Security services

Website Security Audit is a security service from Livin Services. In one line: find out where you are actually exposed before somebody else does. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

Website Security Audit covers scoped assessment and rules of engagement for website security audit, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, findings ranked by real exploitability, not by scanner severity score, each item with the fix written out, so your developer can act without us and a plain statement that an audit reduces risk and cannot eliminate it. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: find out where you are actually exposed before somebody else does. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying Website Security Audit to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

Malware Removal & Recovery is a security service from Livin Services. In one line: clean the site, close the door and prove it stayed closed. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

Malware Removal & Recovery covers scoped assessment and rules of engagement for malware removal & recovery, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, the entry point identified and closed, because cleaning alone means it returns, post-clean monitoring for a period afterwards, with the findings shown to you and search console and blocklist removal handled, since a clean site can still be flagged. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: clean the site, close the door and prove it stayed closed. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying Malware Removal & Recovery to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

Penetration Testing is a security service from Livin Services. In one line: have a person try to break in and document exactly how far they got. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

Penetration Testing covers scoped assessment and rules of engagement for penetration testing, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, scope and rules of engagement agreed in writing before anything begins, reproduction steps for every finding, so a fix can be verified rather than assumed and a retest of the fixes included, since an unverified fix is not a fix. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: have a person try to break in and document exactly how far they got. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying Penetration Testing to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

SSL & HTTPS Setup is a security service from Livin Services. In one line: encrypt everything, redirect properly and stop mixed-content warnings. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

SSL & HTTPS Setup covers scoped assessment and rules of engagement for ssl & https setup, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, automatic renewal configured and tested, so nothing expires unnoticed, every mixed-content warning found and fixed, not only the ones on the homepage and redirects consolidated to one hop, because chains cost speed and search signals. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: encrypt everything, redirect properly and stop mixed-content warnings. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying SSL & HTTPS Setup to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

Firewall Configuration is a security service from Livin Services. In one line: stop the obvious attacks before they ever reach your application. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

Firewall Configuration covers scoped assessment and rules of engagement for firewall configuration, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, rules tuned against your real traffic, so legitimate customers are never blocked, run in monitoring mode first, because a badly tuned firewall costs orders and rules documented, so a future false positive can be diagnosed quickly. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: stop the obvious attacks before they ever reach your application. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying Firewall Configuration to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

Backup Strategy Setup is a security service from Livin Services. In one line: have a restore you have actually tested, not just a scheduled job. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

Backup Strategy Setup covers scoped assessment and rules of engagement for backup strategy setup, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, a full restore performed and timed, because an untested backup is only a hope, copies held somewhere separate from the server, so one compromise cannot take both and the restore procedure written down plainly, so it works when we are unavailable. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: have a restore you have actually tested, not just a scheduled job. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying Backup Strategy Setup to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

Security Monitoring is a security service from Livin Services. In one line: know within minutes when a file or permission changes unexpectedly. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

Security Monitoring covers scoped assessment and rules of engagement for security monitoring, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, alerts tuned to be few and meaningful, because a noisy feed gets ignored, who is notified and what they should do agreed before anything is switched on and a monthly summary of what was seen, including the quiet months. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: know within minutes when a file or permission changes unexpectedly. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying Security Monitoring to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

DDoS Protection is a security service from Livin Services. In one line: stay online through a flood instead of waiting it out. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

DDoS Protection covers scoped assessment and rules of engagement for ddos protection, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, origin server addresses hidden, since protection is bypassed if they are public, rate limits tuned so real customers and payment callbacks are never caught and an honest note on where the paid tiers are worth it and where they are not. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: stay online through a flood instead of waiting it out. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying DDoS Protection to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

API Security is a security service from Livin Services. In one line: lock down authentication, rate limits and data exposure on public endpoints. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

API Security covers scoped assessment and rules of engagement for api security, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, every endpoint checked for data it returns but should not, not only for access control, rate limits per client, so one integration cannot take the api down for everyone and secrets moved out of code and rotated, with the rotation process documented. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: lock down authentication, rate limits and data exposure on public endpoints. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying API Security to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

Authentication Hardening is a security service from Livin Services. In one line: close the login, session and reset gaps attackers actually use. It's a defined piece of work with an agreed finish line, not an open-ended retainer, so you know what you're buying before you commit to it.

Authentication Hardening covers scoped assessment and rules of engagement for authentication hardening, findings report ranked by severity with reproduction steps, remediation performed or specified for your developers, access, credential and permission review, backup and recovery verification, retest confirming each finding is genuinely closed, password reset and session expiry fixed, since those are the routes actually used, second factor added without locking out the people who lose their phone and tested against real attempts rather than assumed secure after configuration. All of that gets written down before we start, so you know exactly what's landing and what isn't. Anything outside the list gets quoted separately — we won't quietly absorb it and we won't quietly bill for it either.

Anything not named in the written scope. In practice that usually means ongoing management after handover, content and copy you have not supplied, third-party licence and subscription costs, and work in other disciplines — those are separate services with their own scopes. We list exclusions explicitly rather than leaving them to be discovered halfway through.

It fits teams where you have been hacked before and are not certain it is fully gone. The goal is simple: close the login, session and reset gaps attackers actually use. If your situation is different, tell us and we will point you at the security service that actually fits — including one we do not sell.

When the underlying problem sits somewhere else. Buying Authentication Hardening to fix something it does not touch is expensive and disappointing in equal measure. Tell us what outcome you are actually after and we will say plainly whether this is the right service, a different one, or nothing at all right now.

A good freelancer is often the right answer for a narrow, well-defined task, and cheaper. What an agency adds is continuity when someone is unavailable, a second pair of eyes on decisions, and accountability that survives the individual. Judge it on whether your project needs those things — plenty do not.

This service is scoped as a defined piece of work with a handover at the end, which is deliberate: it means the engagement has a finish line rather than drifting into an indefinite monthly cost. If you need continuing support afterwards we can arrange it, but it is a separate agreement you enter knowingly.

Revisions within the agreed scope are part of the work, not a numbered allowance to be rationed. What is charged separately is a change of direction — new requirements, a reversed decision, or work outside what was scoped. The distinction is written into the scope so it is not decided by argument later.

Sometimes, and sometimes not — it depends on whether the thing it fixes is actually what is holding you back. Smaller scopes are quoted the same way as large ones, with no minimum engagement, so size is not the barrier. Being honest about whether this is your highest-leverage move is more useful to you than a yes.

A typical Website Security Audit engagement runs 1–2 weeks from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out Website Security Audit isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

A typical Malware Removal & Recovery engagement runs 1–5 days from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out Malware Removal & Recovery isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

A typical Penetration Testing engagement runs 2–4 weeks from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out Penetration Testing isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

A typical SSL & HTTPS Setup engagement runs 1–3 days from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out SSL & HTTPS Setup isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

A typical Firewall Configuration engagement runs 3 days–1 week from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out Firewall Configuration isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

A typical Backup Strategy Setup engagement runs 3 days–1 week from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out Backup Strategy Setup isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

A typical Security Monitoring engagement runs ongoing from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out Security Monitoring isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

A typical DDoS Protection engagement runs 3 days–1 week from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out DDoS Protection isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

A typical API Security engagement runs 1–3 weeks from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out API Security isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

A typical Authentication Hardening engagement runs 1–3 weeks from kickoff to handover. That covers discovery and scoping, build or implementation, review with your team, and a final QA pass. Larger or multi-market builds extend this and we say so during scoping rather than after.

Sometimes, if the scope is reduced rather than the care taken. We will tell you which parts can be deferred to a second phase to hit a date. What we will not do is compress testing and review to make a deadline look achievable — that moves the cost from the timeline to the month after launch.

One fixed price against a written scope. Not an hourly rate. What moves that number is how many templates, integrations and awkward edge cases are involved — not how long we happen to take, which is our problem to manage, not yours. There's no price list because a real quote depends on your situation. Tell us what you need and you'll get a written scope and a fixed figure back, with anything that could change it flagged upfront rather than appearing on an invoice later.

Four things, roughly in order of how much they matter. How much is genuinely bespoke versus configuration. How many integrations and outside systems are in play. What state your starting point is in — inherited problems have to be sorted before anything new can sit on top of them. And how many people are in the approval chain. We'll name which of those apply to you in the quote, so you can see where the number came from.

No. Scoping and quoting are free, and so is the conversation to get there. If it turns out Authentication Hardening isn't what you need, you'll hear that for free too — rather than being sold a paid discovery phase that arrives at the same answer three weeks later.

If we underestimated something inside the agreed scope, we absorb it. That's what a fixed price means. If the scope itself changes because a new requirement turns up, we quote that separately and you decide whether to go ahead before anyone touches it. You won't get an invoice for something you didn't approve.

Agreed in writing before work starts, as part of the scope. There is no deposit taken to hold a slot in the calendar and no charge for the scoping conversation. If the engagement is stopped partway by either side, you pay for the work completed to that point and you keep it.

Depends entirely on what it is. Build work shows immediately because the thing either exists or it does not. Anything depending on user behaviour, search engines or list warm-up takes longer, and how much longer is a function of your traffic volume — low traffic means a longer wait before any change is distinguishable from noise. We say which category your work falls into up front.

Usually one of three reasons: a narrower scope than ours, a junior person delivering it, or exclusions that surface as change requests later. Ask both suppliers for the written scope and compare those rather than the totals. If theirs genuinely covers the same ground for less, take it — and we will tell you so.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Say what is happening now, what you want to be different, and by when. That is genuinely enough to get a scope back. You do not need to specify a solution — if you tell us the outcome, we will tell you what it takes, and sometimes that is less than you expected. What slows a brief down is a list of features with no stated problem behind them.

Five questions worth asking any supplier. Who will actually do the work, not who is in the meeting. What is explicitly excluded. What happens if it takes longer than quoted. Whose name the accounts are in at the end. And what they would talk you out of — the last one is the hardest to fake, and the most revealing.

Everything in the written scope delivered and verified, your team able to maintain it without us, and a recorded before-and-after on whatever measure you agreed at the start. Notably not: a slide deck, a vanity score, or a number with no baseline beside it.

Describe the symptom rather than the fix. If the symptom is one this service addresses, it is the right service. If it is not, we will name the one that is — including when that is a different discipline entirely, or nothing right now. Guessing at the service before naming the problem is how budgets get spent on the wrong thing.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Three real ones. The starting point turning out to be worse than it looked, which extends the work. A dependency outside our control — a platform, a plugin, a third-party API — changing mid-project. And decisions on your side taking longer than planned, which is the most common of the three by a distance. We name whichever apply to you in the scope rather than after.

That is the thing we test hardest against. Work happens on a copy or in a staging environment wherever the platform allows it, and we check the paths that already work before anything goes live. Where a change genuinely cannot be made without affecting something else, you hear that before it happens, not after.

It stays yours and it stays in your systems. We work inside accounts you own, we do not export customer data to our own tools, and access is created so you can revoke it the moment the project ends. If a piece of work genuinely requires handling personal data, we say what, why and for how long, in writing.

Yes, and without making it an event. Send yours over and we will sign it. We do not publish client names or work without permission either way — the example builds on this site are deliberately unnamed for that reason.

Yes. You pay for what has been completed and you take everything produced up to that point, including access and any partial documentation. Nothing is held back as leverage. We would rather stop a project that has stopped making sense than bill through to the end of it.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with OWASP ZAP, Nmap, WPScan and Snyk for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Usually yes, and we prefer to. Rebuilding something that works is a cost with no return. We review what you have first and tell you plainly which parts are worth keeping, which need repair, and which are cheaper to replace than to maintain — including when the honest answer is that nothing needs to change.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with WPScan, ClamAV, Wazuh and Cloudflare for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Usually yes, and we prefer to. Rebuilding something that works is a cost with no return. We review what you have first and tell you plainly which parts are worth keeping, which need repair, and which are cheaper to replace than to maintain — including when the honest answer is that nothing needs to change.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with Burp Suite, Metasploit and OWASP ASVS for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Usually yes, and we prefer to. Rebuilding something that works is a cost with no return. We review what you have first and tell you plainly which parts are worth keeping, which need repair, and which are cheaper to replace than to maintain — including when the honest answer is that nothing needs to change.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with Let's Encrypt, Cloudflare and HSTS for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Usually yes, and we prefer to. Rebuilding something that works is a cost with no return. We review what you have first and tell you plainly which parts are worth keeping, which need repair, and which are cheaper to replace than to maintain — including when the honest answer is that nothing needs to change.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with Cloudflare WAF, ModSecurity and UFW for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Usually yes, and we prefer to. Rebuilding something that works is a cost with no return. We review what you have first and tell you plainly which parts are worth keeping, which need repair, and which are cheaper to replace than to maintain — including when the honest answer is that nothing needs to change.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with Restic, AWS S3 and Backblaze B2 for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Usually yes, and we prefer to. Rebuilding something that works is a cost with no return. We review what you have first and tell you plainly which parts are worth keeping, which need repair, and which are cheaper to replace than to maintain — including when the honest answer is that nothing needs to change.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with Wazuh, Cloudflare and Uptime Kuma for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Usually yes, and we prefer to. Rebuilding something that works is a cost with no return. We review what you have first and tell you plainly which parts are worth keeping, which need repair, and which are cheaper to replace than to maintain — including when the honest answer is that nothing needs to change.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with Cloudflare and AWS Shield for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Usually yes, and we prefer to. Rebuilding something that works is a cost with no return. We review what you have first and tell you plainly which parts are worth keeping, which need repair, and which are cheaper to replace than to maintain — including when the honest answer is that nothing needs to change.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with OAuth 2.0, JWT, Kong and OWASP ASVS for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Usually yes, and we prefer to. Rebuilding something that works is a cost with no return. We review what you have first and tell you plainly which parts are worth keeping, which need repair, and which are cheaper to replace than to maintain — including when the honest answer is that nothing needs to change.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

Four stages, and none of them are a surprise. First a conversation about what you actually need. Then a written scope with a fixed price and a start date, sent before you commit to anything. Then the build, which you can see as it happens rather than being shown at the end. Then handover — documentation and everything you need to run it without us.

The people who scoped it. There is no arrangement here where a senior person wins the work and a junior delivers it — you will know who is on your project and you will speak to them directly rather than through an account manager relaying messages.

WhatsApp or email for day-to-day, whichever you prefer, plus a written update at each milestone. We do not require you to attend a standing weekly call to receive information that fits in a message. If something is going wrong you hear it when we find out, not at the next scheduled meeting.

Access to the relevant systems, one person on your side who can make decisions, and any content or assets the scope depends on. The most common cause of delay on this kind of work is not the build — it is waiting on approvals and material from the client side, so we agree who owns those before we begin.

We work with OAuth 2.0, WebAuthn, Auth0 and Supabase Auth for this. If your stack differs we will tell you honestly whether we are the right team before you commit — we would rather turn work down than learn a platform on your budget.

Message us with what you need. One paragraph is plenty. You'll hear back within a business day, either with a written scope and a fixed price, or with a couple of questions if something important is missing. There's no form to fill in before you get to speak to a person.

Regularly, and it usually goes fine. What makes it work is a clear split of who owns what, written down before anyone starts. What makes it fail is two suppliers with overlapping scope and no agreed boundary, which turns into a blame conversation the first time something breaks.

Often yes. We will review what exists and tell you plainly whether it is worth continuing or cheaper to redo — and we will say "continue" when that is true, even though a rebuild is the larger invoice. What we will not do is quote a rescue without looking at the state of it first.

A walkthrough at handover is included, and the documentation is written for a person who was not in the build. If you want structured training beyond that — several sessions, multiple people, recorded material — say so during scoping and it goes in as a line item rather than being assumed either way.

The person doing the work, directly. There is no account manager relaying messages, and no ticket queue between you and the answer. If it is urgent, WhatsApp reaches someone faster than email during either office's working day.

No. A scan is automated and finds known issues. A penetration test involves a person chaining findings into a real attack path. Scans are cheap and useful monthly; a proper test is a separate, more expensive engagement. Vendors blurring the two are usually selling the scan.

Automated scanning monthly, a dependency and access review quarterly, and a manual assessment annually or after any significant architecture change. More frequent testing without fixing the previous findings is spending for the sake of a report.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

The basics are, and they are not optional extras: keyboard navigation, sensible labelling, and colour contrast that a person can actually read. A full WCAG audit and remediation is a bigger piece of work with its own scope — we will tell you which you need rather than quietly implying the basics are the same thing.

We check. Anything we add is measured on a real mid-range phone before and after, because that is the device most of your traffic is on and it is where slowness actually shows. If a requested feature would cost real performance, you get told the trade-off and you decide — rather than discovering it in a report later.

Where the work touches URLs, content or page structure, yes — and we plan for it. Redirects mapped, structure preserved, nothing silently dropped. Where it does not touch those things, it will not, and we will not claim it as an SEO benefit to make the quote look better.

On real devices, not just a resized desktop browser. The two are not the same: touch targets, keyboard behaviour on forms, and how it performs on a mid-range Android are all things a resized window will happily lie about.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

If it is a defect in what we built, we fix it — that is not a support contract, it is finishing the job properly. If it breaks because something else changed, a platform update or a third-party service, we will tell you what happened and what it would take to resolve, and you decide.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

You do, outright, on final payment. Code, files, accounts, assets. Nothing sits on our infrastructure holding you in place and no licence quietly reverts to us. If you move to someone else next year, everything you need goes with you.

You get a handover: the work itself, documentation of how it is put together, and access to everything involved. We stay available for questions afterwards. There is no automatic rollover into a monthly fee — if you want ongoing support you ask for it, rather than having to cancel something you never chose.

That is the intention. The handover exists so your team is not dependent on us for routine changes. Where the work involves something your team genuinely cannot maintain, we say so during scoping rather than presenting it as a feature after the fact.

You get the before-and-after on whatever measure was agreed at the start, using the same method both times. Ongoing monthly reporting is a separate arrangement — a recurring report is a recurring cost, and it should be something you chose rather than something that appeared.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

Yes. This work is delivered remotely and we work with clients across time zones. We have offices in both countries, which in practice means a wide window of overlap with most of Europe, the Middle East and North America. Where a project needs live hours, we agree them up front.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

We'll guarantee the scope, the date and the quality of the work, because those are ours to control and they're written down. We won't guarantee an outcome that depends on your market, your competitors and platforms none of us own. Anyone promising you a specific number there is either guessing or selling.

We agree what success looks like before starting, and it has to be something measurable rather than a feeling. Whichever measure applies to your situation, you get the before figure as well as the after — reporting a result without a baseline is not evidence of anything.

Removal is often same day. Finding and closing the entry point takes longer, and skipping it means reinfection within weeks. We do both, and if we cannot identify the entry point we tell you that plainly rather than declaring it fixed.

We can implement many of the technical controls and evidence them. Certification also needs policy, process and an external auditor, which is not our role. We will map what we can cover and be explicit about what you still need elsewhere.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.

Often, yes — and if we think so, we'll tell you. Bringing us in makes sense when your team hasn't done this particular thing before, when it's a one-off that doesn't justify a hire, or when time rather than skill is what you're short of. If it's that last one, be clear with yourself that you're buying time back, not expertise you don't have.