THE BORING
PART.

Who you are contracting with

Engagements are contracted with a UK limited company, registered at Companies House and operating under English law. Company number, registered address and VAT position are on request and in every statement of work — and go in your supplier register.

Payment

50% on signature, 50% on delivery. The signature invoice clearing is what holds your delivery slot, not the signature itself. Retainers are billed monthly in advance. Fixed-fee work does not carry a day rate, and the price does not move once the scope is signed.

What starts the clock

Every published timeline starts at access granted — repository access, environment access, or the documents in hand — never at signature. Where fixes are included, the commitment is a pull request opened. What merges is decided by your reviewer, your CI and your change-approval process, and no supplier can honestly promise otherwise.

Liability

Liability is capped at the fees paid for the engagement in question. Professional indemnity and cyber cover are held, and the certificate is available on request. Where an engagement touches AI systems, the policy wording is confirmed in writing to cover it — a detail worth checking with any supplier, because standard forms increasingly exclude AI-related losses.

Intellectual property

Everything produced for you in a fixed-fee engagement is assigned to you on final payment: code, documents, findings, diagrams. Pre-existing tooling, methods and the audit taxonomy remain mine, and you get a perpetual licence to the outputs they produce. You are never in a position where using what you paid for requires my continued involvement.

Data handling and sub-processors

A written data-handling annex accompanies every engagement: what is accessed, where it is processed, how long it is retained, and the full sub-processor list including any AI tooling used in delivery. That list is disclosed in full at contracting rather than discovered at security review. A DPA is available and I will sign yours.

Continuity — the one-person question

It is one person, and that is the reason the work is fixed-price and delivered in weeks rather than scoped, staffed and delivered in months. The mitigations are written into the contract rather than promised on a page: source code in escrow, a handover runbook maintained throughout the engagement rather than written at the end, and a defined handover procedure. If I am unavailable, you own everything and can hand it to anyone.

What I do not do

I do not issue certifications, and I am not an accredited conformity-assessment body. Architecture supports a compliance case; it never confers one. Nothing on this site or in any deliverable is legal advice. Penetration testing is not offered — there is no CREST or OSCP credential behind it, and claiming otherwise would be the first dishonest thing in the relationship.