Taken accounts
Email, WhatsApp, social networks, or banking. Someone writes in your name and asks for a transfer.
Preventive cybersecurity
A digital security audit for your business
For clinics, firms, workshops, shops, and restaurants with 1 to 20 people. I review accounts, email, the website, backups, and the privacy notice. Always with a letter signed by someone who represents the business, and without tests that enter your systems.
Opens WhatsApp · +52 442 825 3951
- From $2,900 MXN
- Querétaro and remote
- CIS Controls v8 and OWASP
01The problem
You do not have to be famous to get hit.
In a small business, fraud usually comes through something simple to close: email without two-step verification, WhatsApp without a PIN, a site that was never updated, or a backup that was never tested.
Phishing
A message that looks like the tax authority, a bank, or a delivery company, and asks for a click or a detail.
A spoofed site or email
A customer pays, but the money does not reach you because the page or the sender was not yours.
Data that disappears
Customer or patient files with no copy, or with a copy that will not open the day you need it.
Privacy notice
Mexico’s federal personal-data law (LFPDPPP, official gazette 20 March 2025) asks for a privacy notice when you handle people’s data. This review looks at the one you already published. Drafting it is an add-on, and a lawyer should see the final version.
02Scope
What gets checked
The package sets how far the review goes. Nothing is touched without the signed letter, and on the computers the owner or their staff is the one at the keyboard.
Accounts and two-step verification
Email, online banking, social networks, and WhatsApp Business. Basic is a guided questionnaire. Standard confirms it on screen.
All three packages
Backups
Whether they exist, whether they run on their own, whether a copy is kept apart, and whether one file can be restored.
Standard and Premium
Updates
A supported operating system, patches, antivirus, firewall, disk encryption, and screen lock.
Standard and Premium
Wi-Fi and router
Encryption, a guest network, WPS, UPnP, ports, factory passwords, and firmware. Looked at from the owner’s admin panel.
Standard and Premium
Email: SPF, DKIM, and DMARC
So it is harder to send messages that appear to come from your domain.
All three packages
Website: HTTPS and headers
Certificate, security headers, cookies, a visible CMS version, exposed admin panels, and forms. This is a passive review: there is no attempt to get in.
All three packages
Personal data and the privacy notice
Basic is a quick look at the notice on the site. Standard covers the data inventory, full and short notices, sensitive data, consent, ARCO rights, and confidentiality.
All three packages
Staff and phishing
Standard includes a short conversation, with no trick emails. Premium adds a 45 to 60 minute workshop, twice a year.
Standard and Premium
03Process
How it works
Six steps. The work does not start with the chat. It starts when the letter is signed and the deposit has landed.
- 01
First conversation
Free. We see whether the service fits and which package matches. If I am not the right person, I say so there.
- 02
Letter and scope
Signed by the owner or the legal representative. It states what is reviewed, what is not, and what happens to the information at the end.
- 03
50% deposit
SPEI bank transfer. The receipt is what books the date. The other 50% is paid on delivery.
- 04
Non-intrusive review
The site, domain, and email are looked at from the outside. On computers, Wi-Fi, and the router, you or your staff operate the screen.
- 05
A traffic-light report
One page in plain language: what is fine, the main risks, and where to start.
- 06
Help fixing it
Fixes are not part of the audit. They are quoted separately, or I leave a guide. The add-ons are further down.
The report’s traffic light
- In order
- Needs attention
- Urgent
04Packages
Three ways to start
Prices in Mexican pesos (MXN), for a business of up to 20 people. A quote is valid for 15 calendar days.
There are no intrusion tests, no scans that enter your network, and no changes to your systems during the review. The audit lowers risk. It does not promise that an incident is impossible.
Basic
Diagnóstico Digital Exprés
$2,900 MXN
One-time payment
- For whom
- A business that wants to know, without a visit, whether the site, the domain, and email are exposed, and whether critical accounts have two-step verification.
- Format
- Fully remote
- Timing
- 3 to 5 business days from the signature and the deposit
- If you book Standard within the next 30 days, $1,000 MXN comes off.
Included
- A passive look at the site: HTTPS, security headers, cookies, a visible CMS or plugin version, exposed admin panels, forms, and data the page leaves in view.
- Domain: holder, expiry, transfer lock, DNS, and subdomains that are no longer used.
- Email: SPF, DKIM, and DMARC.
- Whether the domain shows up in public breach data, after checking that the domain is yours.
- A guided questionnaire on accounts and two-step verification: email, online banking, social networks, and WhatsApp Business.
- A quick review of the privacy notice published on the site.
Not included
- Computers, Wi-Fi, the router, backups, and antivirus.
- Fixing what is found.
- An on-site visit.
- Drafting the notice or giving a legal opinion.
What you receive
- A one-page report: traffic light, five risks, and recommendations.
- A list of what was reviewed across accounts, email, the site, and the notice.
- A 30-minute video call to walk through it.
Payment
- 50% ($1,450 MXN) by SPEI to book.
- 50% ($1,450 MXN) when the report is delivered.
Standard
Auditoría Integral Microempresa
$6,900 MXN
One-time payment. Up to 10 devices and 1 location.
- For whom
- Clinics, practices, firms, and businesses that hold customer or patient data and need a full diagnosis plus evidence of security measures.
- Format
- On site in the Querétaro metro area, or remote
- Timing
- 1 to 2 weeks. One visit of about 4 hours, plus the analysis and the report.
- Each extra device: $300 MXN, up to 20 devices.
- Outside the Querétaro metro area: travel costs, or the review is done remotely.
Included
- Everything in Basic.
- Devices, in person or by screen share: inventory, a supported system, updates, antivirus, firewall, disk encryption, and screen lock.
- Wi-Fi and the router from the owner’s panel: encryption, a guest network, WPS, UPnP, ports, factory passwords, and firmware.
- Backups: the process, automation, a copy kept apart, and a test restore of one file.
- Personal data: inventory, full and short privacy notices, sensitive data, consent, ARCO rights, and confidentiality.
- Incident response: an owner, contacts, and “what to do if…” cards.
- A short staff conversation about phishing. No trick emails.
Not included
- Fixing the findings. Quoted separately, or left as a step-by-step guide.
- Intrusion tests, exploitation, active network scans, or social engineering.
- Complex servers, an ERP, or custom software.
- Antivirus licenses or new equipment.
- A legal opinion. A lawyer should see the final privacy notice.
What you receive
- A full results list, using CIS Controls v8 (IG1), OWASP, and the LFPDPPP.
- A one-page report with a traffic light and the top five risks.
- A 90-day plan: this week, this month, and this quarter, with an estimated cost.
- Templates: inventory, emergency contacts, incident cards, and a one-page anti-phishing guide.
- A 60-minute results meeting.
Payment
- 50% ($3,450 MXN) by SPEI to book the visit.
- 50% ($3,450 MXN) when the report is delivered.
- Travel costs, if any, are paid with the deposit.
Premium
Protección Continua
$1,490 MXN
Per month. 12-month minimum, billed quarterly in advance ($4,470 MXN).
- For whom
- Someone who wants a trusted person watching security through the year, without building an IT department.
- Format
- Mixed
- Timing
- 12 months, renewable
- Includes the Standard audit in month one.
- Above 10 devices: $100 MXN per device each month.
- 15% off add-ons.
Included
- The Standard audit in the first month.
- Each month, from the outside: certificate and domain expiry, headers, SPF, DKIM, DMARC and its reports, alerts if the domain appears in breach data, safe browsing, and whether the site responds.
- Four reviews a year of accounts, updates, backups (including a restore test), Wi-Fi, and the privacy notice, with an updated traffic light.
- A 45 to 60 minute anti-phishing workshop, twice a year, in Querétaro or online.
- Optional, and only if the letter marks it: one educational phishing exercise a year, with no passwords asked for or stored.
- WhatsApp guidance on business hours, up to two hours a month, and a first orientation if there is an incident.
Not included
- 24-hour monitoring, a security operations center, or on-site incident response.
- Antivirus licenses, cloud backups, or equipment.
- Fixing major findings. Quoted separately.
- Intrusion tests or other offensive work.
What you receive
- The initial report, the same as Standard.
- A one-page monitoring note each month.
- Four quarterly reports with a traffic light and how things moved.
- A certificate of attendance for the staff training.
Payment
- To start: 50% of the first quarter ($2,235 MXN) by SPEI. The other 50% when the initial audit is delivered.
- Later quarters are paid in advance, within the first 5 days.
- Early cancellation: 30 days’ notice, and work already done is billed.
05Add-ons
If something needs fixing afterward
The audit does not include the fix. These jobs are quoted separately, with the same 50% SPEI deposit and the rest on completion.
Website hardening
Update the CMS and plugins, remove what is unused, two-step verification on the admin, a limit on login attempts, security headers, hidden versions, and an automatic backup.
$1,500 MXN on Torio Web sites · $2,500 MXN on other WordPress sites
Move to HTTPS
Certificate, redirect, mixed content, HSTS, and a certificate test.
$900 MXN
Privacy notice for the site
A full and a short notice from a template, published on a page and linked from forms and WhatsApp. A lawyer should review the final version.
$1,200 MXN · $1,800 MXN when there is sensitive data, such as a clinic
Safer email
SPF, DKIM, and DMARC, from p=none to quarantine, on Google Workspace or Microsoft 365.
$1,200 MXN
Two-step verification and a password manager
A guided session for up to 10 people: email, banking, social networks, and WhatsApp.
$1,500 MXN
An extra anti-phishing talk
45 to 60 minutes, up to 15 people, with Mexican examples: the tax authority, banks, and delivery companies.
$1,500 MXN per session
A one-section website
A professional Torio Web page, already with HTTPS, security headers, and a privacy notice.
$3,500 MXN
Safe Start bundle
Basic, plus the move to HTTPS and website hardening when the site was built by Torio Web.
$4,500 MXN (you save $800 MXN)
06Questions
Before you write
Is it legal? Will you hack my business?
No. Work starts only with an authorization and scope letter signed by the owner or the legal representative. The review is preventive and non-intrusive: no access attempts, no intrusion tests, and nothing that could affect operations. On the computers and the router, you or your staff are the ones who operate them.
Do I need technical knowledge?
No. The report is in plain language: a traffic light, the main risks, and where to start. If a term is needed, it is explained on the call.
How long does it take?
Diagnóstico Digital Exprés takes 3 to 5 business days. The full audit takes 1 to 2 weeks. Protección Continua is a 12-month service. The clock starts when the letter is signed and the deposit is in.
How do I pay?
By SPEI bank transfer. The work is booked with 50%, and the rest is paid on delivery. Account details are shared when the letter is signed. Torio Web does not ask for cash paid to a third party, or for a transfer to an account other than the one agreed. If you need an invoice (CFDI), VAT is added.
Do you fix what you find?
The audit is the diagnosis. Fixes are quoted separately, or left as a step-by-step guide. The add-ons on this page cover the site, HTTPS, email, two-step verification, and the privacy notice.
Do you guarantee there will be no incident?
No. The review lowers risk and writes down what is worth closing. It does not promise that an incident is impossible.
Terms
- Work starts only after the signed letter and the 50% SPEI deposit.
- You can stop the work at any time. Work already done is billed.
- A visit can be rescheduled at no cost with 24 hours’ notice.
- What is collected is confidential and is deleted at the close, as the letter says.
- This is not legal advice.
Next step
The first conversation is free.
Tell me what kind of business it is, and whether you already have a site, your own email, or computers at the office. If the package does not fit, I will say so in that conversation.
Opens WhatsApp · +52 442 825 3951