Your biggest deal is gated by a security review you cannot answer.

Wazuh for SIEM and XDR (centralised logging, file integrity, threat detection), Keycloak for identity and SSO with enforced MFA, Teleport for privileged-access management with audited session recording, Velociraptor for endpoint visibility and incident-response forensics, SonarQube for SAST and secure-SDLC gates on every pull request, and OpenVAS for vulnerability scanning on a defined cadence. All six are open-source and licensed for commercial use. We deploy them into an adjacent AWS, GCP, or Azure tenant connected to your production environment, and configure them against the controls your framework actually requires.

The engagement runs as four sequenced steps: scope the framework, deploy the stack into an adjacent connected tenant, collect evidence and prepare for the audit, then run audit fieldwork and complete the prospect's questionnaire. Steps overlap deliberately — stack deployment starts as soon as the adjacent tenant is stood up and connected, not after scoping wraps. We do not promise a fixed calendar because the pace depends on the size of your production environment, the framework, and how responsive your team can be — but the deploy step is measured in days, not quarters. If a prospect's deadline is tight, we sequence the questionnaire-rescue work in parallel so the deal advances while the full programme runs.

Whichever one your prospect requires. We do not start with the most ambitious framework; we start with the one that unblocks the deal. SOC 2 Type I is the fastest path to audit-grade evidence for North American buyers. ISO 27001:2022 is often the right call for European or multinational buyers. HIPAA is the answer if the data is health-related. We confirm in the scoping call, not before.

Two different products. Drata and Vanta monitor controls you already have — they do not deploy the controls themselves. Our engagement deploys the controls: an open-source stack that lives in an adjacent connected tenant you own, instrumented for the same evidence Drata or Vanta would collect. If you already pay for one of those platforms and want to keep it, we configure it alongside the stack. If you do not, you do not need to start — the stack produces the evidence directly.

It keeps running. Every component is open-source, deployed in an adjacent tenant you own, with documentation and runbooks left in your repo. We will hand off to your engineers in a structured way. The whole point of the open-source-into-an-adjacent-tenant model is that the evidence engine is not held hostage by us, by Drata, or by any other vendor.

Run the deal-blocking questionnaire through our Security Questionnaire Rescue service in about three days, and start the full programme in parallel. The questionnaire bridges the gap until the audit evidence catches up.

Not immediately. The programme ships with a monthly review cadence and a compliance dashboard so the founder or CTO can stay in control without becoming the security organisation. Most clients add a fractional security lead in the 12–18 month window, after the second annual audit.

Flat engagement fee, quoted from the scoping call before any build work starts. The scope drives the number — framework, in-scope systems, audit firm fees — and we publish the breakdown in writing. We do not bill hourly, we do not charge change orders for controls that were always going to be required, and the stack carries zero per-user pricing — your headcount can grow without your compliance bill following it.