Managed IT team and contractor vetting: Who works here, and how everyone is vetted.
Nobody touches your systems until you have been told their name and they have been through every step below. That rule does not bend as the team grows, and the team is growing: contractors and technicians are being brought on to support managed IT clients.
Why the client list grows slower than the demand
Three founding spots is what can be supported properly while the team is built out around them. Taking a fourth today would buy you the thing everyone complains about: an MSP where the person who knows your setup is never the one who picks up. So the order is deliberate, vetted people first, then the fourth client, and you get the version of this that still has time for you.
The people we bring on are developers, designers and operations engineers working under SentinelGrid's Independent Contractor Agreement, plus technicians for client support work. Some of the same discipline that runs our software runs the hiring: nothing is informal, everything is written down.
The vetting process
Every contractor or technician who will work on a client environment goes through all of it. No step is skipped for someone we happen to know.
- Identity verified. Government ID checked against the person, and tax paperwork (W-9 or W-8BEN) on file before any work starts.
- References checked. Previous clients or employers contacted directly, not just listed.
- Technical assessment. A paid, scoped piece of work on our own infrastructure, never a client's, reviewed before any client engagement is offered.
- Signed Independent Contractor Agreement. Confidentiality that lasts indefinitely for credentials, personal data and security information; access limited to the engagement; a written prohibition on looking at data the job doesn't touch, which in a client environment is also the law (CFAA; § 815.06, Fla. Stat.); no malware, backdoors or undisclosed telemetry in anything delivered; and a 24-hour duty to report any suspected security incident.
- Regulated-data duties flow down. If a client has a HIPAA, PCI DSS, CJIS or FERPA addendum with us, the contractor receives a copy and is bound by it. For CJIS work, fingerprint-based background checks and security awareness training are completed before any access, and the statement of work says so.
- Shadowed first. First client work is done alongside an established member of the team, with the client's knowledge, before independent access is granted.
How access works
- Named to you first. You are told, by name, who will have access to your environment before they have it, and you can say no.
- Per engagement, least privilege. Access is issued for the specific work, to the specific systems, at the lowest level that does the job. Never a shared admin login.
- Logged. Remote sessions on managed devices are initiated by a named person and logged: who, when, how long.
- Revoked on exit. When the engagement ends, access is removed the same day, on the same joiner, mover, leaver discipline we run for your staff.
- No minors in client environments. Contractors under 18 may work on SentinelGrid's own projects with parental consent; they are never given access to a client's systems or data.
- Accountable to you through us. Contractors work for SentinelGrid, not for you directly; we remain responsible for their work under your agreement, and the same liability terms apply.
What you'll see change
As people are brought on, the build status row for the team moves, your monthly report names who worked on what, and if you're a founding client you're told before anyone new is assigned to you. If we ever bring on someone in a role that changes who is accountable for your service, you'll hear it from us directly, not from a footer.
Want to work with us? Contracting enquiries go to sales@sentinelgrid.us.