Do I need to know what should be automated?

No. Most people arrive with a feeling rather than a specification — something takes too long, or only one person can do it, or it gets dropped whenever the week is busy. That is enough to start from. If you can point at one job you would gladly stop doing by hand, we can work with that. If you can’t point at one yet, start with the free diagnostic instead: it finds the constraint first, and the workflow follows from it.

What happens with the first workflow?

We build it. You describe the job the way you would explain it to somebody starting on Monday — what comes in, what you would check, what should go out, and what you would never let leave without reading it. That becomes a working workflow, connected to the tools you already use, running on your account. You watch it run on real work before you rely on it. One workflow, start to finish, so what you are judging is a thing that works rather than a proposal for one.

What happens after that?

It runs. Keeping it running is the recurring part — hosting, the models it calls, monitoring, and the fixes for when something upstream changes its mind about a field name. Most people then add a second workflow, and it is usually one they spotted themselves while watching the first one work. There is no bundle to commit to up front. The next workflow is a decision you make when you want it, and not before.

Can my team eventually build workflows themselves?

That is the intended end state, and the training exists for it. Once your team has watched a few workflows get built, the skill turns out to be the describing — knowing what the work actually involves and where the judgment sits — which is the part your team already has. Some businesses would rather we kept building, and that is a legitimate choice rather than a failure. Most want at least one person inside who can change something without picking up the phone.

Do I become dependent on hmn.plus?

It is the right question to ask any vendor, and the honest answer is that you can be for exactly as long as it is useful. Three things are deliberate: the workflows are described in plain language rather than locked in a format only we can read, they run on infrastructure that can sit in your own name, and we teach the building instead of keeping it. Being the only people who can change your systems would be a business model. It is not ours.

Can we eventually own the system?

Yes, and it is an option rather than a destination — plenty of businesses would rather we kept running it, and that is a reasonable thing to want. When you do want it, the workflows, their definitions and the infrastructure transfer to you, and your team keeps the training that makes them usable. We would rather you stayed because staying is worth it.

The first automation is a fixed price, so the first decision is a small one: NZ$500 + GST to map it and get it built. After that, the platform it runs on is NZ$150 + GST a month for each person who builds workflows — everyone else who uses it is free — and that covers hosting, running your workflows, monitoring and support. Workflows you build yourself cost nothing extra; the ones we build are quoted one at a time, on what each actually involves. No annual lock-in, and nothing larger to sign before you have seen something of your own working.

Why not use ChatGPT, Claude, Zapier or n8n?

They answer a different question. Chat tools put something capable on the other end of a conversation, and then nothing happens unless a person types — every session starts again, and what the business knows ends up living in whoever writes the best prompt. Zapier and n8n wire apps to each other; the wiring holds until a field name changes, and it never makes a judgment call. Both leave the work depending on a particular person. What we build has a fixed shape: the same steps in the same order, your rules written in, a record of every action and the reason for it, and a person standing where a person should stand. The thinking inside a step can be as sharp as it needs to be. The path through it does not change because somebody phrased something differently. That is the difference between a tool one person is good at and a system a business runs on.

Where should AI actually be used?

On the judgment inside a step, not on the whole step. Reading an enquiry and working out what kind it is: yes. Drafting a reply in your voice, from your own past replies: yes. Moving money, or telling a client something binding, with nobody looking: no. What we build to is that anything with consequences waits for a person, and everything in front of it does not have to. A faster version of a bad process is still a bad process, which is why deciding where AI belongs happens before anything gets built, and is most of the value.

Anthropic Claude Code Leak: A Security Wake-up Call

The incident: a wake-up call for the AI industry

Recently, Anthropic—an industry leader in AI development—accidentally exposed the full source code for Claude Code. This was due to a 60MB .map file uploaded to the public npm registry. Besides revealing code, it laid bare some unreleased features: 'KAIROS Mode', 'The Buddy System', and 'Undercover Mode'. Such exposure underscores a critical issue many in tech are grappling with: the race to innovate often overlooks essential security protocols.

Our experience: why rapid development complicates security

At hmn.plus, we’ve always seen the allure of fast-paced development. Innovations demand speed; markets are competitive. But this incident at Anthropic is a clear example that speed often compromises security. From first-hand experience, we know that shortcuts in the development phase can lead to long-term complications. This is why we invested in reliable supply chain security early. It's not the glamorous part of tech, but it's critical.

The struggle between speed and security

Why do so many get it wrong? Simply put, the pressure to innovate often trumps the necessary diligence in maintaining robust security practices. Even the best platforms are only as secure as their least protected element. When development outpaces these basic security checks, vulnerabilities abound.

Key Lessons from Anthropic's leak

The case with Anthropic provides stark lessons:

Review security protocols: Whether you’re launching a startup or steering a titanic organization, regular updates and examinations of your security measures are imperative.
Integrate security into development: From the outset, embed security within your development processes. It shouldn’t be an afterthought but a core component.
Employee awareness: Build a culture where every team member understands their role in maintaining security. This isn't just an IT issue—it's part of the core DNA of a tech company.

Mitigation and moving forward

The reality is that digital security isn't foolproof. But the post-leak phase is equally important. Conduct comprehensive audits post-incident, reassess potential exposures, and most importantly, learn. We’ve experienced that when systems fail, it's a chance to fortify strategies and hone processes.

The future of AI and supply chain security

As AI continues to advance, so too will the intensity of security threats. The Claude Code leak is a cautionary tale. Our systems must evolve in tandem with our aspirations. Ignoring supply chain security isn't just risky—it's fatal.

Ultimately, the onus lies with those driving innovation. The balance of achieving rapid development while ensuring tight security is tricky but not impossible. As seen with Anthropic's oversight, the lesson for us all is clear: innovate, but never at the expense of integrity.