Identify what is vulnerable
Review supported evidence of weak access controls, exposed sharing, unapproved information routes and missing monitoring. Separate a confirmed condition from a question that still needs checking.
Explore AssessmentPLEASANTWORKS SHIELD
Identify vulnerabilities.
Fix what matters.
Protect patient confidentiality.
Shield is a private, AI-connected cybersecurity defense system in development. It is designed to help your practice find weak points in staff access, patient-photo sharing, intake and connected tools—then coordinate authorized fixes and check the result. Patient confidentiality stays at the center.
Business inquiries welcome · Shield services are in development · View current availability
FICTIONAL REPORT EXAMPLENot a live dashboard
What needs attention?
A future owner report would make both findings and unanswered questions visible.
- Staff accounts
- Access review needed
- Patient-photo sharing
- Permissions not checked
- Website forms
- Destinations not assessed
- Backups
- Restore test not verified
Illustrative states only. No practice has been assessed by this page.
01 / IDENTIFY. FIX. PROTECT.
Clear risks.
Practical action. Patient trust.
The product is designed for med spas, aesthetic practices and compatible wellness clinics. It works around existing IT and security tools, with scope and availability confirmed before delivery.
Fix what matters
Prioritize the issue, assign the authorized practice lead or IT provider and define the permitted change. Check fresh evidence afterward; an attempted fix is not a verified correction.
Explore RespondProtect patient confidentiality
Keep patient photos, records and communications tied to their permitted purpose and audience. Continue reviewing changes and coverage gaps within the agreed service scope.
Explore PrivacyPATIENT CONFIDENTIALITY & PRACTICE PREPAREDNESS
Protect patient trust.
Keep your practice prepared.
A patient-information exposure can leave your team dealing with more than an IT repair. Shield’s design brings evidence, ownership and corrective steps together, giving security work and any necessary privacy or legal review a clear starting point.
Know what was observed, what remains uncertain, who owns the correction and whether it was verified. If specialist review is needed, preserve the facts rather than rely on a reassuring dashboard.
- Patient information, with purpose
- Review the access and sharing paths around clinical photos, records, messages and intake. Clinical care, marketing and AI use keep their separate permissions.
- A record of the work
- Retain the source, timing, assigned owner, permitted correction and verification result. Missing evidence and unresolved gaps stay visible.
- The appropriate adviser, when needed
- Surface questions for the practice’s responsible privacy or legal adviser. Security support is not legal advice or a guarantee of compliance; obligations depend on the actual facts.
02 / THE SHIELD APPROACH
Monitor → Understand → Assign.
Correct → Verify.
- 01
Monitor
Collect the agreed information from tested connections. Show when a source is missing or out of date.
- 02
Understand
Review what happened, what it may mean and what is still unknown. Optional AI assistance must follow the approved data rules.
- 03
Assign
Give the next step a named owner: your team, your IT provider or a separately agreed specialist.
- 04
Correct
Make only an authorized change, with the practice’s clinical and operational needs considered.
- 05
Verify
Check fresh evidence that the specific fix worked. Keep unfinished work visible.
03 / FOUR SCOPED SERVICE OPTIONS
One product.
The right scope for your practice.
Service options remain inactive and individually quoted. Included systems, human review and action authority depend on a written agreement and delivery acceptance—not practice size alone.
Private Security Assessment
A bounded system and information-path review, supported findings, prioritized corrections, named owners and a verification plan.
Explore AssessmentShield Monitor
The Private Cybersecurity Monitoring System design: qualified sources, coverage health, reviewed cases, follow-through and recurring owner reporting.
Explore MonitorShield Respond
Scoped containment and correction coordination, exact action authority, fresh verification and specialist incident handoff.
Explore RespondExtended Assurance
Separately scoped vendor reviews, access or recovery exercises, secure-development checks or extended coverage. Each addition needs its own qualification.
Explore Extended AssuranceCURRENT PRODUCT STAGE
A working foundation.
A defined path to delivery.
What is implemented—and what still needs acceptance?
Local implementation is meaningful engineering evidence, not evidence of live protection at a customer practice.
- Working local prototype
- A Go/PostgreSQL monitoring service retains fictional events, cases and coverage gaps. Three synthetic confidentiality workflows, a monitoring-health scheduler and generated owner reports are implemented locally.
- Implemented reference controls
- The TypeScript reference includes source-bound knowledge retrieval, permission-constrained model routing, a persisted synthetic request lifecycle and validated case-assistance outputs. No live model is called.
- Separate live acceptance
- Real vendor connectors, production deployment, provider-native changes and staffed service delivery remain unqualified. The additional legal/privacy and publication layers are specifications, not activated services.
FOR A CLOSER LOOK
Security first.
AI as permitted assistance.
Shield’s product design connects security evidence, human review and optional AI assistance. Its technical category is Private, Secure AI-Connected Cybersecurity Defense System.
Access and data-use rules remain independent of a model’s suggestions. People authorize consequential actions; processing destinations and terms need review before deployment.
PRODUCT CAPABILITIES
From the public website.
To the people behind it.
Explore all eight service areas
The product specification covers these areas; each live capability must be qualified for the actual systems in scope.
- Internet exposure
- Enrolled websites, domains and approved remote-access surfaces. Match observed software and configuration to applicable advisories; an exposed service is not proof of compromise.
- Identity and business email
- Supported sign-ins, privileges, forwarding and staff or contractor departures. Review who retains access and who is responsible for correcting it.
- Patient media and record access
- Sharing settings, external links and supported access/export metadata. Clinical photographs, scans and renders keep their source, purpose and permission context.
- Websites and intake
- Trace agreed form destinations and third-party transfers with fictional submissions. Distinguish an observed transfer from a configuration that needs review.
- Marketing and AI use
- Compare the asset, approved purpose, recipient and destination before publication or transfer where a reliable integration exists. Treatment permission is not marketing or model-training permission.
- Devices and recovery
- Use existing endpoint, device-management and backup evidence. Separate a successful backup job from a tested restore and necessary clinical availability.
- Monitoring health
- Surface stale sources, permission loss, missing event ranges, backlog and failed test signals. No alerts is not the same as no risk.
- Investigation and response
- Connect evidence, responsible people, permitted corrections and fresh checks. Keep accepted risks, incomplete changes and returning issues visible.
YOUR NEXT STEP
Identify the weak points.
Plan the next step.
Tell us which systems your practice uses and what you want to protect. We’ll discuss the relevant scope, readiness and responsibilities before any work.