Services · How to Engage

Scope, deliverables, and a timeline.

The Terraform & Platform Assessment is a 7-day, read-only review of your cloud, Terraform, CI/CD and Kubernetes, with findings ranked by priority and a 90-day plan. The fee is credited toward a retainer signed within 60 days.

The Architecture & Compliance Teardown is a focused second opinion before a major security review or upmarket deal. You share your architecture, current controls, and where the pressure is coming from. We return a written 5-8 page assessment: what holds, what fails an audit or a security review, and the prioritized path to fix it — then walk it through with you on a 60-minute call.

Five ways to engage. Each one lists what it covers, what it leaves out, and how long it runs. The price is set on a call. Solutions describes what we do; this page is how to buy it.

Terraform & Platform Assessment

A 7-day, read-only review of your cloud, Terraform, CI/CD and Kubernetes.

7 business days

What's included

Findings report ranked P0/P1/P2
Cost quick wins with estimated monthly savings
One-page SOC 2/HIPAA Evidence Map
90-day roadmap and a 60-minute readout
A fixed quote if you want help with the work

Not included

Changes to your cloud, Terraform, or pipelines (access is read-only)
A SOC 2 audit or attestation (an independent CPA firm does that)

Typical fit

One cloud, up to 3 environments, and 1 Kubernetes cluster. Extra clouds or clusters are confirmed on the call. No Terraform yet? Same engagement, click-ops-to-code edition.

Architecture & Compliance Teardown

A senior review of your cloud estate and compliance posture, in writing, in a week.

~5 business days from receiving materials

What's included

Written architecture + posture assessment (5-8 pages)
Prioritized findings mapped to audit and deal risk
60-minute walkthrough call with senior engineering leadership
A concrete 90-day recommendation you can execute with or without us

Not included

Hands-on implementation (that is the sprint or fractional work)
A formal audit or attestation

Typical fit

Teams that want a defensible outside read before committing to bigger work — or before an auditor or enterprise buyer takes their own look.

90-Day Readiness Sprint

From scattered controls to the start of your audit window in one focused quarter.

90 days

The structured push to audit-ready: scope and gap assessment, the policy set, control implementation, and an evidence pipeline that generates artifacts continuously. Sequenced weekly, run alongside your team, with milestones at 30/60/90 days.

What's included

Scope + honest gap assessment against your target framework
Policy set drafted to what your team will actually do
Control implementation: identity, logging, change management, backup
Evidence pipeline live before the observation window starts
Readiness assessment + auditor handoff

Not included

The audit itself (we prepare you for your auditor, we are not the auditor)
Compliance-platform subscription fees, if you choose one

Typical fit

Teams with SOC 2 or HIPAA pressure on a deal timeline and no dedicated compliance owner to run the readiness lift internally.

Fractional Platform Engineering

Embedded senior platform leadership, without the principal-engineer hire.

3-month minimum, month-to-month after

A defined weekly cadence of principal-level platform work: architecture direction, hands-on infrastructure, operational maturity, and the hiring guidance to eventually replace us. Landing zones, credential elimination, GitOps, on-call design — the work the Operating Library describes, done in your estate.

What's included

Defined weekly engagement (typically 10-20 hours/week)
Direct senior authorship on architecture and platform code
Platform roadmap, operating model, and vendor selection
Incident program + on-call maturity
Hiring, leveling, and handoff guidance

Not included

Full-time embedded staffing or body-shop augmentation
24/7 on-call coverage of your production (see Managed Operations)

Typical fit

Teams of 10-80 engineers who need platform depth now and a bench they can grow into — not another full-time req.

Managed Compliance Operations

The evidence pipeline, attestations, and security reviews — run for you, continuously.

12-month term

After readiness lands, someone has to keep it true: quarterly access reviews on time, evidence flowing, sub-processor list current, customer security questionnaires answered from a maintained response repository. We run that operating cadence so the posture the audit measured is the posture you actually keep.

What's included

Evidence pipeline operation + quarterly control cadence
Access reviews executed and recorded on schedule
Customer security-questionnaire responses from a maintained answer bank
Sub-processor and vendor review upkeep
Audit-cycle support when the assessor returns

Not included

Initial control implementation (that is the sprint)
Legal review of contracts, DPAs, or BAAs

Typical fit

Teams past their first audit who keep scrambling every renewal cycle — or losing deal velocity to security questionnaires.

Every engagement starts the same way.

An intro call, then a scoped discovery (one to two weeks), then a written recommendation — and only then an engagement decision. We don't generate proposals for work we don't think we should run. Two ways to start: the Architecture & Compliance Teardown (about five business days) and the Terraform & Platform Assessment (seven business days, read-only).

Not sure which tier?

Start with the conversation, not the contract.

Tell us where the pressure is coming from — an audit, a deal, a bill, a platform that needs adult supervision — and we'll tell you honestly which tier fits, including "none yet."

Book a call