How we built silentmonkey.io — from zero to a fully operational boutique consulting presence — using the same Scrum framework, tool stack, and Definition of Done we bring to every client project.
ClientBoutique Digital Consulting
DurationMar 2026 – Ongoing
MethodScrum · Agile
StatusLive · Ongoing
Last Updated
— this page reflects on itself and keeps improving. Living document, not a finished one.
01 · Sprint History
HOW IT HAPPENED.
From a small audit idea to a new site — the milestones, and the honest reasoning behind each turn.
The seed
An audit for an existing site
It began as a small idea: run a website audit on the existing silentmonkey.io. A tool to check speed, compliance, and Core Web Vitals — nothing more.
The pivot
A tool that outgrew its host
The audit tool kept growing — multiple API integrations, a trilingual UI, eight releases. It no longer fit on an old Squarespace page. A new site with new requirements wasn't optional; it was the honest conclusion.
The build
Scrum, adopted mid-flight
We didn't start with Scrum; we started with momentum. When complexity and cross-session context loss made it impossible to say where things went wrong, we introduced the method the moment it was needed — without losing velocity. Recognising a missing methodology and implementing it under way is exactly what we bring to client work.
The self-audit
The auditor turns inward
Then we pointed the audit at our own site. The tool flagged real issues; the code review found more — stale references, a decoupled stylesheet, a duplicated decision log. Each one documented, each one fixed — auditing practised on the one project we control completely.
Today
Live, documented, evolving
A live site, decisions on record, an open backlog. Not a finished monument — a working system, improved in the open.
07.07.2026 · Design · Detail
404-Seite als Miniatur-Erlebnis
Eine 404-Seite ist die Seite, auf der man nie landen soll — und deshalb die perfekte Gelegenheit für einen Moment Charme. Statt einer nüchternen Fehlermeldung: ein Miniatur-Labyrinth, algorithmisch neu gewürfelt bei jedem Aufruf, ein goldener Punkt, der Wege sucht und in einem ONE-WAY-Schild stecken bleibt. Dann die eigentliche Botschaft: The trail ends here. Auffällig auch, was fehlt: og:url bleibt weg, weil eine 404-Seite keinen kanonischen Ort teilen kann. Auslassungen sind Entscheidungen. Wer sich diese Seite bewusst ansehen will, findet sie unter /404.html — traditionell ein Ort, an dem Entwickler ihren Besuchern eine kleine Entschädigung für die Fehlleitung schenken.
02 · Product Backlog
WHAT'S NEXT.
The live backlog — 32 items, filterable by status.
Imprint and Privacy — audit.silentmonkey.io and Ghost
Waiting: Ibiza address + NIF
Legal
Blocked
Stripe ES setup
Waiting: Autónomo registration
Legal
Backlog
info@ to andreas@silentmonkey.io Proton Mail migration
Infrastructure
Backlog
Apple Calendar — reconnect Claude access
Infrastructure
Blocked
Ibiza Voices Stripe — activate tax setup
Waiting: Asociación + Spanish bank account
Ibiza Voices
Blocked
Ibiza Voices legal pages — imprint, privacy
Waiting: NIF + Ibiza address
Ibiza Voices
Backlog
Squarespace to self-built migration
Planned Q3 2026
Infrastructure
Backlog
mlx-whisper local transcription — resume setup
Infrastructure
Next
Guardián de Eivissa — Consell pitch
Guardián de Eivissa
03 · Security Log
WHAT WE WATCH FOR.
Issues found while building this site, documented and fixed in the open. No marketing, no excuses.
High
API Key ExposureR-01 · audit/index.html · Discovered Jun 2026
Fixedv
Problem
The Google PageSpeed API key was hardcoded in plain text in the client-side audit/index.html — publicly visible in the browser source. Any visitor could read and abuse the key.
Fix
Introduced a Vercel Serverless Function (/api/pagespeed) as a proxy. The key now lives in a Vercel Environment Variable — server-side, never in the browser.
ISO 27001 Reference
A.8.24 — Use of cryptography / credential management. A.8.28 — Secure coding.
Why it happened
Static site, no build step, no .env concept in the original design. Key was hardcoded because it was meant to be "quick".
Learning
An API key in client code is not a configuration error — it is a data breach. An information security consultant whose own key sits in the source code has a credibility problem.
Medium
Vercel Rewrite OrderR-02 · vercel.json · Discovered Jun 2026
Fixedv
Problem
The catch-all rewrite for audit.silentmonkey.io intercepted all requests, including /api/pagespeed, which was never reached. Result: HTTP 500.
Fix
Added an explicit /api/(.*) rule before the catch-all in vercel.json. Vercel processes rewrites in order — first match wins.
ISO 27001 Reference
A.8.28 — Secure coding. A.8.21 — Security of network services.
Diagnosis path
A minimal ping test isolated the function from the API call — the function worked, the problem was routing. vercel.json analysis found the cause in two steps.
Learning
Routing rules are security-relevant. A wrong order can cause security functions (auth, rate limiting, proxy) to never apply. Order is architecture.
Governance
ISO 27001 Clause 7.2 — Self-ApplicationR-03 · Governance · Identified Jun 2026
In Progressv
Insight
ISO 27001 clause 7.2 requires demonstrable competence of all persons in the ISMS scope. Advising clients on ISO 27001 without being certified risks a non-conformity in the client's own organisation.
Consequence
The standard applied to oneself: ISO 27001 Lead Auditor and Lead Implementer qualification (ongoing). No advisory activity until certification.
Qualification ongoing. Certification pending. Until then: showcase, not an advisory offering.
Learning
Knowing a standard without applying it to yourself means you haven't truly understood it. Clause 7.2 is not a checklist for others — it is a mirror.
04 · Design Decisions
WHY IT LOOKS THIS WAY.
Every ADR behind this site's structure, palette, and language rules.
ADR-001 · Closed
One Domain
silentmonkey.io as the single root, every service on a subdomain. Evaluated against ~12 criteria over six months of recurring discussion — single-domain won on nearly every axis.
ADR-002 · Closed
Vercel over Ghost
Ghost was the original choice — reversed mid-build as overengineered for the actual scope. Leaner stack, ~€29/mo saved. Ghost later reinstated, but scoped narrowly to blog.silentmonkey.io.
ADR-003 · Closed
Two Pillars
Collapsed from three pillars to two — Digital Solutions and Digital Governance — after the original three-pillar model diluted the pitch.
ADR-004 · Closed
Netlify → Vercel
Migrated for GitHub auto-deploy — every push to main becomes a shippable Increment, matching the Scrum rhythm.
ADR-005 · Closed · 2026-05-07
English Is Canonical
EN is canonical for routes and filenames. DE/ES delivered as static overlay spans, not translated pages or a runtime translation API.
ADR-006 · Closed
Project Color System
Gold = brand/action, reserved for the main site. Blue = status/information, shared by the Audit Tool and Polyglot Engine. Each case study carries its own distinct accent, never reused.
ADR-007 · Accepted · 2026-07-03
Silence Is Also a Color
This hub carries no accent color. Blue was already claimed twice before Making-Of reached for it. The brand's own name gave the real answer: grayscale, for the one section built to hold still.
Full ADR log — including reconstructed context for 001–004 and 006 — lives in ADR-LOG.md in the repo.
00 · Overview
BY THE NUMBERS.
8Sprints Completed
177+Releases Shipped
3Languages
~€75Monthly Running Cost
€29Saved / mo — PO Decision
200+Increments Delivered
1.5k+Lines of Code
0Agency Budget
8moVelocity Window
01 · Process
THE BOARD.
Every feature, every page, every integration ran through a proper Product Backlog — prioritised, estimated, and refined before a single line was written. No ad-hoc decisions. No scope creep without an explicit change to the Sprint Goal. Product Owner and Developer were the same person — which is either elegant or insane. Probably both.
Full-stack digital competence — DNS to AI integration
EU-compliant tool stack — DSGVO by design
Own audit tool — unique lead generation Increment
No agency overhead — lean, fast, direct
W
Weaknesses
Solo operation — capacity limits per project
DNS migration still pending
Legal setup in transition — German market only for now
No case studies published yet
Squarespace migration still pending
Brand recognition still early stage
O
Opportunities
AI consulting market growing rapidly
Custom-built stack — full control, no platform lock-in
Audit tool as scalable lead engine
Proyex — client transparency as differentiator
Automation (n8n) reduces manual overhead
Boutique positioning in underserved markets
T
Threats
Agencies with larger budgets & teams
Squarespace/Wix self-service trend
AI tools reducing perceived need for consultants
Slow client decision cycles
Platform dependency (Vercel, cal.eu, Stripe)
03 · Methodology
WHY SCRUM?
Scrum is an agile framework for delivering complex projects in short, focused cycles called Sprints. Every Sprint starts with Planning, ends with a Review and Retrospective, and ships a working Increment. We apply it to every client project — and to ourselves. Here's what it means in practice.
📋
PRODUCT BACKLOG
The single source of truth for everything that needs to be built. Prioritised by value, estimated by effort, owned by the Product Owner. Nothing enters a Sprint without being groomed in the Backlog first. No surprises. No scope creep.
🎯
USER STORY
Every task is framed from the user's perspective: "As a [user], I want [feature], so that [outcome]."Acceptance Criteria define exactly when a Story is done. No ambiguity. No moving goalposts.
⚡
SPRINT
A fixed time-box — typically 1–2 weeks — with a clear Sprint Goal. The team commits to a scope and delivers. Each Sprint produces a working, shippable Increment. You don't wait for "done" — you see progress every cycle.
✅
DEFINITION OF DONE
A shared, explicit checklist that every Increment must pass before it's considered complete. Tested. Deployed. Reviewed. Done means done — not "almost done" or "done on my machine." Quality is non-negotiable.
🔍
REVIEW & RETRO
After each Sprint: the Review inspects what was delivered. The Retrospective asks what can improve. Continuous improvement is built into the process. Not a post-mortem — a living habit that makes every Sprint better than the last.
🔮
TRANSPARENCY
Every User Story, every blocker, every Sprint Board is visible. Scrum's three pillars — Transparency, Inspection, Adaptation — are not theory here. Clients see the board in real time, via Proyex. No curated highlight reels.
05 · Infrastructure
THE STACK.
Every tool chosen for a reason. EU-compliant where possible. Open-source preferred. No vendor lock-in without justification.
Code versioning and auto-deploy pipeline. Connected to Vercel — every push goes live automatically. Full version history.
"We built this the way we build everything — one Sprint at a time, until the Increment speaks for itself. The project took longer than the initial velocity suggested. It always does. That's not failure. That's how real things get made."
Andreas · Founder, Silent Monkey Solution
THIS COULD BE YOUR PROJECT.
You've seen how we work. You know what we build. If you have a project that needs clarity, structure, and someone who hasn't said no yet — let's talk.