Operations lead handed the security questionnaire
A deal is waiting on answers about access control and data retention, and the honest answer is that nobody has written them down.
Security decisions without a security hire
We act as the security voice in the room for teams too small to employ one, covering policy, vendor reviews, customer questionnaires and what to do when something goes wrong.
What arrives
- Written policies short enough that staff will read them
- An access review naming every account, what it can reach, and who owns it
- Completed answers to the security questionnaires your buyers send
- A vendor review for each supplier touching customer data
Who this is for
Three profiles. If none of them is recognisably you, this is probably the wrong page - and the line below is the one worth reading before you book anything.
Not a fit: Skip this if you need a certification audit signed off, because certification bodies cannot accept work from the people who advised you.
Founder whose team grew past 20 people
Access was informal when everyone sat together, and now leavers still have accounts nobody remembered to close.
Engineering manager choosing between vendors
Two suppliers want access to customer data and you need someone to read what they actually committed to.
What you get
- Written policies short enough that staff will read them
- An access review naming every account, what it can reach, and who owns it
- Completed answers to the security questionnaires your buyers send
- A vendor review for each supplier touching customer data
- An incident plan with named roles and the first hour written out
- A quarterly session to revisit what changed
What we build it with
- OWASP SAMM
- CIS Controls
- NIST CSF
- Google Workspace
- Microsoft 365
- 1Password
- Okta
Chosen per project, not per fashion. If your team already runs something else and it works, we use that.
How the work runs
-
1
1 week
Where you are
We look at how access, data and vendors are handled today, without judging the shortcuts.
From you: An hour each with whoever runs IT, engineering and HR.
-
2
3-5 days
What matters
We rank the gaps by what would actually hurt, and mark the ones a customer will ask about.
From you: A view of which deals or contracts are waiting on this.
-
3
2-3 weeks
Write it down
We draft the policies, the access model and the incident plan in language your staff will follow.
From you: One reviewer who can say yes, and a list of your current tools.
-
4
Ongoing
Keep it true
We revisit quarterly, because a policy that describes last year's company is worse than none.
From you: A recurring hour in the calendar.
How we work together
Fixed project
Scope and price agreed up front. Best when the outcome is known and the deadline is real.
Dedicated team
A named team for a quarter or more. Best when the roadmap will change and you want the context kept.
Staff augmentation
Engineers inside your process and your tools. Best when you have the lead and need the hands.
Invoiced in
- USD
- EUR
- GBP
- CHF
- SGD
- AUD
- CAD
- AED
- SAR
- QAR
- JPY
- INR
Paid by
Card, netbanking, wallet and UPI through Razorpay, which is what our checkout runs on, so anything it accepts we accept. Bank transfer, SEPA, Wise and Payoneer for invoices that prefer it.
NDA before the first call. Full IP assignment on delivery. Contracts under Indian, English or Delaware law.
Work like this
Case studies are being written up
Three are in legal review. We can walk you through the work on a call in the meantime, including the parts that did not go to plan.
What clients say on Google
Live from our Google Business listing - not retyped here.
Loading reviews from Google - read them on Google.
Questions we get asked
No. Certification needs an accredited auditor, and an auditor cannot certify work they advised on. What we do is get you to the point where an audit is worth starting, and answer the buyer questionnaires that are usually the real reason certification came up. Many teams find the questionnaires were the actual requirement.
That is the usual outcome, and it is why we write short ones. A policy nobody reads fails the first time someone needs it. We aim for documents a new joiner can read in ten minutes, tied to the tools you actually use, and we check at each quarterly session whether they still describe reality.
The incident plan names that person, and it is someone at your company, not us. Our part is making sure the first hour is written down before it is needed: who is told, what gets shut off, what gets preserved, and what gets said to customers. We can be on the call, but the decisions stay yours.
We draft the answers and you approve them, because you are signing them, not us. Where an answer would be untrue today, we say so and either fix the gap first or write an honest answer with a remediation date. Buyers accept the second far more often than people expect.
Stuck on a security questionnaire?
Send the questionnaire and we will tell you which answers you already have and which need work.