How we work.
Clear scope, fixed prices, written updates and published methods. You always know what is happening and why.
Four steps, every engagement
20-minute call
Free · this weekWe listen to what you need, ask about your systems and deadline, and tell you honestly whether we are the right fit.
We sign an NDA before any detailed or technical discussion.
Written proposal
Within one business dayScope, deliverables, timeline and a fixed price for that scope. You know exactly what you get before work starts.
Anything outside the written scope is quoted in writing before we do it.
Delivery
3–5 weeks for an assessment · 6–12 weeks for a buildWeekly written updates, milestone demos and a daily overlap with your time zone. Read-only access wherever possible.
You can see progress and decisions in writing at every stage.
Report, handover and fixes
At the end of each engagementYou receive the report or the working product, walked through in a readout meeting. We can then implement the fixes or support you monthly.
Handover and code ownership follow what your contract sets out.
Published methods, not opinions
Security assessments follow NIST SP 800-30 Rev. 1: prepare, conduct, communicate and maintain. For health data we apply NIST SP 800-66 Rev. 2. Every risk rating carries a written rationale and an evidence reference.
How NIST SP 800-30 worksSecurity built into every build
Role-based access control, multi-factor authentication, encryption in transit and at rest, audit logging, and dependency and secret scanning before every release.
Secure SaaS developmentFixed price for a written scope
No open-ended hourly billing. The proposal states the scope, what is out of scope, the deliverables and the price. Changes are quoted in writing first.
Your data stays minimal
NDA before detail, read-only access, no sensitive files by email, and working files deleted within 30 days of project close.
How we protect your informationWhat we do not do
- Issue certifications. Only an accredited certification body can certify you; we prepare you for that audit.
- Destructive testing, such as denial-of-service, or testing anything without your written authorisation.
- Legal advice. Your counsel interprets the law; we make your systems and records match it.
- Promise compliance. No assessment can guarantee it, and we will not claim otherwise.
Frequently asked questions
How is the price set?
From the written scope: the number of systems or features, integrations and the timeline. You get one fixed price for that scope, and any change is quoted in writing before work proceeds.
Do you need access to our production data?
Usually not. We work from configurations, diagrams and redacted samples, with read-only access wherever possible.
How do we stay informed?
A written update every week covering what was done, what is next, blockers and decisions needed, plus demos at each milestone.
What if we are in a different time zone?
We work Mon–Fri, 10:00–19:00 IST. Calls until 21:30 IST by arrangement for US and Canada; UK and Europe overlap daily.
Have a product to build or a system to secure?
Tell us what you need. You will receive a written proposal within one business day.