Security and compliance

Managed lanes

One responsibility kept true every month, for one team.

• Composed outcome

  A managed compliance evidence lane: evidence index, access reviews and policy checks

  For one control area of one framework: evidence refreshed each quarter, access reviews recorded, policies checked against systems monthly, and one bounded item a month. Proposed GBP 695 a month.

  Quote after scope check

• Composed outcome

  A managed security assurance lane: answers, app reviews and a monthly sign-in review

  For one company: your answer library kept current, a quarterly connected-app review, a monthly sign-in review and one bounded item a month. Proposed GBP 615 a month; timing by written proposal.

  Quote after scope check

Monthly services

Each one re-tests and tunes the work above every month.

• Recurring responsibility

  Keep your register of personal-data uses and suppliers current as you add tools

  Each month new suppliers and tools found in your app lists and invoices are added to the register with a source, and ended or changed ones are flagged. The legal columns stay yours.

  £95/month · untested offer price

• Recurring responsibility

  Get your audit evidence index refreshed every quarter for one control area

  Each quarter the same control area is re-exported, hashed and re-indexed, with new and closed gaps listed. We write no evidence and make no claim about the framework.

  £175/month · untested offer price

• Recurring responsibility

  Get a monthly check that your policies are in date and still match what your systems show

  Each month a report lists policies past their review date and statements that no longer match your systems, such as "MFA for all" against three accounts without it, with both quotes.

  £125/month · untested offer price

• Recurring responsibility

  Get your quarterly access review ready to sign, with decisions and exceptions recorded

  Each quarter a review pack per system (user, role, last use) goes to your named reviewer. Their decisions are recorded with dates, exceptions are tracked to closure, and you get a record to sign.

  £95/month · untested offer price

• Recurring responsibility

  Keep alert triage and paging running all hours, with the timings reported each month

  Alerts from your named tools are sorted and serious ones paged to your on-call person at any hour, with each month's page times, misses and silent feeds reported. We fix nothing.

  £195/month · untested offer price

• Recurring responsibility

  Keep your security answer library current as your policies change

  Each month your security answers are checked against current policies, stale or contradictory ones flagged, and the unknown list updated. Questionnaire drafts are a separate job.

  £95/month · untested offer price

• Recurring responsibility

  Get a monthly review of risky sign-ins, new admins and new mail forwards

  Each month you get a list of risky sign-ins, new admins, new forwarding rules and unfamiliar locations in your Microsoft 365 or Google tenant, with the log rows and a question for you. Not monitoring.

  £145/month · untested offer price

• Recurring responsibility

  Get each month's new secret and code-scanning alerts sorted, with what to fix first

  Each month new secret-scanning and code-scanning alerts are classed fix now, can wait, false positive or needs an owner, with evidence. No code changed, no alert closed. Dependabot is separate.

  £145/month · untested offer price

• Recurring responsibility

  Get your connected-app permissions reviewed again every quarter, with what changed

  Each quarter you get the list of outside apps with access to your Microsoft 365 or Google account: what was added, removed or widened, unknown ones flagged and a named owner for each.

  £75/month · untested offer price

• Recurring responsibility

  Get your week's security alerts sorted into act, watch and ignore, with the reason

  Each week the alerts your security tools raised come back sorted into act, watch and ignore, each with a reason. Not round-the-clock cover, and nothing is acted on for you.

  £175/month · untested offer price

Assistants and drafting

Answers and drafts from your own material, with a person approving what goes out.

• One-off outcome

  Get a security questionnaire drafted only from your own approved answers

  A customer's security questionnaire returned in their format as a first draft. Every answer cites your own approved answer or policy, and anything unsupported is left blank for a named person.

  £149 · untested offer price

Sort and route

Incoming messages, tickets, orders and requests sorted into your categories.

• One-off outcome

  Test all-hours security triage and paging: measured 10-minute target, not a guarantee

  Set up automated triage for up to three alert tools and test paging to your named on-call person against a measured 10-minute intake-to-device target, not a guarantee. We investigate and fix nothing.

  £395 · untested offer price

• One-off outcome

  Get your staff phishing reports sorted with a reason and a draft reply for each

  Forwarded suspicious emails come back classified as phish, spam, genuine or unclear, with the reason and a draft thank-you for the reporter. A person acts on each one; we take no action.

  £149 · untested offer price

• One-off outcome

  Get open secret and code-scanning alerts sorted into fix now, can wait and false alarm

  Each open secret-scanning and code-scanning alert is classed fix now, can wait, false positive or needs an owner, with evidence. We change no code and never use a found secret. Dependabot is separate.

  £295 · untested offer price

Documents and text to data

Documents, emails and free text turned into checked rows.

• One-off outcome

  Get liability, termination and other contract terms in one sheet, each with page and quote

  Parties, term length, termination, liability cap, assignment, governing law and more for up to 40 contracts in one sheet, each value with page and quote. Dates are a separate job.

  £295 · untested offer price

• One-off outcome

  Get a first draft of your register of personal-data uses and suppliers, each line sourced

  A first-draft register of where you use personal data and which suppliers are involved, each line sourced from an app list, invoice or note. Unknowns are listed for your owner.

  £249 · untested offer price

• One-off outcome

  Get a tool, run on your systems, that lists the documents and emails mentioning one person

  For one subject access request, an index of candidate documents and emails that mention the named person, built by a tool you run on your own systems. We never see the content.

  £295 · untested offer price

Review and moderate

Content, code and changes checked against your own rules.

• One-off outcome

  Get contract clauses checked against your own written positions, with differences flagged

  Each contract is compared with the positions your own team has written, such as "no uncapped liability". Differences are flagged with page and quote for your lawyer or owner to decide.

  £295 · untested offer price

• One-off outcome

  Find your Cyber Essentials gaps and get the self-assessment answers drafted

  A gap list against the five Cyber Essentials controls and a drafted answer for each question, tied to evidence, for your director to check and submit. The assessor decides, not us.

  £295 · untested offer price

• One-off outcome

  Get proposed redactions on subject access documents, for your handler to accept or reject

  For one subject access request, proposed redactions of other people's details in documents your handler selects. Each cites the rule your handler set, and the handler decides every one.

  £295 · untested offer price

Watch and flag

Systems and data watched, with exceptions flagged and the evidence attached.

• One-off outcome

  Find what your own domains expose to the internet, with a ranked list of what to fix

  With your written authorisation we check only the domains you list for exposed services, weak TLS, missing headers and public files. You get a ranked list of what to fix, with the evidence for each.

  £295 · untested offer price

• One-off outcome

  Get a list of the outside apps connected to your Microsoft 365 or Google account

  A list of the third-party apps that hold a consent grant in your export, what each can reach, when it was last used and who owns it. Unknown or unusually broad ones are flagged for you to review.

  £195 · untested offer price

Knowledge and reports

Help pages, documentation and reports kept current and traceable.

• One-off outcome

  Get a register of the AI tools your staff use and a draft use policy to edit

  A register of the AI tools used in your company, found from app lists, expense lines and consent grants, with the data each may touch, plus a draft use policy for your owner to edit.

  £195 · untested offer price

• One-off outcome

  Get an audit evidence pack for one control area, with dated exports and gaps named

  For one control area, such as access control, you get dated, hashed exports from your own systems mapped to the control text, with population, sample and gaps named. We write no evidence.

  £395 · untested offer price

• One-off outcome

  Get a subject access request runbook and deadline tracker, tested on a dummy request

  A runbook, intake form, deadline tracker and search plan for subject access requests, proved end to end on a synthetic request. The legal calls stay with your named handler.

  £195 · untested offer price

• One-off outcome

  Get security policies drafted from what you really do, each line confirmed

  Up to 6 short policies, such as access and backup, written from a fact sheet your owner fills in. Every sentence is confirmed as true today; what you do not do becomes a goal, not a claim.

  £295 · untested offer price

• One-off outcome

  Get a reusable library of security answers built from your own policies

  A sheet of 50 to 150 question-and-answer pairs covering the usual security questions. Each answer cites your policy page or an owner's written confirmation, and gaps are listed, not filled.

  £295 · untested offer price

Guides for this work

• Troubleshooting guide

  Read-only roles for reviewing a Microsoft 365 or Google tenant, and why connected apps matter

  Which built-in roles and scopes let a reviewer read sign-in and audit logs without changing anything, which role can also read app consent grants, what native access reviews need, and why connected apps matter.

• Troubleshooting guide

  Subject access requests: the clock, the reasonable search and what you must document

  What the ICO guide says about the one-month deadline, extensions, a proportionate search, exemptions and refusals, and where a written process helps.

• Troubleshooting guide

  Answer a security questionnaire only from a source, and leave the rest blank

  A short method for a late-stage customer questionnaire: one master sheet, a source for every answer, blanks for the rest, and a named signer.

• Troubleshooting guide

  Cyber Essentials in plain words: the five controls, the two routes and who decides

  What the UK scheme covers, how self-led and supported routes differ, what Plus adds, and why no one can promise you will pass.

Examples you can inspect

• Inspectable example

  Pass-mark arithmetic: what 38 out of 40 does and does not show about an AI-drafted answer set

  A table and a short script that turn a test result such as 38 of 40 into the lowest true pass rate it supports, with 95 percent confidence.