Draft for team review, not public

Security for businesses with 5 to 50 people and no IT team

The only thing that changed was the bank account number.

Same email thread. Same sender. Same invoice. Your antivirus never reads the invoice. We set up the rules that do, so a fake hits a rule before it hits your bank account.

You can't afford an IT team. You can't afford to ignore this either. You get your three biggest gaps, written down.

$2.77Blost to business email compromise in the US in 2024, across 21,442 complaints.FBI IC3, 2024
$16.6Bin internet crime reported to the FBI in 2024. A new record, up 33 percent.FBI IC3, 2024
59%of small and mid-sized firms were attacked in the last 12 months. 27 percent hit by ransomware.Hiscox, 2025

The problem

You're not bad at security. You're the accidental IT guy.

The IT guy fixes laptops. The bank sends a balance. Nobody owns the question: who can move money out of your accounts, and what stops a fake?

What it looks like

Fraud looks normal now.

It doesn't look like hacking. It looks like a normal invoice in a normal email thread, or an urgent call from someone who sounds like your partner.

Tools can't see that. A rule can: any change to payment details gets confirmed by phone, on a number you already had.

Why it works

The basics are missing.

Passwords in a shared doc. No MFA on the bank login. A mailbox rule nobody remembers setting up. Staff pasting client data into AI tools nobody checked.

Most attacks on small businesses go through email, passwords and payments. Not exotic hacks.

What we set up

Security basics and payment rules

PaymentsRules

A fake hits a rule, not a person.

  • Callback rule for any change of bank details, on a number you already had
  • Two people sign off on every new payee
  • Code word for urgent payment requests by phone or voice message
  • Daily AI check on outgoing payments: new account, odd amount, odd time
AccountsBasics

The basics insurers now ask for.

  • Password manager for the whole team, shared doc retired
  • MFA on every account that touches money
  • Mailbox rules checked for silent forwarding
  • One-page AI rule: what staff and contractors may paste into ChatGPT, and what not

How it works

First rule in days, not months.

  1. 1

    Free 30-minute check

    A short form and one call. Who can move money, how payments get approved, where passwords live.

    You get: your three biggest gaps, written down.

  2. 2

    Payment rules

    Callback rule, two-person sign-off, code word. Set up in your bank and your accounting tool.

    You get: a fake invoice hits a rule.

  3. 3

    Account basics

    Password manager, MFA, mailbox check, AI rule for the team.

    You get: the basics insurers ask for.

  4. 4

    Hand over

    We walk your team through it once and leave a one-page playbook. No yearly license from us.

    You get: it runs without us.

Old way, new way

Old way
With GooodLife
Invoices
Pay what the email says.
A changed bank number stops the payment until someone calls.
Urgent calls
"It's me, pay this today."
No code word, no payment. Everyone knows it.
Passwords
A shared doc and the same password everywhere.
Password manager and MFA on everything that touches money.
AI at work
Everyone uses whatever tool, with client data.
One page that says what goes in and what doesn't.

Your options

OptionWhat happensCostTime
Do nothingFine until the first fake invoicenothing, until it costsuntil it happens
Antivirus and hopeCatches viruses. Never reads an invoice.smallongoing
Cheap IT guy or MSPLaptops fixed. Payments untouched. Bills you can't read.monthlyongoing
Hire IT in-houseOne person doing everything$70,000+ a yearmonths to hire
GooodLifePayment rules and basics, set up in your accounts, handed overcheck is free, fixed price afterfirst rule in days

What would one wrong payment cost you?

Questions

We're too small to be a target.

Business email compromise took $2.77 billion from US businesses in 2024. It hits whoever pays invoices by email, and small firms have the fewest checks.

Security vendors want a fortune.

We set up the basics once and hand them over. No yearly license from us.

We already have an IT guy.

Good. Ask them who checks a changed bank number on an invoice. We work next to them, on payments and rules, not laptops.

Do you need access to our bank?

No. We set the rules up with you, in your accounts, on your screen. [Data path to be confirmed by the team.]

Can you promise fraud never happens?

No. Nobody can. We make sure a fake invoice hits a rule before it hits your bank account.

Also on your plate

Profitable on paper, broke on Friday?

Our finance dashboard shows your cash 12 months out and chases late invoices for you.

See the cash package →

30 minutes. Who can move your money?

We look at how payments get approved, where passwords live and what your team puts into AI tools. You leave with your three biggest gaps.

Our promiseIf the check doesn't show you at least three gaps worth fixing, you owe nothing and we tell you so.