FullTrust
Book a scoping call
Promise and guarantee

Our commitments to you

Compliance is a business risk, and we share it with you. We believe in our work so much that we put our own fees at risk to prove it.

Our promise

Become audit ready in 90 days

This is our operational commitment. Ninety days from kickoff, your company is in a state where it can enter an independent audit. It is what we hold ourselves to internally and what we report against every week.

If you delay remediation, hold back evidence or leave required changes undone, the timeline moves accordingly. We will tell you the moment that risk appears — never at day 89.

Our guarantee

Pass the agreed audit — or get 50% of your money back

Once you are audit ready, we share the financial risk of the outcome. If you do not pass the audit we prepared you for, we refund half of everything you have paid us.

That is half of every fee you have paid us for the engagement — not a share of what you paid your auditor. The precise terms live in your service agreement, and we would rather set them out now than surprise you later.

The guarantee applies when

  • You completed the remediation actions we agreed on
  • You provided the requested evidence on time
  • You followed our documented recommendations
  • The audit scope did not materially change after we set it
  • The audit was performed by an appropriate independent or accredited auditor
  • The failure relates to the area we committed to prepare

All precise terms are set out in the Master Service Agreement before you sign. Nothing here is a substitute for that document.

What we need from you

Answers within a few days
Not same-day heroics. Just a reliable loop so the program never stalls waiting on a reply.
Access to your people
Short, scheduled time with the engineers, IT and managers who own the systems in scope.
Remediation gets done
Either your team executes the agreed fixes, or you let our ITOps and DevSecOps teams do it.
A stable scope
If the scope changes — new product, new region, new framework — we reset the plan together.
The path

Ninety days, three phases, one outcome

This is how we keep the promise. It holds as long as you answer our requests, give us access to your people, and either complete the agreed remediation or let us do it for you.

  1. Day 0 — 30

    Understand & plan

    Know exactly where you stand and what it will take.

    • Onboarding and framework selection
    • Scope definition and boundary setting
    • Inventory of assets, systems, vendors, personnel
    • Gap assessment against the target framework
    • Review of existing controls, evidence and policies
    • Technical gap analysis
    • Remediation roadmap with named owners
    Outcome

    You and we know precisely where the company stands, what is missing, and what has to happen to pass.

  2. Day 31 — 60

    Implement & operate

    Stop assessing. Start running controls for real.

    • Policies written, reviewed and adopted
    • Compliance workflows switched on
    • Evidence collection running on a schedule
    • Access reviews executed
    • Employee and vendor workflows in place
    • Security awareness training delivered
    • Remediation tracked to closure with IT and engineering
    Outcome

    Most controls are not just documented — they are operating, and evidence is accumulating on its own.

  3. Day 61 — 90

    Validate & get audit ready

    Look at your program the way the auditor will.

    • Evidence validated against control requirements
    • Control effectiveness tested
    • Remaining gaps closed
    • Formal readiness review
    • Audit package assembled
    • Your team prepped for auditor questions
    • Exceptions documented, scope confirmed
    Outcome

    The company is audit ready and can enter an independent audit with confidence.

Start the clock

Ninety days from today, this could be behind you

Tell us the framework, the deadline and who is asking. We will come back with a scope, a price and a start date.

Book a scoping call See pricing