FAQ
Questions we hear before a project starts
The same answers that appear on the service pages, collected in one place. If yours is not here, send it. We reply within one business day.
Working with us
- What does a project cost?
- Every project gets a written, fixed-price quote before work begins, so you know the total up front. Most engagements are either a fixed-scope project or a monthly retainer sized to your environment. If the budget and the problem do not line up, we say so on the first call.
- Who owns the code and the accounts?
- You do. Everything we build ships with documentation, tests, and a handover, and the cloud accounts, licenses, and source code are in your name from day one.
- Can you work with the vendors and systems we already have?
- Yes. Most projects extend or connect the tools you already pay for, and we coordinate directly with your existing IT provider, software vendors, or accountant when a change touches their systems.
- What happens after launch?
- You can keep us on a monthly retainer for monitoring, patching, backups, and support, or take the documentation and run it yourself. There is no lock-in either way.
- Can you help us get SOC 2, or another compliance review?
- Yes. We prepare the application, arrange the compliance platform, and coordinate the examination. A licensed CPA firm issues the SOC 2 report. The same kind of project covers HIPAA, PCI DSS, ISO 27001, and other frameworks a customer or regulator has named.
- How do you handle our data, especially for AI work?
- Your data stays in your own cloud tenant and is never used to train models. We sign NDAs before discovery, and our access is scoped, logged, and removed at handover.
Custom software development
- Do we have to replace everything we already use?
- No. Most projects extend or connect to the systems you already run. A full custom application is the right call when off-the-shelf tools force workarounds that cost more than they save.
- How long does a build take?
- Fixed-scope builds start at four weeks. A retained team is for continuous delivery when the work does not fit a single project.
- Who owns the code?
- You do. Every project ships with documentation, tests, and a handover so another competent team can maintain it.
- What does it cost?
- Fixed-scope builds get a written, fixed-price quote before work begins. Retained teams are billed monthly against an agreed number of hours.
- Do you build in Houston only?
- Houston is home base. We work with companies across Texas and North America, remote-first, and on-site when it helps.
Applied AI
- Do we need to train our own model?
- Usually not. Most of the value is search, drafting, classification, or summarization inside tools you already use, grounded in your own documents.
- How do you handle work that has to be right?
- We measure accuracy and keep a person in the loop where the stakes are high. A feature that cannot be checked does not ship.
- What if AI is the wrong tool?
- We say so. The engagement can start with a short assessment, and we will tell you plainly if a simpler change would do more.
- Where does our data go?
- It stays in your own cloud tenant. We use enterprise API terms that exclude model training, sign an NDA before discovery, and remove our access at handover.
Cloud and data migration
- Will the business stay up during the move?
- That is the plan. We inventory what you run, map dependencies, and sequence the move so your team keeps working. Cutover happens on a schedule you approve.
- Which clouds do you migrate to?
- AWS, Azure, and Google Cloud, plus email and tenant moves for Microsoft 365 and Google Workspace.
- What if the cutover goes wrong?
- Rollback paths are part of the plan, along with data validation before you switch over for good.
- Can you move one system without moving everything?
- Yes. Most migrations are phased. We start with an inventory and move the pieces in an order that keeps the business working, rather than treating the whole environment as one weekend.
Systems integration and modernization
- Can you connect tools we already pay for?
- Yes. ERP, CRM, accounting, and the spreadsheets in between. The goal is to remove double entry and leave one reliable source of truth.
- How long does an integration take?
- Each integration is scoped on its own, typically two to eight weeks, usually after a short discovery.
- What if a system should be replaced instead of connected?
- We will say that. Some older systems are cheaper to retire in phases than to keep integrating.
- Do you work with QuickBooks and the CRMs we already pay for?
- Yes. Most of this work connects tools you already run, including accounting, CRM, and ERP products, and retires the spreadsheet that currently sits between them.
Compliance readiness
- Do you issue the SOC 2 report?
- A licensed CPA firm examines the controls and issues the report. We prepare the application, collect the evidence, and stay on as the liaison through the examination.
- Do you build the compliance software?
- No. A compliance platform collects the evidence, and a licensed CPA firm performs the examination. We arrange both and stay on through the review.
- Is SOC 2 a certification?
- No. SOC 2 is an attestation report under the AICPA Trust Services Criteria. A Type 1 report describes how the controls are designed at a point in time. A Type 2 report describes whether those controls operated over a period, commonly three to twelve months. We will tell you which one the customer is actually asking for. The observation window is calendar time agreed with the auditor.
- What if the request is not SOC 2?
- The same kind of project covers HIPAA, PCI DSS, ISO 27001, and other frameworks a customer or regulator has named. If a framework is outside what we should take on, we say so on the first call.
Managed IT and ongoing support
- Do you only support systems you built?
- No. We support environments we build and ones we inherit, after we understand how they are set up.
- What does a retainer cover?
- Monitoring, patching, backups, help desk support, security hardening, vendor and license management, and a quarterly technology review.
- How fast do you respond?
- The retainer includes a defined response-time commitment, sized to your environment. We agree on it before work starts.
- Is this only for companies in Houston?
- No. Houston is home base. The retainer covers companies across Texas and North America. On-site work happens when it helps.
SOC 2 readiness
- Is SOC 2 a certification?
- No. SOC 2 is an attestation report. A licensed CPA firm examines the controls and issues the report. We prepare the application and coordinate the examination. We do not issue the report.
- What is the difference between SOC 2 Type 1 and Type 2?
- A Type 1 report describes how the controls are designed at a point in time. A Type 2 report describes whether those controls operated over a period, commonly three to twelve months. The observation window is calendar time agreed with the auditor. We will tell you which one the customer is actually asking for.
- What are the Trust Services Criteria?
- Security is the common criteria: access, operations, and change management. Availability covers uptime commitments. Processing Integrity covers whether processing is complete and accurate. Confidentiality covers information you have agreed to protect. Privacy covers personal information. Most first examinations are Security only, unless a customer named more.
- How long does SOC 2 readiness take?
- The remediation work is scoped in writing before it starts. A Type 2 report also includes an observation window, commonly three to twelve months, which is calendar time agreed with the auditor. We do not compress that window.
- What do we get at the end?
- A gap report, an evidence index the examiner can use, policies written for how you operate, and a handover. The CPA firm issues the report itself.
- Do you build the compliance software?
- No. A compliance platform collects the evidence, and a licensed CPA firm performs the examination. We arrange both and stay on through the review.
HIPAA readiness
- Do you certify us as HIPAA compliant?
- No. HIPAA is not a certification we can hand you. We prepare the systems and the evidence so a customer, partner, or reviewer can see how access, logging, encryption, and backups are handled.
- Is this only for hospitals?
- No. It is for smaller healthcare and health-adjacent companies, typically 20 to 500 employees, whose systems create, receive, or store health information and who have been asked to show how that information is protected.
- Will you replace our EHR?
- Usually not. Most of the work is around the systems you already run: who can sign in, what is logged, how backups are tested, and how vendors are handled. A replacement is a separate decision, and we will say if that is the real problem.
- Where does patient data go during the project?
- It stays in your environment. We do not copy it to ours. Access is scoped, logged, and removed at handover. We sign an NDA before discovery on request.
- What do we get at handover?
- A gap report, the remediation that was done, an evidence index, and policies written for how your staff works. You keep the accounts and the documentation.
PCI DSS readiness
- Do you issue the PCI report?
- No. When a formal report of compliance is required, a qualified security assessor issues it. We prepare the systems and the evidence and coordinate the work.
- Can we get card data out of our systems?
- Often, yes. Using a hosted payment page or a tokenization setup can shrink the scope dramatically. We will say when that is the better project, and when you still have systems that must meet the requirements.
- Is this a self-assessment or a full audit?
- That depends on how many transactions you process and how your acquirer classifies you. We will not guess. The written scope names the path they are asking for.
- What do we get at handover?
- A gap report, the remediation that was completed, an evidence index, and documentation your team can keep. The assessor's report, if one is required, comes from the assessor.
- Do you store card numbers while you work?
- No. We do not copy cardholder data into our environment. Access to your systems is scoped, logged, and removed at handover.
ISO 27001 readiness
- Do you issue the ISO 27001 certificate?
- No. An accredited certification body audits the management system and issues the certificate. We prepare the scope, the controls, and the evidence, and we stay on through the audit.
- How is this different from SOC 2?
- SOC 2 is an attestation report issued by a licensed CPA firm about controls over a period or at a point in time. ISO 27001 is a certification of a management system by an accredited body. Customers sometimes say one and mean the other. The written scope names which one they asked for.
- Do we have to certify the whole company?
- Not always. The scope can be the system or the part of the business the customer cares about. A scope that is wider than the request wastes time. We write it down before the work starts.
- What do we get at handover?
- A gap report, policies written for how you operate, an evidence index, and a handover. The certificate, if the audit succeeds, comes from the certification body.
- Can this sit alongside SOC 2 work?
- Yes, when a customer has named both. A lot of the application work overlaps: access, logging, change management, backups. We will not pretend the two reports are the same thing.
Have a project in mind?
Tell us what you are working on. We reply within one business day.