Response times
Sales and consulting: one business day. Security: two business days, always acknowledged. Support subscribers: whatever your plan says, which is a commitment rather than an aspiration.
Contact
Talk with us.
Solve it together.
Forty-five minutes, no obligation, no recording and no follow-up sequence. We will tell you what it takes, what it costs, and whether you need us at all. We have said no before.
Straight to a person
| Everything | sales@conformiti.app |
|---|---|
| Consulting | Same address: say what you need in the first line |
| Security reports | Same address, subject line SECURITY · policy |
| Bugs & features | GitHub issues: public, and usually faster |
Before you write
If you only want to see it, you do not need us: click through the interactive demo, run it yourself with one Docker command, or read the product tour.
Capacity is finite. Consulting is delivered by the
person who wrote the software, not a bench. Engagements typically book
three to six weeks out: worth knowing if you have an audit date
already in the diary.
Send a message
Everything except name, email and message is optional, but the more you say, the more useful the first reply is.
Before the call
What we will
ask you.
Nothing here needs an answer in advance. It is just what the first fifteen minutes covers, so it is not a surprise.
Who is asking you for this, and what exactly did they ask for?
“A customer wants SOC 2” and “a customer's security addendum requires ISO 27001 certification by Q3” lead to very different engagements. If you have the actual contract clause or questionnaire, that is the most useful thing you can bring.
What is already in place, honestly?
Not what the policy says: what people actually do. Onboarding, offboarding, change management, backups, logging, access reviews. It is fine if the answer is “almost nothing”; that is a normal starting point and it changes the plan, not the price.
Who will own this after we leave?
Every engagement has a handover step, and it needs somewhere to hand over to. If the honest answer is “nobody has time”, that is what the fractional retainer exists for, and it is better to say so at the start than to discover it at the readout.
Self-hosted or managed?
It genuinely does not change our fee. It changes who carries backups, upgrades and key custody, and whether your own security policy permits a third party to hold the evidence at all. Plenty of clients self-host specifically so that the consulting engagement is the only relationship.
Is there a date already in the diary?
A booked audit date changes sequencing more than anything else. It decides what gets fixed and what gets documented as a known gap with a remediation plan. Tell us early if there is one.