Brief first · async by default
Start in writing. Add a short call only if it helps.
Security buyers who need a clear owner and a fixed SOW before money moves. Yellow Theme runs engagements asynchronously: written fit note, fixed-fee scope you can reject against, then deposit. There is no public calendar and no required intro call.
From brief to deposit
- 1. Tell us what is blocked. Share the compliance target, primary cloud, source and CI setup, and what should stay out of the first pass. You can add one sentence about the deadline.
- 2. Review the fit note. It explains the likely engagement, the open questions, and whether Yellow Theme is the right partner. A written poor-fit beats a polished plan for the wrong problem.
- 3. Use a short call if useful. After the fit note, reply to that email and request an optional call of up to 20 minutes before signing. The call is never required. There is no public scheduler.
- 4. Approve the fixed scope. The SOW names the deliverables, acceptance criteria, timeline, fee, and independent-auditor boundary. The deposit opens the engagement.
- 5. Work through the repositories. Implementation and evidence stay close to the systems they describe. Written replies arrive within 24 business hours.
The optional call
Start with the written brief. After the fit note, you can reply and request up to 20 minutes before signing if you want a voice. After the deposit, meetings stay light: at most one 30-minute sync each week, usually during the morning engineering window. We do not run a book-a-demo funnel.
Hours and reply SLA
- Engineering work happens in focused morning blocks from 7:00–10:30 a.m. Central Time.
- Written replies arrive within 24 business hours.
- Weekly syncs stay at most 30 minutes when needed — not a standing daily standup.
- The founder/operator scopes every statement of work and reviews deliverables before they ship.
After the deposit
The client portal carries Plan and Evidence for the engagement: milestones, published artifacts, and written progress. Continuity is in the workspace and the inbox — not a chat transcript.
Boundaries that stay honest
- Yellow Theme is not the auditor. An independent CPA issues the report. SOC 2 engineering install.
- We do not replace your GRC platform. Platforms organize the program; we install gates in git. vs GRC platforms.
- Guardrails and Infrastructure as Code are typically mid five figures; the optional retainer is typically mid four figures per month. Exact fees are in the SOW only.
- AI may assist under zero-data-retention; a person reviews artifacts before they ship. FAQ.
Delivery principles and reference architecture live on Methodology — this page is the buyer funnel, not a duplicate of those principles.
Start with the constraint
Send a short brief for a written fit note and fixed-fee SOW — or check readiness first. You see both before any deposit.
FAQ · SOC 2 · vs GRC platforms