We Are Offering Companies a Free Expiration Risk Audit

We are offering companies a free expiration risk audit. It is a bounded review for teams that want a clearer answer to three operational questions: what expires soon, who owns each item, and which renewal path depends on somebody remembering it.

Here is exactly what the audit covers, what your team receives, and where the boundaries are.

What the audit can cover

The agreed scope can include up to 25 public domains or endpoints, plus one or multiple infrastructure sources or exports.

For public endpoints, we review certificate expiry and chain health. For connected sources, access is read only and limited to metadata. The review looks for:

1. assets approaching expiry;
2. missing or unclear owners;
3. renewal paths that are unknown or depend on manual memory;
4. gaps between an asset, its source, its owner, and its next action.

Automated discovery is followed by manual review of the findings. Every target must be explicitly authorized before anything runs.

We do not ask for secret values, private keys, or write access.

What the company receives

The output is meant to be usable outside our process. The company receives:

1. a one-page summary with risks grouped by severity;
2. an inventory with each asset, expiry, owner, source, and next action;
3. a separate view of unowned items and unknown renewals;
4. a 30/60/90-day plan that can be moved into the company's own tracker;
5. a 30-minute findings call.

The company keeps the report even if it decides not to continue.

What this audit is not

The audit is not a penetration test, a vulnerability scan, or a compliance certification. It is an expiration lifecycle review within an authorized scope.

That boundary matters. The goal is to identify operational gaps around expiry, ownership, and renewal, not to make a broader security claim that the work does not support.

How the process works

First, we agree on the domains, endpoints, sources, exports, and authorized contacts. Nothing runs before the scope is approved.

Next, we perform discovery in an isolated workspace and manually review every finding. We then deliver the report and use the findings call to explain the highest priority risks, open ownership questions, and practical next actions.

After that, the company chooses. It can keep the report and stop, or it can move into an optional four-week design-partner pilot. Retention and deletion are agreed in writing before the work starts.

The optional pilot

The pilot is a secondary step, not a condition of the audit. It includes four weeks of free TokenTimer access, onboarding help, one short call per week, and one real workflow. There is no purchase commitment.

The purpose is to see whether the workflow fits the team's actual environment. A company can also decide that it does not, with no obligation to continue.

Who this is for

The audit is intended for DevOps, SRE, platform, security, and infrastructure teams, as well as managed service providers and cloud consultancies.

It is especially relevant when certificate and other expiration tracking is split across several systems, automation covers only part of the estate, spreadsheets still fill the gaps, or renewal ownership is unclear.

Originally published on TokenTimer.