guava

How Guava keeps your systems and data safe

You give me access to your tenant, your data and often your clients’ data. This is how I handle it, and it goes into writing before work starts. Last updated November 3, 2026.

Access

  • Your accounts stay yours. You own every account, line of code and license I set up.
  • I use the narrowest access that works, and I log what I touch.
  • Admin access goes back to you at handover.
  • Every Guava account, from Google and Notion to GitHub and the AI tools I work in, uses multi-factor authentication.

Your data

  • Your data stays in your accounts wherever possible.
  • Every Rollout starts with an AI Security Check: oversharing, shadow AI, and which AI tools can see your data. On Microsoft 365, it fixes oversharing and sets sensitivity labels before Copilot can see anything.
  • Ongoing Optimization & Governance keeps an inventory of the AI tools, connectors and agents your team uses.
  • My own AI usage is public on the Live AI Dashboard: model requests and tokens, with sensitive values masked before storage. Prompts and responses are never captured.

Paperwork

  • Every engagement is covered by an NDA, and I’ll sign yours.
  • I’ll sign your data processing agreement (DPA).
  • I’ll fill in your vendor security questionnaire before you sign.
  • Every engagement has a written scope and a fixed fee.

AI Red Teaming & Penetration Testing

I test the systems your team and clients rely on, including the AI you’ve rolled out. Priced after a scoping call, as a fixed fee in writing.

AI red teaming
Assistants, agents and Copilot setups, tested for prompt injection, data leakage and oversharing.
Priced after scoping
Web apps and APIs
Client portals, internal tools and the APIs behind them.
Priced after scoping
External network
Internet-facing hosts, VPNs and remote access.
Priced after scoping
Microsoft 365 and cloud configuration
Entra ID, conditional access, SharePoint sharing, and Azure and AWS settings.
Priced after scoping

How it works

  1. A scoping call: what’s in scope, what’s off limits, and when testing can run.
  2. Written authorization and rules of engagement, signed by someone who can approve testing of every system in scope. No testing starts without it.
  3. Testing inside the agreed window.
  4. A written report: each finding ranked by severity, with how to fix it.
Book 20 minutes

Report a security problem

If you find a security problem on this site or in guava-stack, email romeo@workwithguava.com.