Frequently asked questions.

Two core service models: Fully Managed IT Services (we take full ownership of your IT operations - monitoring, infrastructure, end-user support, patching, security enforcement - for a predictable monthly fee) and Co-Managed IT Services (we extend your internal IT team by handling routine tasks, escalations, and specialized work). On the cybersecurity side: VAPT, compliance prep (SOC 2 / ISO 27001 / DPDP / HIPAA / PCI-DSS), incident response, ongoing posture management.

Sweet spot is 15 to 250 employees. Below 15 staff, most firms need a defined project (a WISP, a pentest, a readiness review) rather than a retainer, and we do those too. Above 250, you typically need an in-house IT lead with us as a security or specialty partner. We will tell you honestly if your problem is smaller or larger than our fit.

Yes. We serve clients in the United States as well as India. We also work with teams in the UK, EU, UAE, Singapore, and Australia. We invoice in INR or USD and accept card, PayPal and bank transfer.

New inquiries get a human reply within one India business day, usually within four hours. Active incidents get a callback the same hour wherever we can, day or night. No auto-replies, no SDR funnel.

Consultations are quote-based (priced per scope, not per hour). Software and hosting (Vexta) are off-the-shelf with published per-tier pricing. We send a fixed quote within one business day of getting your requirement - no hourly billing surprises.

No mandatory long-term contracts. Vexta is pay-as-you-go (monthly tiers cancel any time). Consultation retainers are month-to-month by default (vCISO has a three-month minimum) and billed monthly in advance; annual prepay gets 10% off.

Within reason. A 30-minute scoping call is always free. A quick vulnerability sniff test against one URL is free. We do not do free audits: a real audit is paid work, and a free one would shortchange you.

Outside India: card or PayPal, in USD. In India: Razorpay in INR (cards, UPI, netbanking, wallets), or USD by card. Service retainers and engagements can also be paid by bank transfer against an invoice. Invoices in INR or USD. We do not take crypto.

Yes. Registered non-profits and NGOs get 30% off Vexta plans and managed IT retainers. Cybersecurity consulting for non-profits is priced at cost - typically 40-50% off the standard rate. Email us with your registration certificate.

SOC 2 Type I and II, ISO 27001:2022, DPDP Act 2023 (India), HIPAA (US healthcare), PCI-DSS, RBI Cybersecurity Framework, SEBI guidelines, GDPR, FedRAMP-aligned controls. We do not issue certificates; you retain the accredited auditor of your choice.

Just the prep - the heavy lift that makes the audit smooth. The certificate itself has to be signed by an accredited certification body or CPA firm. We do not issue certificates and have no commercial partnership, referral fee, or kickback arrangement with any certifying body. You pick the certifier; we sit alongside you during their fieldwork.

Three layers: (1) NDAs and BAAs where applicable. (2) Engagement structure - we work in your environment via least-privilege access, not by data leaving your network. (3) We are happy to start with a tiny paid engagement so you can evaluate the work before any sensitive systems are touched.

We can work entirely in your cloud (AWS / GCP / Azure) so data never leaves your region. For SOC operations where we ingest logs, we set up the SIEM in your region of choice. We do not require data to come to India.