We run the function. You watch it run.
The shape of the deal
Every line below appears in the agreement you sign.
- Retainer
- One flat monthly fee
- Structure
- Base operations fee plus a per-user rate
- Term
- 3 years, multi-year options
- Growth billing
- Quarterly true-forward
- Annual increases
- Capped in writing
- Operators
- Named, working in your portal
- Severity-1
- Staffed 24/7
Comparing routes? The published tiers live under See plans.
The scope
What we run for you
One function absorbs the queue, the identities, the risks, and the evidence; one team runs it. What follows is the standing scope of every operated partnership, and nothing on it arrives later as a surprise line item.
IT and service deskbase
The queue your company feels every day. Requests and incidents worked by named operators, each with an SLA clock your team can watch.
Access lifecyclebase
Joiners, movers, and leavers handled the day they happen. Every grant is requested, approved, and evidenced in one place.
Risk registerbase
A live register with owners and review dates. Your admins propose entries, and an operator confirms each one before it stands.
Evidencebase
Control evidence collected on a calendar and kept current in the vault, ready for the next audit or the next customer review.
Security operationsnamed module
Endpoints and identity watched around the clock under the detection and response module, with severity-1 staffed 24/7.
Compliance operationsnamed module
Framework programs run end to end under the compliance operations module: control calendar, evidence collection, and audit management.
The market math on the tool stack a function like this replaces lives on its own page, with a source and a date on every line. Read the math on the stack
Visibility
What your team sees
A function we run is still your function. Your team keeps a live view of everything we do, in the same portal our operators work from, for the life of the contract.
An illustrative sketch. The live portal, with real anonymized views, is on the platform page.
- RequestsEvery open item, who owns it, and the SLA clock running against it. Nothing is worked out of view.
- Risk registerA live register with operator review. Your admins propose entries, and an operator confirms or declines each one.
- Evidence vaultThe control evidence library, current and exportable, with time-bounded guest access for your auditor.
- Retainer burnWhere the month went, itemized in minutes against the flat fee. You see burn exactly the way we see it.
- CoverageWho is on shift and when, published in the portal, so you can check severity coverage on any day of the term.
How the agreement works
Built to be operated for the long run
The commercial shape is summarized in the term sheet above, and the published pricing lives on the plans page. Here is how the agreement itself is put together, so none of the terms land as a surprise when the order form does.
3-year terms
Running a function well takes tenure, and the term is built for it. Multi-year options extend the same structure, cap included.
Quarterly true-forward
Headcount is counted at each quarter's close. Growth bills forward from the next quarter; nothing is retroactive and nothing is prorated behind you.
A written escalator cap
The maximum annual increase is a number printed in your agreement, fixed before you sign. You know the ceiling on renewal pricing going in.
One-time implementation
A single implementation fee stands the function up: inventory, portal rollout, and the scoped first quarter you can read about below.
The bar under all of this is the same one under every Cloud Sentry plan: the platform, named operators, published flat pricing, and a written escalator cap. The partnership is simply the largest thing built on it.
Where we stop
The work we don't take on, and who we hand you to
A partnership works when the boundaries are written down. These are the engagements we do not take, and what we do instead.
- Penetration testing and red team. We read configuration; we do not probe defenses. When you need one, we scope it with a named testing partner and sit on your side of the table.
- Deep digital forensics. We keep you forensics-ready with retention, preservation, and response. Full DFIR beyond that goes to a named partner or scoped time and materials.
- Crisis communications. Breach PR and notification strategy belong with counsel and communications specialists. We support them with the technical record.
- Privacy counsel. We prepare the evidence and the posture; legal advice comes from lawyers.
- The audit itself. We get you ready and hand your auditor a clean vault. Independent firms certify; we never grade our own homework.
- Physical security. Badges, cameras, and doors are a different trade. We will say so, and point you to one.
Where it runs
Run it hosted, or self-hosted in your own cloud
Standard delivery is the hosted platform: we run it, patch it, and answer for it. When residency or procurement rules out shared infrastructure, the same platform is self-hosted, deployed single-tenant inside a cloud account you already own, AWS included. You keep the boundary; we keep the upgrade path, the patching, and severity-1 response 24/7.
- Your account, your region, your keys. The platform stands up single-tenant inside a cloud account you already govern, AWS included, and your security team can audit the deployment directly.
- Built for the deals that demand it. Data-residency clauses, regulated buyers, and security teams that will not accept shared infrastructure. Self-hosted single-tenant answers all three without changing how the function runs.
- Single-tenant never means version-frozen. Your deployment rides the same release train as the hosted platform, on a cadence written into the engagement.
- Coverage is identical. The operating team, the SLA clocks, and severity-1 response work the same way they do on hosted delivery.
Available for qualified engagements. Qualification is part of the discovery call.
The engagement
How the engagement runs
Every partnership starts the same way and settles into the same rhythm. We tell you what we see on the first call, including whether the partnership is the wrong shape for you.
The discovery call
Thirty minutes with an operations lead. We walk your current stack, size the user band from your real headcount, confirm BYOC qualification if you need it, and give you a plain read on fit.
- Current stack walked end to end
- User band sized from real headcount
- BYOC qualification confirmed if needed
- A plain yes or no on fit
The first quarter, scoped
Implementation runs as a scoped quarter with named owners and dates. Your operators are introduced by name, the portal goes live for your whole company, and the SLA clocks start where everyone can see them.
- Named operators introduced before work begins
- Systems and access inventoried and documented
- Portal live for your whole company
- SLA clocks running from the first ticket
The operating rhythm
From the second quarter the partnership is a cadence. The queue is worked daily, evidence is collected on the calendar, and each quarter closes with a written review carrying the numbers behind every claim we make about our own performance.
- Daily: the queue, access work, and the monitoring your modules cover
- Monthly: retainer burn reviewed in the portal, in minutes
- Quarterly: the written review, the true-forward count, and the road ahead
Scope it in one call.
Thirty minutes with an operations lead. We walk your stack, size the user band, and tell you plainly if the partnership is the wrong shape for you.
Bring your renewal invoices and your headcount. We put real numbers into the structure on this page before anything gets signed.
Prefer to start smaller? The published tiers use the same grammar, a base operations fee plus a per-user rate, and the entry rung self-enrolls.