Pricing

Real numbers so you can work out whether to keep reading. Every job is quoted after we have read your description, and the quote is what you pay.

Prices exclude VAT. Fixed-price work is billed per milestone, retainers monthly in advance. What moves a number: how much of the system we have to touch, whether there is an existing codebase to work around, and how fast you need it.

Authentication

Priced per project. Milestones are billed as they land, so you never pay ahead of work you have not seen.

Login essentials

from 2,400 EUR one project

You have an app and the login needs to stop being a liability.

  • Password handling with Argon2id
  • Email verification and reset that cannot be abused
  • Sessions, logout, device list
  • Rate limiting and lockout
  • Tests on the paths that matter
Full identity layer

from 6,500 EUR one project

Multi-tenant product, real permissions, customers who ask questions.

  • Everything in Login essentials
  • Passkeys, WebAuthn and TOTP
  • Roles, permissions and tenant isolation
  • API keys and machine-to-machine tokens
  • Audit log of who did what
  • Admin tooling for your support team
Enterprise SSO

from 9,800 EUR one project

A deal is blocked because procurement wants SAML.

  • SAML 2.0 and OpenID Connect
  • SCIM provisioning and deprovisioning
  • Per-tenant identity provider config
  • Just-in-time account creation
  • Group and role mapping
  • A test IdP your team can break things against

Infrastructure design

On your cloud account or your own hardware. Everything lands as code in your repository.

Hardening pass

from 1,900 EUR one project

It runs, it works, nobody is sure it is safe.

  • Firewall and network segmentation
  • SSH, users and sudo cleaned up
  • TLS and reverse proxy config
  • Automatic security updates
  • Backups that get restored once to prove they work
Design and build

from 4,800 EUR one project

Starting fresh, or the current setup is past saving.

  • Architecture written down before anything is provisioned
  • Terraform or Ansible, reviewed like code
  • Private networking and WireGuard
  • CI/CD with signed builds
  • Staging that actually matches production
  • Runbooks for the things that go wrong at 3am
Managed

90 EUR per server, per month

You would rather not be the one patching it.

  • Patching and dependency updates
  • Monitoring and alert tuning
  • Backup checks
  • Certificate renewals
  • Quarterly report on what changed

Encryption

We never hold your keys. Key material is derived and held on your side, which also means we cannot get your data back for you if you lose it.

Design review

from 1,500 EUR one project

You already encrypt something and want to know if it holds.

  • Algorithm and mode choices checked
  • Key derivation and storage reviewed
  • Nonce and IV handling
  • Threat model written down
  • A report in plain language
Client-side encryption

from 3,900 EUR one project

Data that should be unreadable even to you.

  • AES-256-GCM or ChaCha20-Poly1305
  • Argon2id or HKDF key derivation
  • Encrypted search and sharing where possible
  • Recovery paths that do not undo the point
  • Documented key rotation
Key management

from 2,900 EUR one project

Secrets are in the repo and everyone knows it.

  • Vault or HSM set up and integrated
  • Secrets pulled out of code and CI
  • Rotation as a scheduled job
  • Per-environment separation
  • A written recovery procedure

Review

Fixed fee, fixed scope. The re-check after you fix things is included in all three.

Focused

890 EUR one-off

One area, usually the login.

  • One day of reading code and config
  • Authentication and session handling
  • Findings with reproduction steps
  • A short call to go through it
Application

2,400 EUR one-off

The whole app, front to back.

  • One week
  • Auth, access control, injection surface
  • Secrets in code, logs and images
  • Dependencies with known holes
  • Findings ranked by what an attacker gains
  • Report your developers can work from
Application and infrastructure

from 5,900 EUR one-off

Everything, including what it runs on.

  • Two weeks
  • Everything in Application
  • Servers, network and cloud configuration
  • CI/CD and supply chain
  • Management summary alongside the technical report

After it is built

Nobody has to take a retainer. Plenty of customers take the handover and never write again, which is fine, that is what the documentation is for.

PlanPriceResponse timeWho it is for
Standard190 EUR / monthNext working dayPatches, questions, small changes. Good for a system that is done and quiet.
Priority490 EUR / monthFour hours, working daysYou are shipping often and want someone who already knows the codebase.
On call1,290 EUR / monthOne hour, any timeNights and weekends included. For systems where downtime costs real money.

Rates and smaller things

Day rate950 EUR / dayFor work that does not fit a fixed price. Billed in half days.
Incident response190 EUR / hourMinimum four hours. Retainer customers get this at the normal day rate.
Re-test after fixesIncludedWithin 60 days of a review, for the findings in that report.
Workshop for your team1,200 EUR / dayAuth, crypto or threat modelling, with your own code as the example.
Second opinion450 EURTwo hours on a design or a decision you are stuck on. No report, just the answer.

Things people ask about the price

Why from, and not a fixed number?

Because an identity layer on a clean Next.js app and the same thing on a twelve year old PHP monolith are not the same job. Once we have read your description you get one number, and that number holds unless you change what you asked for.

What if it takes longer than you thought?

Then it takes longer and you pay the quoted price. That risk is ours, it is the reason we scope before we start rather than billing hours and hoping.

Can we start small?

Most people do. A focused review is 890 EUR and tells you whether the rest is worth spending money on. If you go ahead with a build within 60 days, that fee comes off the project price.

Do you work with startups on a budget?

Sometimes, if the work is interesting. Say what you can spend in the request form and we will tell you honestly whether there is a sensible version of the job at that number.

Not sure which line you are on?

Describe the system in a paragraph. We will tell you which of these it is, or that you do not need us.

Ask for a quote