Written contact only, first reply within one business day
Email for longer messages, Signal for short questions. No calls and no calendar links at any stage of the engagement.
Channels
Scan the code with a phone to open a Signal chat. The code image is at /signal-qr.png. Short questions go here, longer documents by email.
Signal is end-to-end encrypted. Scanning shares no account of yours.
@turva.19
Encrypted email
Mail to erik@turva.dev can be OpenPGP encrypted. Encryption is optional, and an unencrypted message gets the same reply time.
The public key is at https://turva.dev/pgp-key.asc, and it is also published for automatic discovery, so a mail client that supports Web Key Directory finds it from the address alone. RSA 4096, valid until 27 July 2036.
Fingerprint:
7D66 37F2 A37B A45F 56D6 9D3A 95D8 AE0F CEDF EE35
Compare the fingerprint against the key before you use it, because a key served over the web is only as trustworthy as the page that served it.
Response times
- Email and Signal: within one business day
- Weekends: no guaranteed response time
What to include in a first message
A useful first message includes:
- The site or API to be audited (URL)
- Any current scanner results, if you have run them
- The scope you have in mind (Shopify agent storefront check, audit, advisory, implementation, agent operations, MCP server design)
If you do not have scanner results yet, that is fine. The audit starts with running them.
Confidentiality
An NDA is signed before any material moves. Send your own and it is signed as it stands, at no charge. Production credentials are not requested at any stage, and repository write access is scoped per task and only if implementation is purchased.
Geographic service area
Based in Tampere, Finland. Service delivered remotely worldwide. All work is asynchronous and written.