Before you build anything, secure what it sits on. Every app, automation, and agent in this academy runs on top of three things: your email, your AI subscription, and the laptop or phone in front of you. Those are the real front door. A leaked password on any one of them undoes every other lesson here, because whoever gets in can reset your other accounts and impersonate you to your customers or donors.
This is not about becoming a security expert. It is six habits, most of them a one-time setup, that close the doors that get walked through most often: reused passwords, missing two-factor, an unlocked laptop, no backup, and secrets pasted somewhere they should not be. None of it is scary, and none of it takes more than thirty minutes.
Reused passwords are the single biggest cause of account takeover: one site gets breached, and the same email and password get tried everywhere else. Any reputable password manager fixes this. The built-in ones count: Apple Passwords on iPhone and Mac, Google Password Manager in Chrome. If you already pay for 1Password or Bitwarden, use that instead.
Turn it on, let it generate a unique password for each new site, and let it save your existing logins as you use them. You do not need to change every password today. Start with email, AI accounts, banking, and your domain registrar.
Two-factor means a password alone is not enough to log in; you also need a code from your phone or a physical key. Turn it on for these five, in order: your email, your AI subscription, your domain registrar, your payment processor (Stripe, Square, PayPal), and your cloud hosting account.
When a site offers a choice, prefer an authenticator app or a passkey over a text message. SMS codes can be intercepted by a SIM swap; an app or passkey on your device cannot.
Three settings, all one-time:
You need two kinds of backup. First, an automatic cloud backup for your computer as a whole (iCloud, OneDrive, or your device's built-in option), so a lost machine is not a lost business.
Second, for project folders your agent works in, ask it to set up git:
Put this folder under git and commit everything that is here now.
Approve it, then ask for a fresh commit at the end of each work session. Git gives you a restore point for every file your agent touches, separate from your general cloud backup.
Two habits, because your agent sees everything you paste:
.env, and tell your agent to use "the key in .env" instead of typing the key itself. The agent reads the file when it needs it, and the key never lands in your chat history.Set a recurring quarterly reminder. Each time it fires, spend 20 minutes on three things: who still has access to what (remove any login or team member who should not have it), which accounts are missing two-factor (add it), and what your recovery email and phone number are set to on your most important accounts (make sure they are still yours). The template below turns this into a checklist so you are not starting from a blank page each quarter.
Your password manager is turned on and saving new logins automatically. Email, your AI subscription, your registrar, your payment processor, and your hosting account all have two-factor turned on. Automatic updates and disk encryption are on. You have one automatic cloud backup running and git set up in at least one project folder. And you have a quarterly reminder on the calendar for the 20-minute audit.
That is the whole foundation. Everything else you build in this academy sits on top of it.
Template included: Members get the quarterly security audit checklist (printable, one page) and a "which accounts need two-factor" table with rows for both a small business and a nonprofit. Find it in your member dashboard under Templates.
Short on time? Alliance Optimal will implement this end to end, wired into your stack, and hand you the keys.