Questions we get before the first call
How we work alongside your team, what you keep when we leave, what we turn down, and who answers
How does this work alongside engineers we already have?
Your engineers keep the product. We take the stretch where the platform decisions and the audit evidence get made, and those are the same decisions. On the four engagements behind the DevOps page we held the design review and the on-call rotation afterward. Nobody hands a pager to someone billing hours into another team’s backlog, which is the whole reason we take the pager.
What do we keep when the engagement ends?
A platform your own engineers deploy to without asking us. The Terraform, the pipelines, and the runbooks are yours, in your repositories, from the first commit rather than at handover. Fifteen-plus engineers have come up under Max’s mentoring, and that is the register the work is done in.
Do you need access to our production accounts?
Yes. If the answer is no we would rather not start, because a posture assessment that cannot change the IAM boundary and the network path its own finding names produces a document and nothing else. Read access to the accounts is the floor; changing what the finding points at is the engagement.
How do you price it?
Per engagement, against a written scope, never per hour — pricing by the hour rewards slower work rather than better work. An assessment is a fixed fee. The number is in the proposal before anything starts, and there is no version of this where you find out later.
What do you turn down?
Compliance theater, builds with nothing in production yet, and anything that needs an ML platform built from scratch. Each is argued where it belongs, on the homepage or on the AI page. Losing an engagement at the first email costs both of us an email. Losing it at the readout costs a quarter.
Who answers when I write?
One of the two engineers, usually within one business day. There is no coordinator, no qualification call, and no form standing between the message and the person who would do the work.
We are not fintech or healthcare. Does that rule us out?
No. It means the sector examples will not be yours. The named engagements behind this site run through five sectors, from financial services to sports. Fintech and healthcare lead because that is where the regulator applies pressure, not because of a rule about who we take.
Procurement wants insurance certificates, a signed BAA, and our vendor security questionnaire completed.
Those are Farid’s, and they are answered by email rather than by a page — ask and you get a direct answer instead of a marketing sentence that commits to nothing. He also holds the contract terms, the entity paperwork, and anything cross-border.