A paid diagnostic maps the scope. Then a fixed price in writing, no hourly billing after.
Three service lines, real ranges, and a paid diagnostic before anyone commits to a number. The one principle that explains every figure on this page: price follows consequence, not company size. The same engineering scope is worth a different amount depending on what happens to you if it stays broken.
Three service lines
Assess and harden it, finish it, take it over, scale it
Software that already exists and is not safe to grow. Six services, from a security audit to a full engineering takeover.
See the six rescue services → 02 BUILDNew software, built properly and fast
Net-new development by senior engineers who use AI well. Security, scale and cost to serve designed in from day one.
See how we build → 03 COST TO SERVEEngineering the unit economics
Token cost, model routing, caching and the infrastructure bill, so the app stays profitable as it grows instead of the opposite.
See the cost model →Five tiers. Start at the bottom and you are never guessing.
Async. Findings report in days.
- Automated scan + written report
- Delivered async, in days
- Credited toward the full audit
Fixed fee. Days, not weeks.
- Security scorecard
- Architecture review
- Prioritized findings list
A wide band, scope dependent. The consequence tiers below are what place you inside it.
- Critical & high findings remediated
- Auth, secrets & data integrity fixed
- Test coverage on critical paths
- Documented handoff
Migrate off the no-code ceiling, rebuild for scale.
- Data model & infrastructure rebuild
- Full engineering takeover
- Diligence-ready documentation
Your fractional senior team, monthly.
- Feature work on a stable base
- Ongoing security monitoring
- Priced after scope call
New builds, and the cost of running what you have.
A startup MVP or internal tool with no regulated data. Fixed scope and fixed price, set after a paid diagnostic.
Anything touching cardholder or health data, quoted at the regulated end of the market range rather than below it.
Tiered by system size, using infrastructure spend or monthly active users as the band. One to two weeks, read-only access, no production changes.
A base fee for the engineering, plus a smaller capped bonus tied to measured savings against an agreed baseline. Deliberately not a percentage of savings.
An enterprise or mid-market build meant to replace a rented stack is priced on a different structure: a fixed build fee, plus a mandatory annual regulatory-maintenance and support retainer at 20 to 30 percent of build value. We publish no headline build price for it and we refuse engagements where the retainer will not be funded. The full structure, and the arithmetic behind it.
Three companies. The same five critical findings. Three very different prices.
Closing the same five findings takes roughly the same number of engineer-hours in each case below. The fee is not set by our cost to deliver it. It is set by what happens to you if those findings are never closed, which is the honest way to say value-based pricing out loud.
Hypothetical scenarios illustrating how consequence drives price. Not specific clients.
If those vulnerabilities go unfixed, the downside is a leaked email list and a bad week. There is no regulator, no card brand, and no per-record penalty. The ability to pay is also genuinely constrained, and pricing this tier like the ones below would just mean it never gets fixed at all.
Ranked lowest-consequence segment in our own pricing research. Exposure here is reputational and operational, not statutory.
The codebase may be the same size as Tier 1. The exposure is categorically larger. PCI DSS fines run $5,000 to $100,000 per month, assessed through the acquiring bank and escalating with how long non-compliance persists: typically starting near $5,000 to $10,000 a month, rising to $25,000 to $50,000 by months four to six. That is before chargebacks or a platform suspension.
PCI fine schedule: Sprinto, PCI DSS fines. Global cross-industry average breach cost of $4.44 million: IBM 2025 report, via Bluefin.
The engineering hours may be comparable to both tiers above. The client's exposure is not. HIPAA civil monetary penalties run from roughly $145 to $2,190,294 per violation on the 2026 inflation-adjusted schedule, with an annual cap near $2.19 million per identical violation category. Healthcare has recorded the highest average breach cost of any industry for thirteen consecutive years, most recently $6.6 million, and healthcare breaches take the longest to find and contain at 279 days on average. Enforcement is active, not theoretical: OCR closed 2025 with 21 settlements and civil monetary penalties, its second-highest annual total on record.
Penalty schedule, enforcement totals and breach costs: HIPAA Journal, HIPAA violation penalties and HIPAA Journal, average healthcare breach cost. Engagements at this tier are contingent on a Business Associate Agreement review before work starts.
Here the consequence is not a fine, it is a deal. Procurement teams at companies with 200 or more employees routinely block vendor onboarding without a SOC 2 report, and many run a flat "SOC 2 or no conversation" policy. Security review alone adds two to six weeks to an enterprise sales cycle, and a report surfacing late adds another ten to twenty-one days. When the contract in question is worth $80,000 to $500,000 of annual recurring revenue, that stalled deal is a larger and far more concrete number than most regulatory fines on this page.
Enterprise security-review delay figures: Tenesys and Warren Averett. SOC 2 Type II audit fees of $15,000 to $60,000, with $30,000 to $100,000 total first-year cost: Konfirmity.
We do security engineering: assessing a system against a named standard's technical requirements, hardening it, remediating what fails, and documenting it. We do not certify compliance with any framework, and no engineering firm can. A SOC 2 report is an attestation issued only by a licensed CPA firm under AICPA standards, so there is no such thing as being "SOC 2 certified" by us or anyone like us. HIPAA compliance is the legal obligation of the covered entity or business associate itself, no government-issued HIPAA certification exists, and the Office for Civil Rights does not recognise third-party HIPAA certification. A PCI DSS Report on Compliance or Attestation of Compliance can only be issued by a certified Qualified Security Assessor, which we are not.
What we say instead, and mean: we assess, we harden, we remediate, we align a system to the technical requirements a standard sets out, and we prepare you for the audit someone else will run. Anyone promising you more than that is describing a product that does not legally exist.
The diagnostic is what turns a range into a number.
We don't quote off a form. A senior engineer reads your actual codebase during the diagnostic, then hands you a fixed-price proposal in writing before any build work starts. A fixed price is only ever quoted after the scope has been mapped, never before. If a diagnostic surfaces that the job is smaller or bigger than the tier you expected, we tell you before, not after.
- Step 1. You send the repo and describe what's wrong.
- Step 2. A $1,500 Rapid Diagnostic gets you a written findings report in days.
- Step 3. If you go ahead, the full diagnostic audit produces a scorecard and prioritized findings, and the Rapid Diagnostic fee is credited toward it.
- Step 4. We propose a fixed scope and fixed price for the fix, placed inside the consequence tier that actually applies to you.
- Step 5. You approve it before any build work starts. No surprises mid-engagement.
Not a mystery. Six things move the number.
Codebase size & complexity
A single-service app costs less to secure than a multi-service platform with a sprawling schema.
Timeline
Compressing a diligence-driven timeline into two weeks instead of two months costs more, not less.
Severity of findings
Five critical vulnerabilities take more engineering hours to close safely than one misconfigured setting.
Data sensitivity & consequence
Payment data, health data, or a regulator in the picture means more rigor at every step, and a different tier entirely.
Scale target
Rebuilding for a thousand users is a different job than rebuilding for a hundred thousand.
How much documentation exists
A well-documented handoff from a previous developer saves us time. A cold takeover with zero notes doesn't.
What founders ask before they commit.
Why does the same work cost more for a healthcare app than for a SaaS app?
Because the fee tracks your exposure, not our hours. Closing the same five critical findings takes roughly the same engineering effort in both cases. What differs is what happens if they are never closed: a leaked email list and a bad week in one case, and per-violation penalties reaching into the millions plus an active enforcement environment in the other. We would rather say that plainly than hide it behind a scoping formula.
Is the diagnostic fee credited toward the build?
Yes. The $1,500 Rapid Diagnostic fee is credited toward the $3,000 to $9,500 diagnostic audit, pending scope, if you go ahead. Either way, it stands on its own value: a written findings report you keep regardless of what you decide next.
Do you ever bill hourly?
No. Every engagement past the diagnostic is fixed scope, fixed price, agreed in writing before build work starts. We do not publish an hourly rate for build work either, for the same reason: you should never be billed into an open-ended hole.
When do I get an actual number rather than a range?
After the paid diagnostic, and not before. A fixed price is only quoted once scope has been mapped against your real code.
Can you tell me how much the cost-to-serve work will save me?
Not before we measure your system, and we will not guess on a call. Savings depend entirely on the starting architecture. A system that already caches prompts and runs right-sized infrastructure may save very little. One built fast with no caching and everything on a frontier model can save a great deal on the inference line specifically. The audit is what turns that into your number.
What if my project doesn't fit neatly into one tier?
That's expected. The tiers are ranges, not menu items. The diagnostic tells us exactly where your project falls and the proposal reflects that specific number, not a rounded-up default.
Can I start with a smaller engagement and expand later?
Yes. Engagements start with the $1,500 Rapid Diagnostic, then move to the diagnostic audit, rescue-and-harden, or ongoing engineering as needed. Nothing is locked in beyond the scope you've approved.
Do you offer payment plans on larger engagements?
Larger rebuild, takeover and build engagements are milestone-billed rather than paid in one lump sum. We'll lay out the schedule in the proposal.
Want a real number, not a range?
Start with the $1,500 Rapid Diagnostic. You'll have a fixed-price proposal before you commit to anything bigger.