# FAQ — Engagement, Pricing, Compliance | RedactLabs

> Source: https://redactlabs.ca/faq/
> Machine-readable Markdown of this page (also served at this URL under `Accept: text/markdown`).

# Questions, answered.

How we engage, what it costs, how fast we start, how we operate. Plainly stated.

10 QUESTIONS 3 SECTIONS

## Engagement & pricing

4 QUESTIONS

Audits and fixed-fee projects have no minimum beyond the scope. Managed plans carry a monthly minimum (from $750) and a 12-month term, billed monthly. Sentinel Advisory™ (vCISO) runs on a 12-month term, or a 6-month pilot at +10%. Website Care plans run month to month with 30 days' notice, or 12 months when bundled with a build. We do not lock clients into multi-year contracts.

No. The first 30-minute call and any follow-up scoping conversations are free. We commit a fixed-fee proposal before any signed agreement.

For audits and assessments: typically within 2 weeks of signed agreement. Managed retainers: onboarding within 30 days. Website builds: 4–8 weeks for full scope, faster on existing relationships.

Yes — this is one of our most common entry points. We run a transition audit, document everything we inherit, and stand up clean operations within 30–60 days while keeping the lights on. On a managed plan, the takeover is part of onboarding.

## Security specifics

4 QUESTIONS

No. We don't run a 24/7 response desk. Clients on a managed plan, or a Website Care plan with Managed Security, get a first reply to a security incident within 1 business hour (business hours: Monday to Friday, 9:00 to 17:00 ET). Other clients can engage emergency response on a time-and-materials basis.

The Sentinel Exposure Review™ is fixed-fee by headcount: $6,500 CAD for up to 20 staff, $11,500 for 21–75 and $18,500 for 76–150. Larger organizations are scoped after an initial conversation.

Our practices are aligned to PIPEDA, Quebec Law 25, PHIPA, and CyberSecure Canada. We provide board-ready compliance documentation as part of charity and SMB engagements.

Yes. We are vendor-agnostic by design. We work with your existing EDR, SIEM, firewall, and identity stack, or recommend a refresh based on what fits your operational profile and budget.

## Operations & infrastructure

2 QUESTIONS

All three, with specific hardening playbooks for each. Identity, MFA (passkey-preferred), conditional access, DLP, and audit logging configured to a defensible baseline. For privacy-sensitive clients we lean Proton; for regulated Canadian organizations we lean M365 with CA-region data residency; for everyone else, the right choice is whichever your team already runs well.

On Managed IT Complete and Managed IT Assured: a first reply to an urgent IT issue within 1 business hour, and to a standard request within 4 business hours. Security incidents: a first reply within 1 business hour on every managed plan. All in business hours (Monday to Friday, 9:00 to 17:00 ET); there is no 24/7 response.

## Ask us directly.

Email, call, or fill out the contact form. A senior engineer responds within one business day.