Decision brief · 11 Sep 2026 · rev 2, content restored

Inherit their code,
or rebuild what we own.

The engagement is on an ownership footing. The question is which path is fastest, safest, and most in our control. The answer is rebuild, and this deck is what we take with us.

Prepared for Mick Olinik, CTO Companion to the build dossier

The call, up front

Rebuild. It's the fast move, not the slow one.

With the spec, content, and brand already in our hands and a CTO who ships at speed, rebuilding on infrastructure we own is the fastest to a working system, the most in our control, and the lowest risk. The conventional "rebuild takes months and a new team" math does not apply here.

Fastest

A focused scope beats auditing, detangling, and babysitting a codebase we have never seen, then enforcing a handover that can stall. On demo day the infrastructure was still being requested.

Most control

Total ownership from line one. No handover to litigate, no accounts locked to a vendor identity, no BAA to negotiate with a third party.

Least risk

No inherited unknown debt. HIPAA-clean by design. Survivor and payment data on infrastructure we hold. No key-person exposure to a remote team we cannot see.

Why the usual math is wrong here

The expensive part is already done and owned.

SPECThe 111-minute kickoff is a finished requirements document, module by module, with Anja's approvals and her operational asks on tape. Full transcript in hand as of Sep 11. The costliest, slowest part of custom software is deciding what to build. That is done.

ASSETSAll 30 routes of content, Anja's own IA and page list, the press and podcast inventory, the vector brand masters, Program Considerations. Nothing to re-create, only to re-implement.

VELOCITYAn AI-native builder who ships production sites fast changes the cost curve. Rebuild time is measured against our own throughput, not a vendor's Sep 16/17.

SCOPEA rebuild is scoped to what HC needs, not the everything-platform an "Enterprise (25-50 Employees)" tier pushes. Less to build than what was sold.

How the options really compare

The matrix, corrected.

Dimension	A · Continue	B · Inherit in-house	C · Rebuild
Time to live	Their date	Handover drag	Fastest
Control	Low	High	Total
Real cost	Balance + ongoing	Handover + learning	Our build time
HIPAA / BAA	No BAA seen	Audit-bound	By design
Vendor dependency	High	Cut, after handover	None
Inherited debt	Theirs, unseen	Theirs, unseen	None

Once build velocity is the CTO's own, C stops being the slow option and becomes the one that wins nearly every row.

The three paths, reframed

One recommendation, two fallbacks.

Recommended

C · Rebuild

Take the spec, content, brand, and data; build fresh on stacks we own. Fastest and safest given our velocity.

The call

Fallback

B · Inherit in-house

Only if a look at the code reveals something genuinely worth keeping. Then take repo, cloud, Terraform, keys, and own it. Note: none of us has ever seen the code.

Bridge only

A · Continue with Mydas

A short bridge while data moves, never the end state. It keeps survivor and donor data on a vendor cloud with no BAA.

The starting line

What we are rebuilding from.

Platform spec, from the kickoff

RBAC with a permission matrix and MFA on by default · donor and contact CRM with lead ownership · development pipeline, pledges, Major Prospect List (over $10K) · task automation on rules ("payment failed, form submitted, event registered, amount over $1,000," routed to the record owner or a team, claimable) · receipts for card and ACH · reports incl. per-employee, PDF export · subscriptions tracking · documents hub with client-file attachments · Gusto onboarding, USA Fact background checks, QuickBooks, Plan Street export before cancel.

What Anja actually asked for

Events: a buyer of four tickets enters four emails; each guest completes their own card and meal choice; reminder emails to anyone incomplete at a month, two weeks, a week out; tables and hosts; live auction with bid raises. Marketing must not see leads or donors (leads live under development). SMS is broken today: Virtuous tagged every number "home," so nothing can be texted. Square thrift sales and contacts auto-pulled. Social monitoring. EMR is "an entirely different beast," explicitly out of scope.

Build first

Website (content in hand), online giving (recurring-first, honest campaign progress toward the Oct 14 gala), a lean donor and contact record, survivor intake. The things that move money and serve people.

Defer or drop

AI page builder, social-proof pop-ups (constraint D-1: rejected outright), full events and auction suite, deep marketing automation. Add only if a real need proves out.

Rebuilding does not mean walking away empty

We still take the parts that matter.

A rebuild forfeits their code, which was never the valuable asset. Everything worth having transfers regardless, and most of it should be asked for today.

The data they actually hold

Every record in the platform: the demo's contact and donor records (a real "$13,000 lifetime" donor was on screen), anything migrated from Plan Street, HC's own intake form. The ~9,000 thrift contacts are in HC's own Square; the import never happened. Export, then written deletion.

The credentials: withhold, not reclaim

Nothing was granted as of Sep 8 (Talha: "IF WE HAVE THE ACCESS SHARED"; Anja: "I will work to get all of these"). Do not grant. Confirm. Revoke anything since. DNS email records HC adds itself.

The paper

Signed agreement, SOW, every invoice, and which entity signed (MYDAS AI PLLC vs Conversion Marketing Pros). None of us has read the ownership clause. Confirm what the ~$50K covers.

The finished website

Repo and Vercel project. Paid-for, nearly done, the cheapest salvage available even under a full platform rebuild. The gaps (payments, form, survivor page, help bar) we fix ourselves.

Leverage

Every ask is something they already promised.

SKUcustom-software-build-ownership-model. Their product name says ownership.

AUG 24Zain: "complete control of the system because we don't want you guys to be like coming to us again and again." And the assigned next step: "prepare test credentials for all user roles." Fifteen days later, no login. Anja asked; no answer.

SEP 7Talha's own deadline, Sep 16 or 17: finalize platform, push website for review, finish integrations, meet with the advisor. Convert it: deliver everything on that date, or that is the handover date.

BALANCEThe unpaid balance (~half of ~$50K; verify against invoices) is tied to data, paper, and website handover, not to their code and not to a calendar.

RESERVEPublic, unsigned storage bucket serving HC attachments and their own W-9. No BAA. Hold both; use only if the conversation turns.

Friday, under a rebuild plan · 1 of 2

What to demand at 3:30.

1Confirm nothing was granted; grant nothingStripe, Twilio, QuickBooks, domain. Revoke on the call if anything moved since Sep 8.Friday

2The paperAgreement, SOW, invoices, signing entity, what the ~$50K covers.Friday

3Full data export, then written deletionPlatform records, Plan Street migration, intake form data. Ask where the demo's donor records came from.Friday

4Website repo + Vercel projectFinished, paid-for work. Take it.Friday

Friday, under a rebuild plan · 2 of 2

The BAA, the code, and the date.

5BAA: does one exist?If not, no survivor data enters their AWS.Friday

6A quick look at the code, no commitmentOptional. Instance URL and commit history. Only to salvage anything genuinely reusable before we build clean.Optional

7Sep 16/17 becomes the handover dateBalance released against items 2 to 4 landing.Leverage

Discipline

Hedges to keep in the room.

$"~$50K, ~half paid." Both tildes stay until the agreement and invoices are in hand.

WHO"Same operation" is supported. "Brandon Burgan's second brand" is not. Do not say it.

WORKThey said "a lot of changes," not "6 days of work." Quote them, not us.

TEAM"Offshore" is an inference from language on the call. Irrelevant under rebuild; do not lead with it.

LIVE SITE"Still the old HubSpot site," "frozen at Sep 4": unsourced in the archive. Verify before saying.

The bottom line

We own the hard part. We build the rest.

The spec, the content, the brand, the program rules, and the build speed are already ours. That is what makes rebuild the fast, controlled, low-risk move, not the last resort.

Take the data, the paper, and the website today. Grant no credentials. Leave the code. Ship a focused core on infrastructure we own end to end, with the Oct 14 gala as the first real deadline.

Inherit their code,or rebuild what we own.