Turn on MFA
Use multi-factor authentication on email, finance, admin, and remote-access accounts.
QHPractical cybersecurity for U.S. real-estate businesses
Practical cybersecurity for U.S. real-estate businesses without dedicated IT.
For brokerages, agents, property managers, and eligible real-estate teams, QuillHatch checks the public protections around the email domain your clients trust. Find the gaps behind your domain, then get a calm, prioritized plan to close them.
Built for brokerages, agents, property managers, and real-estate teams that need a clear answer about the email domain clients trust.
No passwords. No scare tactics. Just the next right step.
Sample field noteQH / 001
Domain review
yourdomain.com
Prioritized
Email protection
DMARC policy needs attention
Review
Certificate
Valid · 74 days remaining
Next best step
Publish a stricter DMARC policy
A readable report, not a scan dump.
Checking access…
The useful version of secure
A calm answer to the questions that keep you up at night.
You do not need another dashboard full of red warnings. You need to know what a scammer could use, what deserves attention first, and what can wait.
01
Email identity
Start with the live domain check below. We read SPF, DKIM, and DMARC — the public guardrails that help stop impostors from borrowing your address.
Live now
02
Public-facing site
SSL health, certificate timing, and WordPress software that can quietly become an entry point.
Exposure check
03
Leaked credentials
A careful look at breach data connected to your domain, with practical next steps if something surfaces.
Breach watch
A plain-English field guide
Security basics for a smaller team
You do not need to become a security specialist to make your business harder to disrupt. Across the United States, small teams without dedicated IT are often asked to make security decisions between everything else on their list. Start with a few practical steps that improve your resilience.
01 / The exposure
Why small businesses get targeted
Small businesses are not targeted because they are unimportant. They are often included in broad, automated searches. Automated scanning and AI-assisted impersonation or phishing make it cheap for threat actors to look for many companies at once.
Limited IT capacity and exposed email or website weaknesses can create openings. That is true for HOAs, property managers, professional firms, local service businesses, and other eligible businesses—not just one industry.
02 / The disruption
Ransomware, without the mystery
Ransomware is a type of criminal disruption that can lock access to systems or data and pair that disruption with an extortion demand. Common entry points include phishing, stolen credentials, exposed services, or unpatched software.
The impact is disruption and extortion as well as financial pressure: missed work, unavailable files, pressure on staff, and difficult decisions during an already stressful event. Preparation does not make a business invulnerable, but it can improve resilience and make the next safe decision clearer.
Practical fixes
Eight small habits that add up.
Start with the accounts and systems your team relies on every day. The best plan is the one people can follow when work is busy.
Test your backups
Keep tested backups of important data in a separate place, and practice restoring a few files before you need them.
Apply updates promptly
Keep operating systems, browsers, websites, plugins, and security tools current.
Use least privilege
Give each person only the access they need, and remove access when roles change.
Make reporting easy
Tell staff how to report a suspicious message or mistake quickly, without blame.
Strengthen email authentication
Set up SPF, DKIM, and DMARC so recipients can better distinguish your mail from impostors.
Keep HTTPS and SSL healthy
Renew certificates on time and fix website warnings before visitors are trained to ignore them.
Write an incident plan
Keep a short list of who to call, what to isolate, how to communicate, and where recovery steps live.
What QuillHatch does today
A useful starting point, not a promise to prevent ransomware
QuillHatch checks public email and domain protections, public-facing site signals, and leaked-credential exposure connected to a domain. The free scan is the entry point; a paid report adds practical interpretation, and monitoring watches for meaningful changes.
That is different from general preparedness: QuillHatch does not prevent ransomware, replace incident response, or claim to be a complete security audit. Phishing simulations are not available today; they remain separate roadmap work.
Keep learning
These external guides add context to the checklist. They are general preparedness resources, not QuillHatch scan results.
How QuillHatch works
Small inputs. Specific answers. Ongoing awareness.
Built for the moment between “I should probably check that” and calling an expensive consultant.
Conservative recommendations, clearly explained
01
Tell us where to look
Enter your business domain and email provider. No passwords, installs, or technical setup.
02
Get the useful version
Receive a prioritized review in plain English: what matters, why it matters, and the safest fix.
03
Stay ahead of changes
Monthly rechecks watch for new exposure, altered email protection, and certificates nearing expiration.
A small line item for a big peace of mind
Security guidance that fits the way you actually work.
Monthly watch
$39 / month
Start with the free scan, then move to a prioritized report and monthly rechecks when you need ongoing visibility.
Prefer a one-off look? Reports are $49 limited/basic or $99 standard full; monitoring is $39/month.
Run the checkStart with the question
Could someone fake an email from your business right now?
Give QuillHatch your domain. We will show you what is exposed, what to fix first, and what to keep watching.
Check your domain