Skip to content

Full Protection · Our Own Run

Full Protection, Run on Ourselves

We ran it on ourselves first. Full Protection stands on AnaConnectsYou itself before it is offered to any client, and this page is the protection layer exactly as it stands on November 6, 2026: the program count, the scans on file, the watches running, the standard the program holds itself to, and the proof rhythm the firm now runs on its own house. Nothing on this page is ahead of the record.

Run date: November 6, 2026 · Subject: AnaConnectsYou

The Program Today

14 of 30 Protections Done, Zero Incidents

The Security and Data Protection Report holds 30 protections, each with a tool, a status, evidence, and a next check. At the last full check on November 6, 2026, 14 stand Done, 16 stand open with their next steps recorded, and incidents this month stand at zero. The groups below are the 14, stated as they stand.

  • Two step login stands on the business email, on Square, on the domain registrar, on the website host, and on the social accounts. A password alone is never enough to get in.
  • Every domain name is locked at the registrar, so it cannot be transferred, deleted, or pointed elsewhere by anyone else.
  • Every site serves only over an encrypted connection, with plain HTTP sent straight to the encrypted address, and hourly watches verify it on every run.
  • Bot protection stands on the report form and the contact form, checking each visitor before a submission can reach us.
  • Every payment runs through Square on its own pages. We never see or store a card number.
  • Our forms ask only for what a report needs, and never for a Social Security number, an ID number, bank details, card numbers, health information, or passwords.
  • Breach alerts are on for every domain we own: three domains monitored, with zero breached addresses and zero stealer log entries at the last check.
  • ClamAV is live for file scanning on our own side.
  • The content security policy nonce hardening is live, and Mozilla Observatory grades the security headers A. The rescan rides the Monday 9:00 AM weekly scan review.
  • The first quarterly restore test passed, with 36,155 files restored and checksums 10 of 10.
  • Kit email proof landed in the inbox, with SPF, DKIM, and DMARC all passing.
  • Exa is connected and live, and the Aikido Intel public malware feeds are live.

Source: Security and Data Protection Report, last full check November 6, 2026

The Scanner Suite

The Scans on File

Exposed keys: none

Gitleaks read the whole site folder and returned 12 matches. Every match was read and classified, and none is a credential exposure.

Source: Full Scan Report, AnaConnectsYou, November 6, 2026.

Code review: 7 items, none an error

Semgrep read 348 source files and returned 7 review items in server side files. They stand logged as fix items and close only when a rescan proves them gone.

Source: Full Scan Report, AnaConnectsYou, November 6, 2026.

Parts: clean after the fix

OSV Scanner first read 503 parts and found 2 with known weaknesses. Both were fixed the same day, and the rescan of 501 parts found no issues.

Source: Full Scan Report and the dependency fix record, November 6, 2026.

Grades: A+ and A

SSL Labs grades the transport layer A+ with no warnings. Mozilla Observatory grades the security headers A. The CSP nonce hardening is live. The rescan rides the Monday 9:00 AM weekly scan review.

Source: SSL Labs assessment and MDN Observatory scan 133881017, November 6, 2026, and the current program record.

Malware checks live

ClamAV is live. Aikido Intel public malware feeds are live.

Source: Security and Data Protection Report on file.

The one lane that did not run

The OWASP ZAP live site scan could not complete its connection through the network path of this machine, so it produced no findings and none are claimed. The lane is queued for the weekly scan review rather than hidden.

Source: Full Scan Report, AnaConnectsYou, November 6, 2026.

Always Watching

The Watches Running

  • Site health watch on anaconnectsyou.com, every hour. Healthy on every run today, November 6, 2026.
  • Site health watch on guidedhealers.org, every hour. Healthy on every run today, November 6, 2026.
  • Email watch across the business and personal mailboxes, reading for anything that needs the founder, with safety blocks enforced on sight.
  • Domain and email health watch every Monday, covering the authentication records on every domain that sends email.
  • Weekly scan review every Monday at 9:00 AM Eastern, first run November 9, 2026, carrying the scanner lane fix, the grade rechecks, and the Mozilla Observatory rescan.
  • Intelligence cycles twice every weekday, at 7:30 AM and 3:30 PM Eastern, with the Update Watch pull at 7:00 AM on weekdays from November 9, 2026.

The watching that never stops

AnaConnectsYou protects through its own work: the verified record, the fixes, the systems built right, and the proof that follows under the continuing watch. The continuous watch itself is held by the small number of trusted partners the firm prefers its clients to. Outreach to one such partner was sent on November 6, 2026. It is outreach, and it is recorded as outreach; no partnership is claimed until one exists.

The Standard

What This Program Holds Itself To

  • Client files stay off public scanners. Files are scanned on our own side, under our own authority.
  • Our own systems are scanned on our own authority. A client system is scanned only with a signed permission form from that client naming the domains and repositories, under Fla. Stat. s. 815.06.
  • Leaked passwords are never kept. They are pointed to, never stored and never repeated.
  • Grades and counts are published exactly as the tools return them. A blocked lane is recorded as blocked, never as passed.
  • The words bank level, military grade, fully secure, certified, SOC 2 compliant, and HIPAA compliant never appear as claims about this firm. Our one certification sentence is the SBE record, stated with its vendor numbers and dates.
  • Threat lookups run as internal checks. A source whose terms bar use inside paid reports is never used inside one.

The same watch, run on ourselves

The firm runs the same rhythm on itself that a Full Protection client receives. The Monday security check updates the protection report every week. The report itself refreshes on the first of each month, with its next full review on February 5, 2027. Uploaded files are erased 90 days after delivery, and every erasure is logged. What is done is shown, with its date and its proof, and what is open is shown beside it.

Source: Security and Data Protection Report, kept weekly, refreshed monthly

Still Open

Open Items, Stated Exactly

16 of 30 rows still open

The program stands at 14 of 30 protections Done. Each of the 16 open rows carries its own next step and next check date in the Security and Data Protection Report. A row moves to Done only with a date and proof.

Cloudflare in front of the sites

That DNS move is the founder decision, held until she makes it. In the meantime the host provides denial of service mitigation and the encrypted transport graded above.

Signed

This run was performed on AnaConnectsYou by AnaConnectsYou, and its counts are stated exactly as the program record holds them.

Ana Vasquez, M.A. Ed.

Signature

Date

Date signed