Managed lane security-assurance-lane · revised 12 October 2026
Managed lane
A managed security assurance lane: answers, app reviews and a monthly sign-in review
For one company: your answer library kept current, a quarterly connected-app review, a monthly sign-in review and one bounded item a month. Proposed GBP 615 a month; timing by written proposal.
An enquiry starts a fit and scope conversation, not a contract, payment or reserved place. No logins, customer data or account invitations initially.
What the lane takes off your plate
Customer security reviews keep coming, and the answers, the app permissions and the sign-in checks behind them each need a regular owner. Buying each piece on its own works, but someone must decide what comes first each month. Without one arrangement, the work waits until the next deal is blocked.
Who it’s for: Founder or operations lead of a small company that answers customer security questionnaires and wants one accountable monthly arrangement for the paperwork and the checks behind it.
Usually starts when: Questionnaires arrive several times a year, the answers drift, and nobody owns the checks that would make them true.
The result: Each month your answer library is checked against your policies and your sign-in activity is reviewed from exports, and each quarter your connected-app permissions are reviewed. One bounded item a month, chosen from the listed jobs, is delivered and accepted, with a written summary of what was done, held and left open.
What the lane is made of
Each standing report is checked against its own acceptance tests, and each item has agreed acceptance criteria and an accept-or-revise decision. One item is a monthly ceiling, not a completion guarantee. The arrangement continues only under agreed renewal terms.
Keep your security answer library current as your policies change Standing service Included
Each month your security answers are checked against current policies, stale or contradictory ones flagged, and the unknown list updated. Questionnaire drafts are a separate job.
Every month, for the named library
The same standing service you can buy on its own at its listed price.
Get a monthly review of risky sign-ins, new admins and new mail forwards Standing service Included
Each month you get a list of risky sign-ins, new admins, new forwarding rules and unfamiliar locations in your Microsoft 365 or Google tenant, with the log rows and a question for you. Not monitoring.
Every month, one tenant of up to 100 users
The same standing service you can buy on its own at its listed price.
Get your connected-app permissions reviewed again every quarter, with what changed Standing service Included
Each quarter you get the list of outside apps with access to your Microsoft 365 or Google account: what was added, removed or widened, unknown ones flagged and a named owner for each.
Every quarter, up to 150 grants
The same standing service you can buy on its own at its listed price.
Get a reusable library of security answers built from your own policies Job Each time it fires
A sheet of 50 to 150 question-and-answer pairs covering the usual security questions. Each answer cites your policy page or an owner's written confirmation, and gaps are listed, not filled.
As the first item if you have no library, within the monthly allowance
The library the monthly check keeps current.
Get a security questionnaire drafted only from your own approved answers Job Each time it fires
A customer's security questionnaire returned in their format as a first draft. Every answer cites your own approved answer or policy, and anything unsupported is left blank for a named person.
One questionnaire a month, within the monthly allowance
Used when a questionnaire arrives; your reviewer signs the final.
Get your staff phishing reports sorted with a reason and a draft reply for each Job Optional
Forwarded suspicious emails come back classified as phish, spam, genuine or unclear, with the reason and a draft thank-you for the reporter. A person acts on each one; we take no action.
One batch, within the monthly allowance
Get open secret and code-scanning alerts sorted into fix now, can wait and false alarm Job Optional
Each open secret-scanning and code-scanning alert is classed fix now, can wait, false positive or needs an owner, with evidence. We change no code and never use a found secret. Dependabot is separate.
As the only item that month, for up to 100 alerts: its listed price is almost the whole allowance
Find what your own domains expose to the internet, with a ranked list of what to fix Job Optional
With your written authorisation we check only the domains you list for exposed services, weak TLS, missing headers and public files. You get a ranked list of what to fix, with the evidence for each.
As the only item that month, for up to 10 hostnames, after a signed authorisation
Get each month's new secret and code-scanning alerts sorted, with what to fix first Standing service Optional
Each month new secret-scanning and code-scanning alerts are classed fix now, can wait, false positive or needs an owner, with evidence. No code changed, no alert closed. Dependabot is separate.
Bought separately
A standing service of its own, not part of the monthly allowance.
Get your week's security alerts sorted into act, watch and ignore, with the reason Standing service Optional
Each week the alerts your security tools raised come back sorted into act, watch and ignore, each with a reason. Not round-the-clock cover, and nothing is acted on for you.
Bought separately
A standing weekly sort of exported alerts, not part of the monthly allowance.
Find your Cyber Essentials gaps and get the self-assessment answers drafted Job Optional
A gap list against the five Cyber Essentials controls and a drafted answer for each question, tied to evidence, for your director to check and submit. The assessor decides, not us.
Bought separately
For UK companies asked for a Cyber Essentials certificate.
How an engagement works
One company, one active item at a time and at most one agreed bounded item a month, worth up to GBP 300 at its listed one-off price. One is a ceiling, not a promise of completion, unlimited throughput or a fixed turnaround. Delivery days and monthly capacity are confirmed in writing; none is promised on this page.
How it starts
You send a short description of the company, your policies by title, your questionnaire volume and your response to the proposed monthly price, without logins or documents.
We confirm fit, the tenant, who signs answers and who makes changes.
We agree the monthly scope, delivery days, item sizes, price, payment terms and cancellation terms in writing.
Each month we send the reports due that month, deliver the chosen item and send the summary.
Who decides what
You choose items, sign every answer and make every change in your own systems. We propose; you decide.
Handover
Each accepted item arrives as files and a sheet with its evidence. If the arrangement ends, the library, reports and open findings are handed back to you.
Sharing your product safely. Initial contact uses a short description and titles of your policies. No logins, questionnaires or customer data. Private access follows only after a safe handoff and written terms.
What is included, and what is not
- The reports from the three standing services (two monthly, one quarterly)
- Each accepted item with its evidence
- A monthly summary and the list of open findings
Included
- One company: one Microsoft 365 or Google Workspace tenant of up to 100 users and one answer library of up to 150 pairs
- The three standing services: the answer library kept current (monthly), the sign-in review (monthly) and the connected-app review (quarterly)
- One bounded item a month, one active at a time, chosen from the listed jobs. A bounded item is one listed job at no more than its starting scope and worth no more than GBP 300 at its listed one-off price; a larger item is quoted separately
- A written proposal that fixes the delivery days and the monthly capacity
- A written monthly summary of what was reviewed, delivered, held and still open
Not included
- Sending any answer to a customer, or contacting anyone on your behalf
- Any promise of a certification, a pass or an audit result: the assessor or auditor decides
- Changing, disabling or deleting anything in your live systems: your administrator does that
- Watching your systems between reports, round-the-clock cover or any guaranteed response time
- Items larger than a listed job's starting scope, which are quoted separately
How we know it’s done
Agreed with you before work starts. Each check produces evidence you keep.
Each month the summary lists every standing report due that month with its delivery date, matching the dates in the proposal.
Evidence: The monthly summary beside the proposal.
Each standing report meets its own acceptance tests, such as the planted-event smoke test for the sign-in review and a source for every library answer.
Evidence: Each report with its test results.
Each month no more than one item was delivered or started, and its listed one-off price is no more than GBP 300.
Evidence: The monthly summary, listing the item with the job it matches and that job's listed price.
No change was made in your systems and nothing was sent to a customer or any third party by us.
Evidence: Your own audit logs, showing no writes by our access, and your sent mail.
Sign-off. You read each report, sign every answer, accept or send back each item and read the monthly summary.
If it fails. A blocker is raised with a substitute item, revised timing or a stop. Work that does not meet its criteria is not claimed as delivered. Billing for incomplete work is agreed before starting.
When it fits, and when we stop
It fits when
- One tenant and one answer library, or the library job as the first item
- A named owner who chooses items, signs answers and replies to the monthly questions
- An administrator who can create a read-only role or run exports, and who makes any change
- Written policies that the answers can cite
We stop and tell you if
- You want answers sent to customers for you, or claims made that your documents do not support
- You need round-the-clock monitoring or a response time
- Nobody on your side can sign answers or make changes
- The agreed items regularly exceed one a month or GBP 300 of listed jobs, so we agree a different scope
What could go wrong
Everything is read-only analysis and drafts. Ending the arrangement leaves your systems as they are, and you keep every report and file we sent.
Scroll the table sideways to read it all.
| Risk | How we handle it |
|---|---|
| The allowance is read as unlimited help | The proposal states one bounded item a month worth up to GBP 300 at its listed price, one active at a time. Extra or larger work is quoted. |
| The lane is mistaken for monitoring or a security operations centre | It says plainly that nobody watches between reports and there is no response time, round-the-clock cover or incident response. |
| A drafted answer is sent without being checked | We never send answers. Your named owner signs each one, and every filled answer cites a source. |
| Read-only access is wider than it looks | Your administrator creates the role and checks what it can see before it is used. Exports limited to the needed fields are preferred. |
| Your files pass through an AI model provider | The written proposal names the provider type, its country and how long it keeps data before you send anything. Entry items use redacted or synthetic copies, or your own provider account if you prefer. We delete our copies when the arrangement ends. |
A separate automated reviewer checks each report and item before it is sent. Your named owner signs every answer and accepts every item. No human supervisor is included unless your proposal names one, and at launch the work is largely automated.
Stays with a person
- Your named owner signs every answer and accepts every item
- Your administrator makes every change in your systems
Access we would need
- A read-only role or exports for sign-in logs and app grants
- Redacted copies of policies, answers and questionnaires, sent by an agreed secure route
Questions
Is this a security operations centre or managed detection?
No. It is a monthly and quarterly set of reviews and drafts. Nobody watches between reports, and there is no response time or incident response.
Can I buy the parts separately?
Yes. Every standing service and listed job is available on its own. The proposed price equals their listed prices at full use, so the lane adds one arrangement with delivery days and capacity confirmed in writing, not a discount.
Will you send questionnaires to my customers?
No. We return drafts to you. Your named owner signs them and you send them.
What if I need more than one item a month?
Extra items are quoted separately, or we agree a different scope.
Start a conversation
Send us
- What you use: Microsoft 365 or Google Workspace, roughly how many users and how many questionnaires you answered last year
- The policies you have, as a list of titles
- Who would own the arrangement. No logins, policies or questionnaires in the first enquiry
- Your response to the proposed monthly price
Later, once you agree
- A read-only role, or exports, for sign-in logs and app grants, created by your administrator and removable by you
- Redacted copies of your policies and answers through a secure route
- A named owner and a second contact
- A company-controlled secure handoff agreed before access: no live passwords, keys, private code or customer records by ordinary email.
You keep your systems, policies and every decision. We work on exports or a read-only role that you create and can remove, and on redacted copies you send. We never change a live system and never send anything to a customer.
Email fallback: open your mail app
If website submission is unavailable, review and send the fallback email yourself. An email fallback is not a website receipt. Or write to hello@syntheticindustry.ai with “security-assurance-lane” as the subject.