Product
Oduor Web Services
Web, email, and automation infrastructure for small businesses

The problem
Small businesses need a credible web presence and working email, but the gap between a template site and a properly configured domain — SPF, DKIM, DMARC, deliverability — is where most of them get stuck.
What I did
- 01
Standardized a deployment path so a new client site ships without bespoke infrastructure work
- 02
Automated DNS and email configuration, including the authentication records that determine whether mail actually lands
- 03
Built an AI lead-qualification agent on the Claude API to triage inbound enquiries before they reach a human
- 04
Documented client onboarding as a repeatable process rather than tribal knowledge
- 05
Moved the site off GitHub Pages, which cannot set a single response header, onto Cloudflare Workers static assets — so login, signup and the admin now ship with a strict CSP that allow-lists each inline script by its SHA-256 hash, plus HSTS and clickjacking protection
- 06
Rebranded the studio as the Rafiki dot — monochrome, Geist, one cobalt accent — with dark mode, a ⌘K command palette and an estimator that prices a package before the first call
- 07
Made colour contrast a build gate: it reads the palette straight from the theme code and fails the build on any accent that misses WCAG AA, across 182 pairs in seven themes and both modes
- 08
Rebuilt the admin as a console whose Today view pulls the overdue invoice, the open ticket and the unread lead into one list, ordered by how long each has waited
After the rebrand

Fixed-scope packages with the price stated up front. 
The estimator prices a package, with a delivery window, before anyone books a call. 
A ⌘K palette that jumps to any page, service or section. 
Dark mode, with every accent checked against WCAG AA at build time.
Outcome
Live client sites in production with working, authenticated email
Onboarding reduced to a documented sequence instead of ad-hoc setup
Nine fixed-price services, from domain setup to Stripe payments, with a build that fails if the copy's service count drifts from the list
Found and closed a database policy that let anyone holding the public key read every registered user's email, name and role — by introspecting the live schema rather than trusting the documented migration
Built with
- Cloudflare Workers
- Supabase (Auth, Postgres, RLS)
- Stripe
- GSAP
- Google Workspace
- DNS / SPF / DKIM / DMARC
- Claude API