Confidential dossier · 11 Sep 2026 · rev 2, content restored
What we hold, what we don't, what they promised, and the plan for 3:30.
The situation
custom-software-build-ownership-model SKU, tier "Business OS · Enterprise (25-50 Employees)", started Aug 5.Who we're dealing with
W-9 entity
Ops / integrations identity
Same operation by evidence: the PM emails from pmo@conversionmarketingpros.com and every access ask routes to integrations@ on the same domain. Which entity is on the contract is unconfirmed.
Developers
Zain Amir (drove the demo), Abdullah Zahid (host), PM Talha Shah (also signs as Talha Hussain). Kickoff side-chatter in Urdu and English; offshore by inference, not stated.
A small WA automation shop with a remote dev team, building a HIPAA-scope platform for a trauma-serving nonprofit. Any credential we grant would sit with a vendor-controlled Google identity, not ours.
In hand
All archived locally and outside the vendor's reach. A change in access no longer means loss of the record.
Not ours, yet
Everything here exists and was paid toward, but sits on the vendor's side. Integration credentials are not on this list, and the next slide is why.
Correction to rev 1
Rev 1 said HC had already handed Stripe, Twilio, QuickBooks and the domain to the vendor. The thread says the opposite.
"Finish the integrations (Stripe, Twilio, and QuickBooks). IF WE HAVE THE ACCESS SHARED ON integrations@conversionmarketingpros.com."
"ok, I will work to get all of these promptly." The only thing ever shared was a public brand-book link.
"we won't be publishing anything on the domain. We only need access to manage the DNS records for the email system." HC can add those records itself. No registrar access needed.
Do not grant. Confirm on the call that nothing was granted since Sep 8. If anything was, revoke it before the call ends. "Reclaim" is the wrong verb; "withhold" is the right one.
Leverage
The Sep 16/17 date is theirs, not ours. On the call, convert it: either they deliver every item on that list on that date, or that date becomes the handover date.
The website
The platform
Scoped at kickoff: AWS, HIPAA-designed, RBAC with permission matrix, MFA and audit log; donor and contact CRM; development pipeline, pledges, Major Prospect List (over $10K); events with registration, meals, card capture, QR check-in mobile app; AI page builder on brand-book colors; bulk email and SMS, social monitoring. Integrations planned: Square (thrift, ~9,000 contacts in HC's own account), Gusto, USA Fact, Plan Street migration, then Stripe, Twilio, QuickBooks.
Side-chatter, Aug 24: nothing pushed to main; "I'm asking Amazon credentials"; "I'm asking Terraform." Minutes later: "this whole platform is based in AWS." Ask for the instance URL and the commit history.
"It's not like 100% complete setup. It's not like 100% finalized product that we have built... this is the phase one call."
On screen: a contact who "has donated $13,000 in the whole lifetime" with gift history to 2024. Whose data is that, where did it come from, and where does it live now? Export, then deletion, is on the list.
Exposures
HIPAA-scope survivor data on a vendor's AWS with no Business Associate Agreement on the table. Under any path, ask whether one exists. If not, no HC data goes in until one does, or the data comes out.
On the call: "this system is actually very sensitive because we have a lot of people's... sensitive data... passwords and emails can get leaked." Meanwhile their chat attachments, including Mydas's own signed W-9 with its EIN, sit on a public, unsigned, permanent storage bucket. Hold in reserve.
Zain: "if we have zero donors... then we have to lie about it." Anja: "make sure that little database has enough to where it's not obvious." Zain: "we just essentially need people to see that someone is paying... and they trust us." Real-history replay is a donor privacy problem in a small pool. Constraint D-1: neither ships.
One principal, remote team, one PM. Ask what happens if that team moves on. Under rebuild, the answer stops mattering.
How it unfolded
Discipline
Rev 1 stated several things the archive cannot source. They may be true; they likely came from the inbox. In a negotiation, one wrong fact discounts every right one.
Plan for 3:30, under rebuild · 1 of 2
Plan for 3:30, under rebuild · 2 of 2
The bottom line
We own the expensive part: the spec, the content, the brand, the program rules. What we need from them is the data, the paper, the finished website, and a clean exit on credentials that were never granted.
The one thing to hold in mind for 45 minutes: every ask on the plan is something they already said they would give. We are asking them to keep their word, on their date.