your data, with realistic alternatives where they exist.

The aim is not paranoia; it is proportion. You should be spending your attention on the handful of things that account for most of the risk, and ignoring the rest with a clear conscience. I will tell you which is which, and I will not pretend that any of it makes you unhackable — nothing does.