A SOC 2 Type II observation window cannot start until controls are actually operating. Every week of unremediated findings pushes the report — and the enterprise contract waiting on it — a week further out. The platform generates the ticket, the auditor is barred from closing it, and the work lands on a product team already behind on roadmap.
Why teams choose us.
Engineers, Not Advisors
We write the Terraform, wire the SSO, stand up the log retention and ship the CI gates. You get commits, not a recommendations deck.
Your Change Process
We write the change; your named approver merges it, inside your change window, with a documented rollback. Nothing lands in production on our authority.
Evidence In Their Format
Every fix is written back to your compliance platform as evidence, and we take the auditor's questions directly during fieldwork.
Month-To-Month
No annual lock-in. A typical programme runs four months, and the pod converts to permanent headcount whenever you want to own it.
The full menu.
Identity & Access
- SSO and SCIM rollout
- MFA enforcement across the estate
- Least-privilege IAM refactor
- Quarterly access reviews, automated
Logging, Encryption & Retention
- Centralised logging with retention policy
- Encryption at rest and key management
- Backup and restore testing, evidenced
- Delivered as infrastructure-as-code
Secure SDLC & CI/CD
- Security gates in the pipeline
- Secret scanning and rotation
- SAST/SCA with a triage owner
- Dependency and base-image policy
Contractor & Offboarding Controls
- Asset retrieval process, documented
- Same-day access revocation on exit
- Joiner-mover-leaver runbook
- The 2022 SOC 2 points of focus, closed
Audit Liaison
- Evidence written back to your platform
- Auditor questions answered directly
- Fieldwork support during the window
- Weekly progress your auditor can read
Our process.
Backlog Triage
Your findings — ours, your platform's, or your auditor's — land in your tracker, deduplicated, owned and sequenced by what blocks the observation window.
Pod Starts
Two or three engineers plus a named principal for the auditor-facing conversation. Weekly demo, weekly written progress, your sprint cadence.
Ship & Evidence
Each control closed, evidenced, and written back to your platform. We do not mark a control done until the evidence would survive fieldwork.
Hand Over Or Keep
At the end you either take the runbooks in-house, or convert the pod to permanent managed headcount at EOR rates.
What we build with.
Who does what in a compliance programme
Where a pod can operate
This is the service with the most production-data contact, so it carries the most jurisdictional constraint. We would rather set that out here than in a diligence call.
The best fit anywhere. Fourteen of our sixteen core services are unconstrained here, rates are the highest in the portfolio's addressable set, and no US privacy regime imposes data localisation.
Closed: US federal, ITAR/EAR and CUI environments — those restrictions are structural, not procedural. Healthcare is scoped no-PHI-in-scope, which usually removes most of the value, so we will normally decline rather than sell you something thin.
Deliverable for private-sector clients, contracted as fixed-scope, change-controlled projects — never as ongoing administration.
That wording is deliberate. The Cyber Security and Resilience Bill defines a relevant managed service provider to include firms providing ongoing support, maintenance, monitoring or active administration of a customer's systems accessed remotely, with 24-hour incident reporting and fines to £17m or 4% of global turnover. Project framing keeps the engagement outside that definition.
Possible as a fixed-scope engineering project from our US entity, with no managed-service framing and no ongoing administration.
Every EU deal carries a per-deal legal cost no other market imposes: an Article 28 processor agreement, SCC Module 2 or 3, a documented Transfer Impact Assessment and supplementary measures, because India has no EU adequacy decision and the published timeline puts a possible decision no earlier than 2028–29. Expect us to say the CRA product-readiness engagement is the better first step.
Deliverable for mainland commercial clients. This is our second-priority market and the Dubai office fronts delivery.
Closed outright where hard localisation applies: health data may not be processed or transferred outside the UAE, financial-services customer data must stay in-country, and DESC ISR v3 requires in-country processing for Dubai government data and regulated-sector pipelines.
Every market position we hold, with the legal reason and the transfer mechanism, is on where we work.
Choose this if...
Honest about who this is for.
This will be a fit.
- You have a compliance platform and an auditor already, and just need the work done
- You want commits and evidence, not a recommendations deck
- You are comfortable with your own approver merging every production change
- You would consider converting the pod to permanent headcount later
Honestly — not our zone.
- —You want us to sign off on control adequacy or guarantee an audit outcome — we do not and cannot
- —You want monitoring, detection or incident response. We sell none of those and carry no response SLA
- —You want penetration testing under our name — that is referred to a named CREST-accredited partner
- —You need production changes made without a named approver on your side