We run the work inside the product, not beside it.
Scanning, triage, compliance mapping and report drafting happen in the workspace you already pay for. There is no deliverable you wait for and no document at the end: what changes, changes on the screen, while it happens.
These four rules are the offer
A service you cannot cancel on your own, and whose work leaves with the person who leaves, is a staffing contract with a product name on it.
The work happens inside the workspace
Scanning, triage, compliance mapping and report drafting run in the product you already pay for. What changes, changes on the screen, while it happens.
Billing is by scope and service level
Never by the hour, and never by days of presence. We do not sell a calendar of allocated time.
Cancelling a service does not take the work with it
The platform, the data and the work already done stay with you. Findings, marks, evidence and reports remain where they are.
You buy and cancel on the same billing page
From inside the workspace. No call to buy, and no call to leave.
One exception, while it is true: the platform is not live yet, so rule four has no screen. Today the way in is a conversation. This paragraph disappears the day the billing page exists.
Against the staffing model, not against a named competitor
| Criterion | Staffing model | Here |
|---|---|---|
| Unit of billing | An hour, or a day of presence | Contracted scope and service level |
| What you are buying | Somebody being there | Environments covered and deadlines met |
| Where the work shows up | In a document, later | In your workspace, while it happens |
| When you cancel | The work leaves with the person who leaves | The platform, the data and the work stay with you |
| How you sign up and leave | A proposal, a call and a notice period | On the same billing page as the plan |
What is actually contracted
Every count below was read in the platform source, engine by engine. None was rounded from a brief.
- SAST
We configure and keep the engines running
198 code rules across 14 languages, 31 secret patterns, 183 infrastructure-as-code rules and 100 container rules, on the repositories in scope. You watch the scan run; you do not get the result by email.
- Triage
We turn raw output into a findings list you can defend
The same flaw seen by two scanners becomes one finding with two sources. What you mark as accepted or false positive stays marked on the next scan, because the finding identity does not use line numbers.
- GRC
We map findings to the framework your client is audited against
ISO/IEC 27001:2022 with 93 controls, SOC 2 with 47 criteria and OWASP SAMM v2 with 90 activities, with the confidence of each suggestion recorded for you to confirm or reject. Evidence carries an expiry date, and expired evidence stops supporting its control. These are catalogues loaded into the product, not certifications we hold. We hold neither ISO 27001 nor SOC 2.
- Report
We draft the report; you sign it
The executive report comes out written — summary, risks by impact, what is in good shape and a 90-day plan — and is reviewed with you inside the workspace. The signature is yours.
What we do not do
We do not place permanent staff
No recruiting and no permanent placement. If what you need is to hire someone onto your payroll, it is not us — and it is not what we are building.
We do not sell a calendar
There is no "so many days a week". If the purchase needs a person appearing on a schedule, this model does not serve you, and saying so now costs less than finding out in month two.
There is no deliverable outside the product
The document is not the product, and it comes out as a PDF. Not Word, not Excel.
The platform is not live yet
Infrastructure is being rebuilt. There is no signup, no contracting and no billing today — and you pay for nothing before it exists.
Tell us which environments you want covered and we will tell you the scope.
A technical conversation with the person who wrote the code. No slide deck, and no proposal attached.