Terms of Service

Effective October 17, 2026. These terms cover two things: your use of this website, and the standard terms on which Vantalect, LLC ("Vantalect," "we," "us") delivers its fixed-price engagements. A signed statement of work governs any particular engagement; where it and this page differ, the statement of work controls for that engagement.

Part one: this website

Use of the site

You may read, link to, and quote from this site for any lawful purpose. You may not scrape it at a volume that burdens it, misrepresent its content as your own, or use it to send unsolicited communications to the addresses on it.

Content and ownership

The text, images, and design of this site are the property of Vantalect, LLC, except the essays on the blog, which are the work of Charles Sieg, were originally published at charlessieg.com, and are republished here with attribution; the originals remain the canonical versions. Company and product names mentioned on the site (including Claude and Claude Code, trademarks of Anthropic, PBC; GitHub Copilot, a trademark of GitHub, Inc.; Cursor, a trademark of Anysphere, Inc.; AWS, a trademark of Amazon.com, Inc.; SOC 2, a registered trademark of the American Institute of Certified Public Accountants; PCI DSS, a trademark of the PCI Security Standards Council, LLC; CIS Benchmarks, a trademark of the Center for Internet Security, Inc.; and ISO, a registered trademark of the International Organization for Standardization) belong to their owners and are used only to identify those products. Vantalect is not affiliated with or endorsed by any of them.

No warranty for the site

The site is provided as is. The measured figures on it describe our own work, are published with their methodology, and are not a promise of the results any other team will see; the leverage page says so at every point where a number appears. Links to other sites are provided for convenience and we are not responsible for their content.

Limitation of liability for the site

To the fullest extent permitted by law, Vantalect is not liable for any loss arising from your use of this site or reliance on its content. Liability arising from an engagement is governed by part two and by the statement of work.

Part two: the fixed-price engagements

These are the standard terms of the four engagements described on the home page: engineering leverage, the AWS security, compliance, and governance audit, AWS cost analysis and optimization, and the AWS Well-Architected Framework Review. Each is delivered under a signed statement of work that repeats them for the specific client, team, and systems. The three AWS engagements can also be taken together as a bundle, on the terms under "Bundles" below.

The engagements

Each engagement comes in two shapes: a two-week diagnostic, and a six-week engagement that includes it.

The leverage engagements also include a one-year Fulcrum license. Every engagement is delivered personally by Charles Sieg, remotely by default, inside the client's own repositories, accounts, and subscriptions.

Scope

• Engineering leverage: one team of up to six engineers and up to four repositories, named in the statement of work.
• AWS security: one AWS organization of up to 50 accounts, in every enabled region, with one compliance framework mapped beside the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices; in the Hardening, fixes in up to four infrastructure-as-code repositories.
• AWS cost: one AWS organization's bill of up to 50 accounts; in the Optimization, changes in up to four infrastructure-as-code repositories.
• AWS Well-Architected: one production workload and the AWS accounts that run or support it (up to 50 accounts in one AWS organization), evaluated across all six pillars of the AWS Well-Architected Framework; in the Remediation, fixes in up to four infrastructure-as-code repositories.

Additional teams, workloads, repositories, accounts, organizations, or frameworks, an on-site day, product work beyond the paired tickets, infrastructure migration, and support after the closing readout are outside scope and are available only by written change order or a separate agreement.

Deliverables

The Assessment delivers: a Pavilion workspace set up for the engagement; Fulcrum installed in the client's environment; the baseline record and a written baseline report; the agent-readiness audit of the in-scope repositories; the live-ticket demonstration as a merged pull request with its prompt transcript; the installation plan with one repository's guidance file drafted as a sample; and the sponsor readout.

The Embed delivers everything in the Assessment and, in addition: the constraint graph of nested guidance files in every in-scope repository, each proven on a merged ticket; pre-commit gates and review loops; agent workflows installed and documented; tool integrations where they justified themselves; the client's team logging its own leverage by week five; the week-six measurement against week one; the playbook; and the handover workshop with its recording.

The Audit delivers: a Pavilion workspace set up for the engagement; the scan of every in-scope account and enabled region; the findings register, with critical and high findings verified by hand; the identity and access review; the compliance map for the chosen framework; the governance review; the remediation roadmap; and the sponsor readout.

The Hardening delivers everything in the Audit and, in addition: a fix as code for every critical finding in the findings register; guardrails at the top of the organization; identity on single sign-on and least-privilege roles, with long-lived keys retired; detection enabled in every in-scope account and region; an organization trail into a protected log archive; incident runbooks; the week-six re-scan; and the handover workshop with its recording.

The Analysis delivers: a Pavilion workspace set up for the engagement; the spend baseline; the waste register; the rightsizing plan; the commitment plan; the architecture review; the savings roadmap; and the sponsor readout.

The Optimization delivers everything in the Analysis and, in addition: the approved waste removed; rightsizing applied; commitments sized for the client to purchase; storage and data-transfer changes; non-production schedules; budgets, anomaly alerts, tag policies, and showback reporting; the week-six savings measurement; and the handover workshop with its recording.

The Review delivers: a Pavilion workspace set up for the engagement; the AWS Well-Architected Tool baseline workload and week-two milestone across all six pillars; the verified High- and Medium-Risk Issue register; the current- and target-state architecture diagrams; the reliability and recovery analysis; the security and operational gap analysis; the remediation roadmap; and the sponsor readout.

The Remediation delivers everything in the Review and, in addition: a fix as code for every agreed High-Risk Issue; reliability controls in place; workload security hardened; operational telemetry and alarms; performance and cost tuning applied; operational runbooks; the week-six Well-Architected Tool milestone; and the handover workshop with its recording.

A deliverable is accepted when it is in the client's repository, account, or inbox and has been presented at the corresponding meeting. The last readout (a diagnostic's sponsor readout, or a six-week engagement's closing readout) is the acceptance meeting for the engagement.

Consultant time and change orders

Each engagement includes the consultant hours in the table above. Hours beyond the cap, and any work outside scope, are performed only under a written change order agreed before the hour is spent and are billed at $450 per hour, invoiced monthly.

Client obligations

Each engagement is run in a Pavilion workspace set up for the client in week one, holding the calendar, recordings, transcripts, documents, discussion, decisions, tasks, obligations, and the measurement, and exported to the client at the close of the engagement. Meetings are held on Zoom and recorded with the client's permission, with Zoom's transcripts and recaps delivered alongside each recording. The client makes its sponsor available for thirty minutes a week and for the readouts, and in addition:

• Engineering leverage: makes each paired engineer available at least four hours a week, and grants repository, continuous-integration, and container-host access within three business days of signature.
• AWS security: deploys the read-only audit role in every in-scope account within three business days of signature, makes a platform or security lead available at least four hours a week, and in the Hardening, approves or declines each change within two business days through its own change process.
• AWS cost: grants billing read access and deploys a view-only role in every in-scope account within three business days of signature, turns on its Cost and Usage Report and Compute Optimizer if they are off, names an owner for each account or workload, and in the Optimization, approves or declines each change within two business days and decides on commitments in week four.
• AWS Well-Architected: deploys the read-only inspection role in every account that runs or supports the workload within three business days of signature, grants access to record the workload and milestones in the client's AWS Well-Architected Tool, makes the workload's lead architect or tech lead available at least four hours a week, and in the Remediation, reviews and approves or declines each change within two business days through its own release process.

Week one begins on the statement of work's target start date, or on the first business day after that access exists if that is later. If an obligation is not met, the schedule slides by the same number of business days, and the measurement gates below are evaluated on the work the client made possible.

Access to client systems

The security, cost, and Well-Architected engagements read the client's AWS accounts through roles the client deploys, from templates Vantalect provides and the client can read before deploying them. Those roles are read-only: they can read how the accounts are configured and billed, and the Well-Architected workload's metrics and alarms; they cannot change a resource, and cannot read the contents of storage buckets, databases, or secrets, apart from the Cost and Usage Report the cost engagement measures. The Well-Architected engagement also records the workload, its answers, and its milestones in the client's AWS Well-Architected Tool, through access the client grants for that purpose alone. In the six-week engagements every change is made as code through the client's own pull requests and pipeline, and Vantalect does not hold standing write access to production. Scan results, billing extracts, architecture notes, and working files are kept in the engagement's Pavilion workspace, exported to the client at the close, and deleted from Vantalect's systems within thirty days after it.

Fees, invoicing, and the measurement gates

Each two-week diagnostic's fee is invoiced as set out in its statement of work. Each six-week engagement's fee is invoiced half at signature and half only if its measurement gate is met. If a gate is not met, the second invoice is not issued and the client keeps everything delivered. Invoices are due within fifteen days.

• The Embed is invoiced in full only if the week-six measurement is at least three times the week-one baseline. Both measurements are taken with Fulcrum using the same method: the total senior-engineer-equivalent hours of the tasks the team logs in the in-scope repositories, divided by the total agent session hours spent on them, on the same kind of work.
• The Hardening is invoiced in full only if every finding rated critical in the findings register, as agreed at the week-two readout, is closed at week six, verified by a re-scan run the same way as the first. A critical finding the client accepts in writing as a risk counts as closed, as does one whose fix the client declined, or approved but had not applied by the re-scan.
• The Optimization is invoiced in full only if the annualized savings in place at the end of week six are at least three times the fee. Savings are measured change by change on the client's Cost and Usage Report: the cost of each changed resource in the week before the change against the week after it, and the on-demand cost of the usage each commitment covers less its amortized cost, annualized. A change the client approved at the week-two readout and later declines counts at the savings the roadmap estimated for it. If the changes the client approves from the week-two savings roadmap do not total at least three times the fee, the engagement ends when the client's approvals close, at most two business days after the readout, unless both parties agree in writing to continue. The client then pays the Analysis fee in place of the Optimization's: the half invoiced at signature is credited against it, and the balance is invoiced.
• The Remediation is invoiced in full only if every High-Risk Issue (HRI) in the workload's HRI register, as agreed at the week-two readout, is closed at week six, verified in the week-six AWS Well-Architected Tool milestone. A High-Risk Issue the client accepts in writing as a risk or defers as a multi-quarter application rewrite counts as closed, as does one whose fix the client declined, or approved but had not applied by the week-six milestone.

Bundles

A client that takes two of the AWS security, cost, and Well-Architected engagements, or all three, under one agreement pays each engagement's fee less 10% when it takes two, or less 15% when it takes all three, in either shape. Engineering leverage is not part of the bundle. The discount is set at signature by the number of engagements selected and does not change afterward, including when an engagement ends early, except that an engagement the client cancels before it starts, other than for Vantalect's breach, does not count toward it; the others are then billed at the discount for the number that remain.

In a bundle, the engagements share one access setup, one kickoff, and one Pavilion workspace, and they start two weeks apart unless the statement of work sets other dates. Each engagement keeps its own scope, deliverables, consultant hours, and measurement gate, and each is invoiced on its own terms at its discounted fee, with every first invoice issued at signature. The discount does not change any measurement gate: the cost engagement's gate stays at three times the Optimization's list fee. If the changes the client approves from the cost engagement's week-two savings roadmap do not total at least three times the Optimization's list fee, that engagement ends when the client's approvals close, at most two business days after its readout, unless both parties agree in writing to continue; the client then pays the Analysis's discounted fee in place of the Optimization's, with the half invoiced at signature credited against it, and the other engagements continue. Either party may end one engagement in a bundle, or all of them, as described under Termination; the others continue at their discounted fees.

The Fulcrum license

Each leverage engagement includes a one-year license to install and use Fulcrum in the client's environment, starting at installation. Renewal is optional at $1,199 per year. The leverage record the client builds is the client's whether or not it renews, and nothing it records is transmitted to Vantalect or to Renkara Media Group, Inc., the maker of Fulcrum. Fulcrum's own license terms are published at fulcrum.renkara.com.

What the security, cost, and Well-Architected engagements are not

The security and Well-Architected engagements are technical assessments and remediation of an AWS environment or workload. They are not an audit opinion, an attestation, a certification of compliance, or a penetration test: SOC 2 reports are issued by licensed CPA firms and PCI DSS assessments by Qualified Security Assessors, and Vantalect is neither. The savings named in an Analysis are estimates made from the client's own usage and prices at the time. Vantalect does not purchase commitments or apply changes on the client's behalf; the client decides and applies every change.

Ownership and confidentiality

The client owns outright the guidance files, gates, workflows, integrations, infrastructure code, policies, runbooks, plans, playbooks, recordings, and reports delivered under the engagement, once every undisputed invoice then due is paid. Vantalect keeps the measurement of the leverage and cost engagements (the baseline and closing numbers) and may cite it with the client's name removed unless the client agrees otherwise in writing. Security findings are never cited, with or without the client's name, and neither are Well-Architected High-Risk Issue registers. All work happens inside the client's repositories and accounts. A mutual non-disclosure agreement, where one is signed, governs anything more specific.

Termination

Either party may end an engagement with five business days' written notice. Vantalect then invoices consultant hours spent to date at $450 per hour, capped at the fee for the engagement, and refunds anything the client has paid beyond that; the client keeps everything delivered to that point. In a six-week engagement, a client that ends it after week two, other than for Vantalect's breach, pays at least the two-week diagnostic's fee, and if Vantalect ends it before its measurement gate is decided, other than for the client's breach, the client pays no more than the half invoiced at signature.

Warranties and liability

Vantalect warrants that the work will be performed in a professional manner by the person named in the statement of work. Beyond the measurement gates above, no particular result is guaranteed: the client's team, systems, and choices determine the number, and a security or Well-Architected engagement reduces risk but cannot guarantee that an environment will never be breached or a workload will never fail. Vantalect's total liability arising from an engagement is limited to the fees paid for that engagement, and neither party is liable to the other for indirect or consequential loss.

Part three: general

These terms are governed by the laws of the State of Texas, without regard to its conflict-of-laws rules. If any provision is unenforceable, the rest remain in effect. Changes to these terms are posted here with a new effective date and apply to engagements signed after that date. Questions go to info@vantalect.com.

Vantalect, LLC · info@vantalect.com · 847.331.3649