Price
Three ways to work together.
Flat monthly. No per-seat count, no charge per questionnaire, and no separate fee when an auditor asks for something. Move up a tier when the work moves up, not when the headcount does.
For a company that has started getting security questionnaires and is answering them out of a spreadsheet.
- A written policy set, built on the systems you actually run
- One framework of your choosing
- Questionnaires answered as they arrive, in whatever format
- Every answer traced to a document or a screenshot
- Gaps written down with a date, not papered over
- Evidence collected on a schedule
- Vendor review
- The audit run for you
For a company with an audit booked, or a customer who has said the word "SOC 2" out loud in a renewal conversation.
- Everything in Baseline
- Evidence collected on a schedule, before the audit asks
- Vendor and subprocessor review
- The audit run end to end, including auditor correspondence
- Findings tracked to closure
- A second framework mapped from the same evidence
- A named security lead your customers can meet
- Incident response on retainer
For a company whose customers now want to talk to someone who owns security, and who does not want to hire one yet.
- Everything in Operating
- A named security lead, on your side of the table
- Customer security calls attended with you
- Incident response on retainer
- Security review of new vendors before you sign
- Board and customer reporting
- All four frameworks maintained together
| What you get | Baseline | Operating | Department |
|---|---|---|---|
| Written policy set | Yes | Yes | Yes |
| Frameworks covered | 1 | 2 | All four |
| Questionnaires answered | Unlimited | Unlimited | Unlimited |
| Every answer traceable to evidence | Yes | Yes | Yes |
| Evidence collected on a schedule | — | Yes | Yes |
| Vendor and subprocessor review | — | Yes | Yes |
| Audit run end to end | — | Yes | Yes |
| Named security lead | — | — | Yes |
| Customer calls attended | — | — | Yes |
| Incident response on retainer | — | — | Yes |
| Commitment | Monthly | Monthly | Monthly |
Why the price is where it is
Each tier sits below the threshold where most companies convene a committee, which means one person can decide. That is deliberate.
It is lower than a consultancy because the documentation is generated rather than billed by the hour. Everything comes out of one record of the systems you actually run. What you are paying for is the judgement about what belongs in that record, and the fact that nothing gets claimed on your behalf that you could not defend in an assessment.
There is no setup fee and no annual commitment. If it is not working, stop.