Confidential dossier · 10 Sep 2026

The Helping Captives build

What we hold, what we don't, and the plan of attack.

Prepared for Mick Olinik, CTO Decision point Fri 11 Sep call Source authorized read-only recon

The situation

We own it on paper. We hold almost none of it.

01Two deliverables, one vendor. A public website (nearly done, unpublished) and a back-office "Business OS" platform, bought on the "custom-software-build-ownership-model" SKU.

02Ownership is theoretical. We have the client chat portal and the deliverable files. Not the code, the cloud, or a login to the actual platform.

03The vendor is small. One Washington founder fronting the work; the build is executed by an offshore dev team.

04Friday is about possession, not praise. Convert paper ownership into an actual handover, with the unpaid half of the fee as leverage.

Who we're dealing with

One founder, two brand names, an offshore build.

MYDAS AI PLLC

Contract / W-9 entity

Where: Liberty Lake, WA
Tax: PLLC, S-corp
EIN: 42-4062875

Conversion Marketing Pros

Ops / integrations identity

Brandon Burgan's second brand, same WA person. Holds every integration grant we have given.

The build team

Offshore developers

Zain Amir, Abdullah Zahid, PM Talha Shah. Kickoff side-chatter in Urdu (Pakistan).

A young, one-founder WA automation shop with an offshore dev team, building a HIPAA platform for a trauma-serving nonprofit. Every access we grant points at integrations@conversionmarketingpros.com, a vendor-controlled identity.

In hand

What we control today

The full project chat all 59 messages, verbatim

Kickoff recording + transcript 111 min, the platform spec

Website content all 30 pages captured

Brand masters vector logos + 31pp brand book

Survivor program ruleset the safe-house doc

Vendor W-9 signed, for the file

All archived locally and outside the vendor's reach. A change in access no longer means loss of the record.

Not ours, yet

The half that matters is still theirs.

Source code / git repo no access, no copy

The AWS account runs in the vendor's cloud

Terraform config + state the keys to the infra

A platform login never issued to us

The database schema + data, no export

Env secrets & keys all vendor-held

Integration credentials pointed at the vendor

Website repo + Vercel vendor-held

This is the Friday list. Everything here exists and was paid toward, but sits on the vendor's side.

The website

Close, but the money and the survivors don't flow.

30

pages designed and written

0

working payment integrations

0

our logins to the platform

LIVEThe public helpingcaptives.org is still the old HubSpot site. The new build sits only on staging, frozen at a Sep 4 version.

GAPSDonate has no payment processor. The contact form is a dead-end mailto. The survivor program page Anja keeps asking for still isn't built.

CLAIMThe "lot of changes" cited Sep 7 appear on no surface we can see. Ask for the preview link Friday; it tests the claim.

The platform

A demo, not yet a delivery.

From the kickoff, it is architecturally ambitious: AWS, HIPAA-designed, role-based access with MFA and audit log, a donor CRM, a development and pledge pipeline, a Major-Prospect list, an events system with card-on-file and QR check-in, an AI page builder, and bulk email and SMS.

The unknown that decides everything

How much of that is working code versus a clickable demo. This recon cannot see it from outside. Repo access settles it.

The exposure

It will hold survivor records and donor card data, HIPAA scope, on the vendor's cloud, and we cannot even log in.

How it unfolded

Aug 5 to Friday

Aug 5–6Kickoff. Project thread opens; first website mockup on staging.

Aug 12–14Requirements. Anja sends brand book, nav, page list, assets.

Aug 24Platform demo. 111-min call; we approve the direction.

Aug 28–Sep 7Access asks. Mydas requests Stripe, Twilio, QuickBooks, domain.

Sep 2–3Mick added to the client portal; ownership questions begin.

Sep 11Decision call. The Mydas path gets decided, and access could change.

Flags

What to watch

Credentials with the vendor

Stripe, Twilio, QuickBooks, domain all route to a Burgan-controlled Google identity, not us.

Survivor data, HIPAA scope

Sensitive records plus donor payments on a vendor cloud we do not own or control.

"Social proof" pop-ups

Donate-page pop-ups planned. Anja steered them to real donors. Confirm it ships that way.

Key-person continuity

One founder, offshore team. Ask what happens if that team moves on.

Plan of attack

Friday: possession, not praise.

1Lead with their own wordsThe SKU literally says "ownership model." Ask to document the handover, not re-litigate the relationship.Friday

2Demand the handoverRepo, AWS, Terraform + state, secrets, database, a platform login, website repo and Vercel.Friday

3Reclaim the integration identitiesRe-point Stripe, Twilio, QuickBooks, DNS off conversionmarketingpros.com onto admin we own.Friday

4Hold the leverageTie the unpaid balance to verified handover milestones, not dates.Leverage

5Get eyes on the code, then chooseThe one unknown recon can't resolve, and the hinge for buy versus rebuild.Next

The bottom line

Get possession. Then decide.

We own the expensive part already: the spec, the content, the brand. That is the leverage, and the freedom to walk if the code is weak.

The one open question, and the whole reason to secure repo access Friday: how much real, sound software actually sits behind the demo. Answer that, and buy-versus-rebuild answers itself.