Terms of Service

Effective October 18, 2026. These terms cover two things: your use of this website, and the standard terms on which Vantalect, LLC ("Vantalect," "we," "us") delivers its fixed-price engagements. A signed master services agreement and statement of work govern any particular engagement; where they and this page differ, they control for that engagement.

Part one: this website

Use of the site

You may read, link to, and quote from this site for any lawful purpose. You may not scrape it at a volume that burdens it, misrepresent its content as your own, or use it to send unsolicited communications to the addresses on it.

Content and ownership

The text, images, and design of this site are the property of Vantalect, LLC, except the essays on the blog, which are the work of Charles Sieg, were originally published at charlessieg.com, and are republished here with attribution; the originals remain the canonical versions. Company and product names mentioned on the site (including Claude and Claude Code, trademarks of Anthropic, PBC; GitHub Copilot, a trademark of GitHub, Inc.; Cursor, a trademark of Anysphere, Inc.; AWS, a trademark of Amazon.com, Inc.; Terraform, a trademark of HashiCorp, Inc.; SOC 2, a registered trademark of the American Institute of Certified Public Accountants; PCI DSS, a trademark of the PCI Security Standards Council, LLC; CIS Benchmarks, a trademark of the Center for Internet Security, Inc.; and ISO, a registered trademark of the International Organization for Standardization) belong to their owners and are used only to identify those products. Vantalect is not affiliated with or endorsed by any of them.

No warranty for the site

The site is provided as is. The measured figures on it describe our own work, are published with their methodology, and are not a promise of the results any other team will see; the leverage page says so at every point where a number appears. Links to other sites are provided for convenience and we are not responsible for their content.

Limitation of liability for the site

To the fullest extent permitted by law, Vantalect is not liable for any loss arising from your use of this site or reliance on its content. Liability arising from an engagement is governed by part two and by the master services agreement and statement of work.

Part two: the fixed-price engagements

These are the standard terms of the five engagements described on the home page: engineering leverage, the AWS security, compliance, and governance audit, AWS cost analysis and optimization, the AWS Well-Architected Framework Review, and the AWS Multi-Account Foundation, and of the multi-account engagement's add-on to the security engagement. Each is delivered under a signed master services agreement and a statement of work that repeat them for the specific client, team, and systems; a bundle adds a Bundle Schedule. The four AWS engagements can also be taken together as a bundle, on the terms under "Bundles" below.

The engagements

Each engagement comes in two shapes: a two-week diagnostic, and a six-week engagement that includes it.

The leverage engagements also include a one-year Fulcrum license. Every engagement is delivered personally by Charles Sieg, remotely by default, inside the client's own repositories, accounts, and subscriptions.

Scope

• Engineering leverage: one team of up to six engineers and up to four repositories, named in the statement of work.
• AWS security: one AWS organization of up to 50 accounts, in every enabled region, with one compliance framework mapped beside the CIS AWS Foundations Benchmark and AWS Foundational Security Best Practices; in the Hardening, fixes in up to four infrastructure-as-code repositories.
• AWS cost: one AWS organization's bill of up to 50 accounts; in the Optimization, changes in up to four infrastructure-as-code repositories.
• AWS Well-Architected: one production workload and the AWS accounts that run or support it (up to 50 accounts in one AWS organization), evaluated across all six pillars of the AWS Well-Architected Framework; in the Remediation, fixes in up to four infrastructure-as-code repositories.
• AWS multi-account: one target AWS organization of up to 50 accounts, built from one existing organization (a retrofit) or from one source organization plus standalone accounts (greenfield), with AWS Control Tower, or the equivalent the Blueprint names where Control Tower cannot be used, in the Regions agreed at the week-two readout; in the Build, policies and account customizations in up to two infrastructure-as-code repositories. Accounts move between organizational units and organizations with their resources intact; moving resources between accounts is not part of it.

Additional teams, workloads, repositories, accounts, organizations, or frameworks, an on-site day, product work beyond the paired tickets, infrastructure migration (other than moving AWS accounts between organizations in the multi-account engagement), and support after the closing readout are outside scope and are available only by written change order or a separate agreement.

Deliverables

The Assessment delivers: Fulcrum installed in the client's environment; the baseline record and a written baseline report; the agent-readiness audit of the in-scope repositories; the live-ticket demonstration as a merged pull request with its prompt transcript; the installation plan with one repository's guidance file drafted as a sample; and the sponsor readout.

The Embed delivers everything in the Assessment and, in addition: the constraint graph of nested guidance files in every in-scope repository, each proven on a merged ticket; pre-commit gates and review loops; agent workflows installed and documented; tool integrations where they justified themselves; the client's team logging its own leverage by week five; the week-six measurement against week one; the playbook; and the handover workshop with its recording.

The Audit delivers: the scan of every in-scope account and enabled region; the findings register, with critical and high findings verified by hand; the identity and access review; the compliance map for the chosen framework; the governance review; the remediation roadmap; and the sponsor readout.

The Hardening delivers everything in the Audit and, in addition: a fix as code for every critical finding in the findings register; guardrails at the top of the organization; identity on single sign-on and least-privilege roles, with long-lived keys retired; detection enabled in every in-scope account and region; an organization trail into a protected log archive; incident runbooks; the week-six re-scan; and the handover workshop with its recording.

The Analysis delivers: the spend baseline; the waste register; the rightsizing plan; the commitment plan; the architecture review; the savings roadmap; and the sponsor readout.

The Optimization delivers everything in the Analysis and, in addition: the approved waste removed; rightsizing applied; commitments sized for the client to purchase; storage and data-transfer changes; non-production schedules; budgets, anomaly alerts, tag policies, and showback reporting; the week-six savings measurement; and the handover workshop with its recording.

The Review delivers: the AWS Well-Architected Tool baseline workload and week-two milestone across all six pillars; the verified High- and Medium-Risk Issue register; the current- and target-state architecture diagrams; the reliability and recovery analysis; the security and operational gap analysis; the remediation roadmap; and the sponsor readout.

The Remediation delivers everything in the Review and, in addition: a fix as code for every agreed High-Risk Issue; reliability controls in place; workload security hardened; operational telemetry and alarms; performance and cost tuning applied; operational runbooks; the week-six Well-Architected Tool milestone; and the handover workshop with its recording.

The Blueprint delivers: the inventory of every in-scope account; the foundation scan; the target design (the OU tree, the account map, and the guardrail, identity, logging, network, backup, vending, and tagging designs); the policy set as code; the move plan; the risk register; and the sponsor readout.

The Build delivers everything in the Blueprint and, in addition: the landing zone set up or upgraded and enrolled, with the Security OU, its log archive and audit accounts, and an organization trail into the log archive; every in-scope account in its target OU and enrolled; the baseline guardrails inherited by every OU; IAM Identity Center for people, with long-lived IAM users retired from workload accounts; the security services delegated to the audit account; account vending, proven on one vended account, with central backup, the network account, and the tag policy where in scope; the week-six re-scan; the operations runbooks; and the handover workshop with its recording.

A deliverable is accepted when it is in the client's repository, account, or inbox and has been presented at a session the statement of work lists, or at the latest at the closing readout; the client may ask for corrections within five business days after that, and Vantalect makes them. The Pavilion workspace is the tool each engagement runs in, not a deliverable; its export is the client's. The last readout (a diagnostic's sponsor readout, or a six-week engagement's closing readout) is the acceptance meeting for the engagement.

Consultant time and change orders

Each engagement includes the consultant hours in the table above, and the add-on below includes its own. Hours beyond the cap, and any work outside scope, are performed only under a written change order agreed before the hour is spent and are billed at $450 per hour, invoiced monthly.

Client obligations

Each engagement is run in a Pavilion workspace set up for the client in week one, holding the calendar, recordings, transcripts, documents, discussion, decisions, tasks, obligations, and the measurement, and exported to the client at the close of the engagement. Meetings are held on Zoom and recorded with the client's permission, with Zoom's transcripts and recaps delivered alongside each recording. The client makes its sponsor available for thirty minutes a week and for the readouts, and in addition:

• Engineering leverage: makes each paired engineer available at least four hours a week, and grants repository, continuous-integration, and container-host access within three business days of signature, and logs every task in Fulcrum (both weeks of the Assessment; week one and from week five in the Embed).
• AWS security: deploys the read-only audit role in every in-scope account within three business days of signature, makes a platform or security lead available at least four hours a week, and in the Hardening, approves or declines each change within two business days through its own change process.
• AWS cost: grants billing read access and deploys a view-only role in every in-scope account within three business days of signature, turns on its Cost and Usage Report and Compute Optimizer, with the settings Vantalect provides, within three business days of signature if they are off, names an owner for each account or workload, and in the Optimization, approves or declines each change within two business days and decides on commitments in week four.
• AWS multi-account: deploys the read-only role in every in-scope account and in the management account within three business days of signature, makes a platform lead available at least four hours a week and a finance or billing contact in week one, and in the Build, approves each change window in writing at least two business days ahead, has the management account's owner present in every window, and, on the greenfield path, creates the new management account, with its root email on the client's domain and its root MFA in the client's custody, before week three.
• AWS Well-Architected: deploys the read-only inspection role in every account that runs or supports the workload within three business days of signature, grants access to record the workload and milestones in the client's AWS Well-Architected Tool, makes the workload's lead architect or tech lead available at least four hours a week, and in the Remediation, reviews and approves or declines each change within two business days through its own release process.

Week one begins on the statement of work's target start date, or on the first business day after that access exists if that is later. If an obligation is not met, the schedule slides by the same number of business days, and the measurement gates below are evaluated on the work the client made possible.

Access to client systems

The security, cost, and Well-Architected engagements read the client's AWS accounts through roles the client deploys, from templates Vantalect provides and the client can read before deploying them. Those roles are read-only: they can read how the accounts are configured and billed, and the Well-Architected workload's metrics and alarms; they cannot change a resource, and cannot read the contents of storage buckets, databases, or secrets, apart from the Cost and Usage Report the cost engagement measures; the security and multi-account roles carry explicit denies on reading them. The Well-Architected engagement also records the workload, its answers, and its milestones in the client's AWS Well-Architected Tool, through access the client grants for that purpose alone. In the six-week engagements every change is made as code through the client's own pull requests and pipeline, and Vantalect does not hold standing write access to production.

The multi-account engagement's Build, and its add-on, also act in the client's AWS Organizations management account, where setting up AWS Control Tower, creating organizational units and accounts, and moving and enrolling accounts are done. That access is time-boxed: Vantalect acts there only in change windows the client approves in writing, each limited to the actions its move plan names, through a role the client creates from a template it reads first, whose trust policy admits only the named consultant, requires multifactor authentication, and is valid only between the start and end of the approved window. The role denies closing accounts, deleting or leaving the organization, changing payment methods or billing contacts, and creating IAM users or access keys. Account emails, root credentials, and payment methods stay with the client, and Vantalect never holds a root credential for any account. The client deletes the role after the last change window and before the re-scan, which checks that it is gone. A client that grants no write access gets the same engagement with its own engineer acting in every window. Inside member accounts, every change is made as code through the client's pipeline. Scan results, billing extracts, architecture notes, and working files are kept in the engagement's Pavilion workspace, exported to the client at the close, and deleted from Vantalect's systems within thirty days after it.

Fees, invoicing, and the measurement gates

Each two-week diagnostic's fee is invoiced as set out in its statement of work. Each six-week engagement's fee is invoiced half at signature and half only if its measurement gate is met. If a gate is not met, the second invoice is not issued and the client keeps everything delivered. Invoices are due within fifteen days.

• The Embed is invoiced in full only if the week-six measurement is at least three times the week-one baseline. Both measurements are taken with Fulcrum using the same method: the total senior-engineer-equivalent hours of the tasks the team logs in the in-scope repositories, divided by the total agent session hours spent on them, on the same kind of work.
• The Hardening is invoiced in full only if every finding rated critical in the findings register, as agreed at the week-two readout, is closed at week six, verified by a re-scan run the same way as the first. A critical finding the client accepts in writing as a risk counts as closed, as does one whose fix the client declined, or approved but had not applied by the re-scan.
• The Optimization is invoiced in full only if the annualized savings in place at the end of week six are at least three times the fee. Savings are measured change by change on the client's Cost and Usage Report: the cost of each changed resource in the week before the change against the week after it, and the on-demand cost of the usage each commitment covers less its amortized cost, annualized. A change the client approved at the week-two readout and later declines counts at the savings the roadmap estimated for it. If the changes the client approves from the week-two savings roadmap do not total at least three times the fee, the engagement ends when the client's approvals close, at most two business days after the readout, unless both parties agree in writing to continue. The client then pays the Analysis fee in place of the Optimization's: the half invoiced at signature is credited against it, and the balance is invoiced. The closing readout is held once the last change has seven days of data, at most ten business days after week six.
• The Build is invoiced in full only if every check of the foundation scan agreed at the week-two readout passes at week six, verified by the same scan run the same way as the first, and every in-scope account is in its target organizational unit. A check the client waives in writing counts as passed, as does one whose change the client declined, or approved but had not applied by the re-scan.
• The Remediation is invoiced in full only if every High-Risk Issue (HRI) in the workload's HRI register, as agreed at the week-two readout, is closed at week six, verified in the week-six AWS Well-Architected Tool milestone. A High-Risk Issue the client accepts in writing as a risk or defers as a multi-quarter application rewrite counts as closed, as does one whose fix the client declined, or approved but had not applied by the week-six milestone.

A security or Well-Architected register item the sponsor objects to counts toward its gate only once the objection is resolved; a High-Risk Issue closes only with recorded evidence of an applied change; a declined change that did not conform to what was agreed, or one Vantalect delivered too late to apply, never counts in Vantalect's favor at a gate; and in the multi-account engagement, no change window is held and no account moves until the sponsor agrees to the account map and the path in writing. Before Vantalect relies on a missed client obligation, it says so in writing within two business days.

The multi-account add-on to the security engagement

A client that signs the AWS security engagement, in either shape, may take the multi-account engagement's Build as an add-on, The Build after a Security Audit, under its own statement of work, signed after the security engagement's statement of work or together with it. The security engagement's inventory and governance review stand in for the Blueprint's discovery, so the add-on runs four weeks, for a fee of $25,000, fixed, with up to 70 consultant hours (about 30 live with the client's team, estimated), and week one begins no earlier than the Audit's sponsor readout. It delivers the Build's deliverables, with the design, the policy set, the move plan, and the risk register written in its first week; it is invoiced half at signature and half only if the Build's measurement gate above is met at the end of week four; and the client obligations and access terms of the Build apply to it. Either party may end it as described under Termination, without the minimum that applies after week two of a six-week engagement; if Vantalect ends it before its measurement gate is decided, other than for the client's breach, the client pays no more than the half invoiced at signature. The client's payment is refunded in full if the security engagement ends before its sponsor readout, other than for the client's breach, or if the add-on's week one has not begun within sixty days of signature. The two engagements share one Pavilion workspace, exported after the later closing readout, and the security engagement's read-only role stays until the add-on ends.

When the security engagement's Hardening and the multi-account engagement's Build run together, as an add-on or in a bundle, the Build delivers the organization-level guardrails, the organization trail, and delegated detection once for both, and a critical finding the Build closes counts as closed for the Hardening.

Bundles

A client that takes two or more of the AWS security, cost, Well-Architected, and multi-account engagements under one master services agreement, listed on one Bundle Schedule, pays each engagement's fee less 10% when it takes two, or less 15% when it takes three or more, in either shape. Engineering leverage is not part of the bundle, and the multi-account add-on is priced net: it takes no bundle discount and does not count toward one. The discount is set at signature by the number of engagements selected and does not change afterward, including when an engagement ends early, except that an engagement the client cancels before it starts, other than for Vantalect's breach, does not count toward it; the others are then billed at the discount for the number that remain. An engagement canceled because Charles is unavailable, because of an event beyond either party's control, or after Vantalect ends a listed engagement still counts.

In a bundle, the engagements share one access setup, one kickoff, and one Pavilion workspace, and they start two weeks apart unless the Bundle Schedule sets other start weeks. Each engagement keeps its own scope, deliverables, consultant hours, and measurement gate, and each is invoiced on its own terms at its discounted fee, with every first invoice issued at signature. The discount does not change any measurement gate: the cost engagement's gate stays at three times the Optimization's list fee. If the changes the client approves from the cost engagement's week-two savings roadmap do not total at least three times the Optimization's list fee, that engagement ends when the client's approvals close, at most two business days after its readout, unless both parties agree in writing to continue; the client then pays the Analysis's discounted fee in place of the Optimization's, with the half invoiced at signature credited against it, and the other engagements continue. Either party may end one engagement in a bundle, or all of them, as described under Termination; the others continue at their discounted fees. If Vantalect ends a six-week engagement in a bundle before its measurement gate is decided, other than for the client's breach, the client pays no more than half of that engagement's discounted fee. Each engagement's record is exported at its own closing readout.

The Fulcrum license

Each leverage engagement includes a one-year license to install and use Fulcrum in the client's environment, for any number of the client's users, starting at installation; during that year the master services agreement controls over Fulcrum's own license terms. Renewal is optional at $1,199 per year. The leverage record the client builds is the client's whether or not it renews, and nothing it records is transmitted to Vantalect or to Renkara Media Group, Inc., the maker of Fulcrum. Fulcrum's own license terms are published at fulcrum.renkara.com.

What the AWS engagements are not

The security, Well-Architected, and multi-account engagements are technical assessments and remediation of an AWS environment, workload, or organization. They are not an audit opinion, an attestation, a certification of compliance, or a penetration test: SOC 2 reports are issued by licensed CPA firms and PCI DSS assessments by Qualified Security Assessors, and Vantalect is neither. The savings named in an Analysis are estimates made from the client's own usage and prices at the time. Vantalect does not purchase commitments or apply changes on the client's behalf; the client decides and applies every change, except the management-account actions of an approved multi-account change window. Vantalect does not buy, sell, or exchange a commitment in any engagement.

Ownership and confidentiality

The client owns outright the guidance files, gates, workflows, integrations, infrastructure code, policies, runbooks, plans, playbooks, recordings, and reports delivered under the engagement, once every undisputed invoice then due is paid. Vantalect keeps the measurement of the leverage and cost engagements (the baseline and closing numbers) and may cite it with the client's name removed unless the client agrees otherwise in writing. Security findings are never cited, with or without the client's name, and neither are Well-Architected High-Risk Issue registers or a multi-account engagement's inventory, scan results, and account map. All work happens inside the client's repositories and accounts. A mutual non-disclosure agreement, where one is signed, continues; where it and the master services agreement differ, the term more protective of the disclosing party applies.

Also in the master services agreement

The master services agreement also covers notice of a security incident, including suspected misuse of the credentials and roles issued for an engagement; how personal data is handled; the client's indemnity, which does not reach Vantalect's own negligence or defects; the client's license to use a deliverable while its invoice is pending; citation that never identifies the client; assignment to an affiliate; and how the agreement itself ends.

Termination

Either party may end an engagement with five business days' written notice. Vantalect then invoices consultant hours spent to date at $450 per hour, capped at the fee for the engagement, and refunds anything the client has paid beyond that within fifteen days, less any set-off a Bundle Schedule allows; the client keeps everything delivered to that point. In a six-week engagement, a client that ends it after week two, other than for Vantalect's breach, pays at least the two-week diagnostic's fee, and if Vantalect ends it before its measurement gate is decided, other than for the client's breach, the client pays no more than the half invoiced at signature.

Warranties and liability

Vantalect warrants that the work will be performed in a professional and workmanlike manner by Charles Sieg, and re-performs work that does not conform if the client reports it within thirty days of the closing readout. Beyond the measurement gates above, no particular result is guaranteed: the client's team, systems, and choices determine the number, and a security, Well-Architected, or multi-account engagement reduces risk but cannot guarantee that an environment will never be breached or a workload will never fail. Each party's liability arising from an engagement, and in total, is limited as the master services agreement sets out, generally to the fees paid for that engagement, and neither party is liable to the other for indirect or consequential loss, with the exceptions the master services agreement names.

Part three: general

These terms are governed by the laws of the State of Texas, without regard to its conflict-of-laws rules. If any provision is unenforceable, the rest remain in effect. Changes to these terms are posted here with a new effective date and apply to engagements signed after that date. Questions go to info@vantalect.com.

Vantalect, LLC · info@vantalect.com · 847.331.3649