Terms of Service

Effective September 25, 2026. These terms cover two things: your use of this website, and the standard terms on which Vantalect, LLC ("Vantalect," "we," "us") delivers its fixed-price engagements. A signed statement of work governs any particular engagement; where it and this page differ, the statement of work controls for that engagement.

Part one: this website

Use of the site

You may read, link to, and quote from this site for any lawful purpose. You may not scrape it at a volume that burdens it, misrepresent its content as your own, or use it to send unsolicited communications to the addresses on it.

Content and ownership

The text, images, and design of this site are the property of Vantalect, LLC, except the essays on the blog, which are the work of Charles Sieg, were originally published at charlessieg.com, and are republished here with attribution; the originals remain the canonical versions. Company and product names mentioned on the site (including Claude and Claude Code, trademarks of Anthropic, PBC; GitHub Copilot, a trademark of GitHub, Inc.; Cursor, a trademark of Anysphere, Inc.; AWS, a trademark of Amazon.com, Inc.; SOC 2, a registered trademark of the American Institute of Certified Public Accountants; PCI DSS, a trademark of the PCI Security Standards Council, LLC; CIS Benchmarks, a trademark of the Center for Internet Security, Inc.; and ISO, a registered trademark of the International Organization for Standardization) belong to their owners and are used only to identify those products. Vantalect is not affiliated with or endorsed by any of them.

No warranty for the site

The site is provided as is. The measured figures on it describe our own work, are published with their methodology, and are not a promise of the results any other team will see; the leverage page says so at every point where a number appears. Links to other sites are provided for convenience and we are not responsible for their content.

Limitation of liability for the site

To the fullest extent permitted by law, Vantalect is not liable for any loss arising from your use of this site or reliance on its content. Liability arising from an engagement is governed by part two and by the statement of work.

Part two: the fixed-price engagements

These are the standard terms of the three engagements described on the home page: engineering leverage, the AWS security, compliance, and governance audit, and AWS cost analysis and optimization. Each is delivered under a signed statement of work that repeats them for the specific client, team, and systems.

The engagements

Each engagement comes in two shapes: a two-week diagnostic, and a six-week engagement that includes it.

The leverage engagements also include a one-year Fulcrum license. Every engagement is delivered personally by Charles Sieg, remotely by default, inside the client's own repositories, accounts, and subscriptions.

Scope

• Engineering leverage: one team of up to six engineers and up to four repositories, named in the statement of work.
• AWS security: one AWS organization of up to 50 accounts, in every enabled region, with one compliance framework mapped beside the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices; in the Hardening, fixes in up to four infrastructure-as-code repositories.
• AWS cost: one AWS organization's bill of up to 50 accounts; in the Optimization, changes in up to four infrastructure-as-code repositories.

Additional teams, repositories, accounts, organizations, or frameworks, an on-site day, product work beyond the paired tickets, infrastructure migration, and support after the closing readout are outside scope and are available only by written change order or a separate agreement.

Deliverables

The Assessment delivers: a Pavilion workspace set up for the engagement; Fulcrum installed in the client's environment; the baseline record and a written baseline report; the agent-readiness audit of the in-scope repositories; the live-ticket demonstration as a merged pull request with its prompt transcript; the installation plan with one repository's guidance file drafted as a sample; and the sponsor readout.

The Embed delivers everything in the Assessment and, in addition: the constraint graph of nested guidance files in every in-scope repository, each proven on a merged ticket; pre-commit gates and review loops; agent workflows installed and documented; tool integrations where they justified themselves; the client's team logging its own leverage by week five; the week-six measurement against week one; the playbook; and the handover workshop with its recording.

The Audit delivers: a Pavilion workspace set up for the engagement; the scan of every in-scope account and enabled region; the findings register, verified by hand; the identity and access review; the compliance map for the chosen framework; the governance review; the remediation roadmap; and the sponsor readout.

The Hardening delivers everything in the Audit and, in addition: every critical finding in the findings register closed as code; guardrails at the top of the organization; identity on single sign-on and least-privilege roles, with long-lived keys retired; detection enabled in every in-scope account and region; an organization trail into a protected log archive; incident runbooks; the week-six re-scan; and the handover workshop with its recording.

The Analysis delivers: a Pavilion workspace set up for the engagement; the spend baseline; the waste register; the rightsizing plan; the commitment plan; the architecture review; the savings roadmap; and the sponsor readout.

The Optimization delivers everything in the Analysis and, in addition: the approved waste removed; rightsizing applied; commitments sized for the client to purchase; storage and data-transfer changes; non-production schedules; budgets, anomaly alerts, tag policies, and showback reporting; the week-six savings measurement; and the handover workshop with its recording.

A deliverable is accepted when it is in the client's repository or inbox and has been presented at the corresponding meeting. The closing readout is the acceptance meeting for the engagement.

Consultant time and change orders

Each engagement includes the consultant hours in the table above. Hours beyond the cap, and any work outside scope, are performed only under a written change order agreed before the hour is spent and are billed at $450 per hour, invoiced monthly.

Client obligations

Each engagement is run in a Pavilion workspace set up for the client in week one, holding the calendar, recordings, transcripts, documents, discussion, decisions, tasks, obligations, and the measurement, and exported to the client at the close of the engagement. Meetings are held on Zoom and recorded with the client's permission, with Zoom's transcripts and recaps delivered alongside each recording. The client makes its sponsor available for thirty minutes a week and for the readouts, and in addition:

• Engineering leverage: makes each paired engineer available at least four hours a week, and grants repository, continuous-integration, and container-host access within three business days of signature.
• AWS security: deploys the read-only audit role in every in-scope account within three business days of signature, makes a platform or security lead available at least four hours a week, and in the Hardening, approves or declines each change within two business days through its own change process.
• AWS cost: grants billing read access and deploys a view-only role in every in-scope account within three business days of signature, turns on its Cost and Usage Report and Compute Optimizer if they are off, names an owner for each account or workload, and in the Optimization, approves or declines each change within two business days and decides on commitments in week four.

The schedule starts when that access exists. If an obligation is not met, the schedule slides by the same number of business days, and the measurement gates below are evaluated on the work the client made possible.

Access to client systems

The security and cost engagements read the client's AWS accounts through roles the client deploys, from templates Vantalect provides and the client can read before deploying them. Those roles are read-only: they can read how the accounts are configured and billed, cannot change a resource, and cannot read the contents of storage buckets, databases, or secrets. In the six-week engagements every change is made as code through the client's own pull requests and pipeline, and Vantalect does not hold standing write access to production. Scan results, billing extracts, and working files are kept in the engagement's Pavilion workspace, exported to the client at the close, and deleted from Vantalect's systems within thirty days after it.

Fees, invoicing, and the measurement gates

Each two-week diagnostic's fee is invoiced as set out in its statement of work. Each six-week engagement's fee is invoiced half at signature and half only if its measurement gate is met. If a gate is not met, the second invoice is not issued and the client keeps everything delivered. Invoices are due within fifteen days.

• The Embed is invoiced in full only if the week-six measurement is at least three times the week-one baseline. Both measurements are taken with Fulcrum using the same method: senior-engineer-equivalent hours per task divided by agent session minutes, summed over the period, on the same kind of work, and evaluated on the work that was actually paired.
• The Hardening is invoiced in full only if every finding rated critical in the findings register, as agreed at the week-two readout, is closed at week six, verified by a re-scan run the same way as the first. A critical finding the client accepts in writing as a risk counts as closed, as does a fix the client approved and then chose not to apply.
• The Optimization is invoiced in full only if the annualized savings in place at the end of week six are at least three times the fee. Savings are measured change by change on the client's Cost and Usage Report: the daily cost of each changed resource or commitment in the week before the change against the week after it, annualized. A change the client approved at the week-two readout and later declines counts at the savings the roadmap estimated for it. If the week-two savings roadmap does not total at least three times the fee, the engagement ends at the readout unless both parties agree in writing to continue. The client then pays the Analysis fee in place of the Optimization's: the half invoiced at signature is credited against it, and the balance is invoiced.

The Fulcrum license

Each leverage engagement includes a one-year license to install and use Fulcrum in the client's environment, starting at installation. Renewal is optional at $1,199 per year. The leverage record the client builds is the client's whether or not it renews, and nothing it records is transmitted to Vantalect or to Renkara Media Group, Inc., the maker of Fulcrum. Fulcrum's own license terms are published at fulcrum.renkara.com.

What the security and cost engagements are not

The security engagements are technical assessments and remediation of an AWS environment. They are not an audit opinion, an attestation, a certification of compliance, or a penetration test: SOC 2 reports are issued by licensed CPA firms and PCI DSS assessments by Qualified Security Assessors, and Vantalect is neither. The savings named in an Analysis are estimates made from the client's own usage and prices at the time. Vantalect does not purchase commitments or apply changes on the client's behalf; the client decides and applies every change.

Ownership and confidentiality

The client owns outright the guidance files, gates, workflows, integrations, infrastructure code, policies, runbooks, plans, playbooks, recordings, and reports delivered under the engagement. Vantalect keeps the measurement of the leverage and cost engagements (the baseline and closing numbers) and may cite it with the client's name removed unless the client agrees otherwise in writing. Security findings are never cited, with or without the client's name. All work happens inside the client's repositories and accounts. A mutual non-disclosure agreement, where one is signed, governs anything more specific.

Termination

Either party may end an engagement with five business days' written notice. Vantalect then invoices consultant hours spent to date at $450 per hour, capped at the fee for the engagement, and the client keeps everything delivered to that point.

Warranties and liability

Vantalect warrants that the work will be performed in a professional manner by the person named in the statement of work. Beyond the measurement gates above, no particular result is guaranteed: the client's team, systems, and choices determine the number, and a security engagement reduces risk but cannot guarantee that an environment will never be breached. Vantalect's total liability arising from an engagement is limited to the fees paid for that engagement, and neither party is liable to the other for indirect or consequential loss.

Part three: general

These terms are governed by the laws of the State of Texas, without regard to its conflict-of-laws rules. If any provision is unenforceable, the rest remain in effect. Changes to these terms are posted here with a new effective date and apply to engagements signed after that date. Questions go to info@vantalect.com.

Vantalect, LLC · info@vantalect.com · 847.331.3649