Hi,
While I don't think it is a great idea to just go hosting sites for other people/companies, you have to do what the "boss" requested.
Full-trust will be fine as long as you take a few steps to ensure the site is secure and isolated.
-
Create a unique Application Pool for the site.
-
Create a unique local user account on your web server. Do not put this user in any groups. Use this account for the Application Pool identity and the website user.
-
Create a directory for the website that is not under your website directory and only allow only the unique user access to the directory. Of course, you will want an admin account on the directory for management purposes.
-
Ensure the unique user can only write data to the App_Data and Data directories in the client's site directory and that those directories are not executable.
That should take care of it.
HTH,
Joe D.