Clear scope. Written terms.
Protection that fits where you are.
Start with the problem you need to solve. Each engagement defines the assets, work, exclusions and next steps before it begins.
Working commercial draft: prices, capacity, terms and service times require owner confirmation. No purchase or paid assessment is available in this preview.
What brings you here?
Suggested starting point
Discuss this package →Security Foundation
A stronger starting point for every account you own.
Protect your presence
Intelligence & investigations
Platforms, registrars and hosts make the final decisions on recovery and removal. We cannot promise their outcomes.
The full specification.
Security Foundation
- Description
- A stronger starting point for every account you own.
- Unit
- one-off
- Duration
- 2–3 weeks
- Assets
- Up to 5 accounts, 1 Meta portfolio and 1 Google account
- Hours
- Up to 16 analyst hours
- Monitoring
- Point-in-time assessment; no ongoing monitoring
- Reporting
- Assessment and 45-minute walkthrough
- Actions
- Hardening sessions, access register, response playbook and staff briefing
- Term
- Fixed scope
- Extras
- $150 per additional account; workshops and on-site work separately scoped
- Exclusions
- No penetration testing, device forensics or managed IT
- Cancellation
- Full refund before kickoff; 50% after kickoff (draft)
- Support
- Business hours during the engagement
- Sla
- Standard acknowledgment and assessment
- Audience
- Businesses and agencies
Recovery Assistance
- Description
- A clear assessment. An official route. A person beside you.
- Unit
- assessment
- Duration
- Assessed before engagement
- Assets
- Affected accounts named in the engagement
- Hours
- Further work scoped in writing
- Monitoring
- No ongoing monitoring
- Reporting
- Updates every 2 business days or on material change
- Actions
- Evidence checklist, official guidance, follow-up and hardening checklist
- Term
- Assessment then separate scoped engagement
- Extras
- Further support quoted per case; assessment credited
- Exclusions
- No verification bypass, unauthorized access, funds recovery or promised outcomes
- Cancellation
- Assessment fee covers analysis delivered, even when further work is unsuitable (draft)
- Support
- Urgent assessment, then business hours
- Sla
- Urgent acknowledgment and assessment
- Audience
- Verified owners and authorized representatives
Brand Protection
- Description
- Find the impersonation. Check the evidence. Take action.
- Unit
- per month
- Duration
- Monthly managed service
- Assets
- 1 brand, 3 executives, 5 handles and 3 domains
- Hours
- Up to 8 analyst hours per month
- Monitoring
- Permitted public sources and domain monitoring; tooling pending
- Reporting
- Monthly report and high-harm notices in business hours
- Actions
- Up to 25 enforcement submissions per month
- Term
- 3-month minimum, then month to month (draft)
- Extras
- Additional brands and blocks of 25 actions; legal escalation separately scoped
- Exclusions
- No litigation, legitimate criticism removal or promised takedowns
- Cancellation
- 30 days’ notice after minimum term (draft)
- Support
- Business hours
- Sla
- Standard; high-harm findings use urgent pathway
- Audience
- Brands, creators and executives
Managed Protection & Intelligence
- Description
- One coordinated plan for a more complex digital presence.
- Unit
- tailored retainer
- Duration
- Agreed engagement scope
- Assets
- Multiple brands, executives and markets, scoped individually
- Hours
- Agreed analyst allocation
- Monitoring
- Brand protection across agreed assets and markets
- Reporting
- Monthly reports and quarterly leadership briefings
- Actions
- Protection, annual security review and intelligence briefings
- Term
- 6-month minimum (draft)
- Extras
- Additional markets and extended coverage by agreement
- Exclusions
- No unsupported markets or unstaffed extended-hours promises
- Cancellation
- Defined in the signed engagement
- Support
- Named lead; extended hours only when staffed
- Sla
- Agreed severity-based escalation
- Audience
- Businesses with multiple brands or markets
Cybercrime Investigation
- Description
- A scoped investigation with a clear question and a documented record.
- Unit
- initial scoped phase
- Duration
- Agreed after conflict and scope review
- Assets
- Named parties, incidents and authorized sources only
- Hours
- Initial phase agreed; further work $200–300 per hour (draft)
- Monitoring
- No ongoing monitoring unless separately scoped
- Reporting
- At least weekly updates; findings with confidence and limitations
- Actions
- Preservation plan, lawful research, timeline, evidence register and report
- Term
- Written instruction for each matter
- Extras
- Device forensics, specialist work and third-party costs separately scoped
- Exclusions
- No guaranteed identification, funds recovery, hacking back or legal advice
- Cancellation
- Defined in the signed matter engagement
- Support
- Named investigator during agreed staffed hours
- Sla
- 4 business hours acknowledgment; active harm uses urgent pathway (draft)
- Audience
- Businesses, counsel and victims of cybercrime
Legal Support Retainer
- Description
- A standing technical resource with separate instruction for each matter.
- Unit
- per month
- Duration
- Recurring support
- Assets
- Each matter requires conflict clearance and written scope
- Hours
- 10 analyst hours per month
- Monitoring
- No continuous monitoring
- Reporting
- Matter-specific factual reports to agreed recipients
- Actions
- Preservation planning, lawful OSINT, technical explanation and disclosure input
- Term
- 6-month minimum (draft)
- Extras
- Additional hours, acquisitions and third-party costs quoted separately
- Exclusions
- No legal advice, expert witness service or promise of privilege or admissibility
- Cancellation
- Defined in the signed engagement
- Support
- Business hours
- Sla
- 4 business hours acknowledgment; preservation assessment within 1 business day (draft)
- Audience
- Law firms and in-house legal teams
Threat Intelligence Retainer
- Description
- Analyst-reviewed intelligence tied to your exposure and decisions.
- Unit
- per month
- Duration
- Monthly intelligence cycle
- Assets
- Up to 5 domains, 3 brands and 5 executives
- Hours
- 10 analyst hours per month
- Monitoring
- Agreed lawful public and licensed sources; coverage confirmed at onboarding
- Reporting
- Monthly intelligence report, quarterly leadership briefing and high-priority flash alerts
- Actions
- Requirements workshop, source review, campaign analysis and agreed IOC exports
- Term
- 6-month minimum (draft)
- Extras
- Additional sources, entities and analyst hours quoted separately
- Exclusions
- No stolen-data purchases, threat-actor engagement or scanning third-party systems
- Cancellation
- Defined in the signed engagement
- Support
- Business hours; no continuous SOC monitoring
- Sla
- Priority findings shared during staffed hours; cadence agreed at onboarding
- Audience
- Security teams and businesses
DFIR Support Retainer
- Description
- Prepared intelligence and evidence coordination alongside your response team.
- Unit
- per month
- Duration
- Onboard before an incident
- Assets
- Named organization and agreed incident scope
- Hours
- 8 analyst hours per month; unused hours roll over once (draft)
- Monitoring
- Lawful leak and exposure monitoring when activated
- Reporting
- Agreed incident updates, timeline contributions and post-incident summary
- Actions
- Responder liaison, OSINT, evidence register and brand exposure review
- Term
- Retainer terms agreed in writing
- Extras
- Surge hours and specialist forensic work separately scoped
- Exclusions
- No lead incident response, containment, eradication or ransom negotiation
- Cancellation
- Defined in the signed engagement
- Support
- Business hours; extended coverage only by staffed agreement
- Sla
- 2 business hours priority acknowledgment (draft)
- Audience
- Security teams and appointed incident responders
Before you commit.
Are taxes included?
Taxes and currency will be confirmed in the written proposal. This preview does not accept payment.
What if recovery is unsuccessful?
The assessment fee covers the analysis delivered, not a promised outcome. Further work requires a separate agreed scope.
Can I cancel?
Cancellation and minimum terms are shown above as drafts. The signed engagement sets the final terms before work starts.
How would payment work?
The planned methods are card through Stripe and bank transfer to the verified legal entity. Never cryptocurrency, gift cards or a personal wallet.
What do response times mean?
They measure acknowledgment and assessment during confirmed staffed hours. They do not promise a platform decision or a resolution time.
A clear next stepSomething wrong now,
Something wrong now,
or planning ahead?
Tell us where you are. We’ll help you understand the route forward.