Managed IT roadmap · updated 9 October 2026: What's ready and what isn't.

Customer portal, support console and email-to-ticket intake, in production at support.sentinelgrid.us with real tickets from two organisations, ours and a customer's. A client can also run their own IT desk inside it, with roles they define themselves, instead of routing to us. This piece is finished.

Remote management server running in production. Per-client separation is no longer the thing beta is for. It shipped and was verified: each client gets their own space with a boundary they cannot see across, provisioned from the admin console, and the administrator account is behind 2FA. The host reports in by dead-man's switch and has been rebuilt from its own backup to prove it survives losing its disk.

An optional add-on: a client covers some or all of its people, and they ask for help with their own laptop or phone from the support portal. Those tickets are private to the employee and us. Their company sees how many there were, never what they were about, and the company's own IT staff cannot open them. Help is a one-time remote session the employee starts themselves, and nothing stays on the device afterward. Live in the support desk since October 1, 2026.

Live at status.sentinelgrid.us. Each service is checked on its own schedule, every three to five minutes, by a scheduler that wakes every two. Outage alerts go out by email and to a phone. The phone service we used lapsed on 28 September, and for four days alerts arrived by email only. Its replacement, a notification server we run ourselves, was switched on on 2 October. The old route was tested end to end, including deliberately waking someone at 2am to confirm it does; that test has not been repeated on the new route yet, and this sentence changes when it has. Private infrastructure reports in by dead-man's switch, overnight noise is held and delivered as one summary, and per-client branded status pages are already running for more than one organisation.

Live at portal.sentinelgrid.us. It is one sign-in for tickets, status and your records, and where agreements are signed. Now multi-tenant: access scoped to your company, managers you appoint yourself, your own service status, and a verified single sign-on handoff into the support desk so you are not signing in twice.

Rehearsed end to end against our own infrastructure before it was ever offered to anyone, and the branded report template prints clean at both A4 and Letter. Three questions are fixed headings in it, so no report can ship without answering them: what happens if the main machine dies tonight, who can get into what and should they, and the single thing most likely to hurt you first. You keep the report whether or not you hire us.

Beta rates for all four plans are published and written into the service terms. Held 24 months.

Version 1.0 is written and signable: the Founding Client Agreement and the Simple Client Agreement, plus HIPAA, PCI DSS, CJIS and FERPA addenda. Response targets are in both, along with a written definition of what counts as a "response", and there is an agreed and tested out-of-hours route to reach us when the thing that is down is us. Independent legal review is still outstanding, and there is a row for it two rows down. Revised with beta clients, not at them.

Our administrative consoles sit behind Cloudflare Access rather than a password on the open internet, with an offline break-glass credential that has been tested. We hold ourselves to this before asking a client to adopt it, which is also why the client-facing version of it, at the bottom of this table, is still marked planned.

Device inventory and remote access are live per client. This row used to say the hardening itself was a documented runbook a human walks rather than automated policy. That is no longer the whole truth. It is a platform in production on two estates: the shop computers at Zych's Certified Auto and our own. Our own fleet has no computers enrolled at the moment, so in practice that is one estate today, not two. Machines enrol themselves (at Zych's, straight from an image) and come back with their accounts, applications and policies; screen lock, USB storage, AutoPlay, the firewall, Remote Desktop, SmartScreen and automatic updates are enforced and put back within five minutes of anyone changing them; antivirus (Microsoft Defender on Windows, ClamAV on Ubuntu) installs itself on every machine and reports what it has stopped, and an application we ban is refused on every machine; and every machine reports its own health, including whether the fleet's own work took. Automatic driver and firmware updates now run on every computer at Zych's, one at a time, and have applied their first real firmware (Secure Boot certificate updates on one laptop). On the one Dell, the maker's own update tool failed to install, so that machine gets Windows Update drivers only for now. It stays in build rather than operational for one reason: both estates are ones we set up ourselves, and pointing it at a client environment we did not build is the remaining work. Disk encryption and MFA enforcement are still runbook items everywhere.

The agreements above were drafted in-house and have not yet been through an outside attorney; a flat-fee review has been requested from Florida counsel. SentinelGrid has not yet incorporated, and the liability cap in the agreements has not been independently reviewed. When that changes, this row and the agreement version number both change.

A second person joined in August, on marketing and advertising rather than client systems. Client environment access has not yet been extended beyond the founding team. Contractors and technicians are being brought on under the published vetting process, and clients are told by name who has access to their environment before they have it.

Not started. The audit report template exists and reports go out as a PDF by email; assembling them automatically inside the portal is a later build, shaped by what the first clients want to see. This row previously said "in build", which was generous. No code had been written, so it has been moved back to planned.

Not built. Until it is, we configure and verify a backup product you own, by hand. The pipeline is designed and deliberately gated on a first client: object storage with a scoped per-client token, encrypted backups, the job wrapped in a dead-man's switch, and one real restore performed before anything else proceeds. We will not claim a backup works until we have restored from it in front of you.

Designed, not built. We run this on our own systems already; rolling it into a client's environment is a different job and has not been done. Until it is, access reviews there are a manual, documented process.