How I Work
PROTECT · PREVENT · PREPARE
I publish my prices because I've never liked "call for a quote." This page exists for the same reason.
Before you hire someone to handle your business's data, you should be able to read exactly what you're agreeing to — what I'll do, what you're responsible for, how you get out if it isn't working, and what happens to your information when we're finished. None of that should be a surprise buried in a document you sign on setup day.
So here it is, in plain English. The actual signed agreement has the legal language; this page tells you what it means.
Before any work happens
You get the agreement first, and you sign it before I touch anything.
Two documents:
The Master Service Agreement. This is the relationship — responsibilities, confidentiality, liability, how either of us ends it. You sign it once. It doesn't change from client to client, and you can read the whole thing right now without talking to me.
A Statement of Work. This is your specific engagement — which service you're on, what's included, what isn't, and what it costs. It's one page. Everything I'm going to do is checked off on it, and everything I'm not going to do is checked off too, including the technology work I don't handle.
I split those two on purpose. The agreement is the same for everyone. The Statement of Work is yours, and it's short enough that you'll actually read it.
Who is responsible for what
This is the part most agreements get vague about, and vagueness here is how people end up surprised on the worst possible day.
What I'm responsible for:
Setting up your protection the way the Statement of Work describes it
Watching your backups and telling you when something is wrong, where your Statement of Work includes that — it's the service, not a courtesy
Giving you a written Recovery Status Report on a regular schedule, so you're not taking my word for it
Answering when you call about a security question
Keeping anything I hold on your behalf where it belongs, and telling you where that is
What you're responsible for:
Telling me when something material changes — a new computer, a new cloud account, a staff member who leaves, a location that moves
Keeping the drive I set up plugged in and powered, if your service includes a local copy
Reading the reports I send you. I'll flag the problems; you have to open the email
Anything outside the Statement of Work, including general technology support, which I don't provide
If a backup fails and I don't tell you, that's on me. If a backup fails because the drive got unplugged in March and nobody mentioned it, we'll figure it out together, but I'd rather you just tell me in March.
Getting out
Thirty days' written notice, either direction, no reason required.
There's no annual contract, no automatic renewal you have to remember to cancel, and no early termination fee. If it isn't working, you leave, and I'd rather you leave than stay unhappy.
If you go, I'll tell you honestly what you should set up next, whether or not it involves me.
Where your data lives, and what happens to it when we're done
If your service includes an off-site copy, I hold it. That's a real responsibility, so here's exactly how it works.
Where it goes. Your off-site copy lives in business cloud storage that I control, under a signed agreement with the provider covering how that data is handled. It isn't sitting on a laptop, and it isn't on a drive in my truck.
Why it's separate from you. The whole point of the off-site copy is that it's somewhere your own computers can't reach. If ransomware gets into your office, it can encrypt everything the office can touch. It cannot touch this.
Who can see it. Me. Not a team, not a subcontractor, not an overseas help desk.
What happens at the end. When our agreement ends, ask me in writing and I'll delete or destroy everything of yours I hold — including any off-site copy — and issue a written Certificate of Data Destruction within thirty days. It identifies what was destroyed and the method used, and it's dated and signed. You keep it. It's the document you hand an auditor or an insurer who asks what happened to the old data.
To be precise about what it covers: it covers data and media in my possession. Drives and backups sitting in your own accounts or on your own equipment stay yours and aren't touched by the agreement ending — which is the point. Your data shouldn't disappear because our arrangement did.
If your business is regulated. If you handle health records, card payments, or anything with retention rules attached, tell me during the Data Safety Check. There are extra arrangements that have to be in place before I hold that kind of data, and I'd rather sort them out before we start than after.
What happens to the software if you leave
If your service includes VaultGuard Backup, the license stays active while your service is active and runs for thirty days after the agreement ends. After that you can buy a subscription directly if you want to keep using it.
Here's the part that matters more: you are not locked in. The backups made under your service use the backup format built into Windows itself, not something invented here. So even with no license and no relationship with me, you can restore those backups using the recovery tools already in Windows. I built it that way deliberately. A backup that only works while you're paying me isn't a backup, it's a hostage.
What I'm liable for
My total liability under the agreement is capped at the fees you've paid me in the previous twelve months.
That's standard for this kind of work, and I'm putting it on a public page rather than only in a signed document, because you should know it before you're invested rather than after. What it means in practice: I carry real responsibility for doing the work correctly, and I am not an insurance policy against every possible outcome. If you need coverage beyond that, cyber insurance is the right instrument, and I'm happy to talk through what a policy would actually ask of you.
Billing
Setup fee and monthly service are invoiced through Stripe. Payment is due within fifteen days.
The quote matches the invoice. There are no line items you didn't see coming, no fuel surcharges, no after-hours multipliers, and no annual increase written into the agreement.
Late invoices accrue interest at one and a half percent per month. I'd rather never use that, and I'm telling you it exists so it isn't a surprise if it ever comes up.
Emergency and hourly work is billed at the published rates on the services page — active clients pay less, and that discount is the same whichever service you're on.
If money is tight one month, tell me before the invoice is late. I'd rather work something out than send a reminder.
Working with one person
When you call, you get me. Not a call center, not a ticket queue, not a different technician each visit who has to be told your setup from scratch.
I want to be straight about both sides of that.
The good part: nothing gets lost in a handoff. I know your setup because I built it. You never explain your business twice.
The honest part: I'm one person. I'm not a 24-hour operation, and I won't pretend to be. What I commit to is responding quickly during the day and treating a real emergency as an emergency. If you need someone monitoring your systems at three in the morning, you need a larger firm, and I'll tell you that rather than take your money.
If something actually goes wrong
Ransomware, a breach, a dead computer on a Monday morning — this is what the whole arrangement is for.
You call. We start with what's still intact rather than what's lost, because in most cases more survives than it looks like at first. If you're an active client, your call goes ahead of non-client emergencies, and your emergency rate is half.
I won't tell you to pay a ransom, and I won't tell you never to — that's your decision with your lawyer and your insurer. What I will do is make sure it's a decision rather than the only option left. The best negotiating position is not needing one.
Still have questions
That's what the free Data Safety Check is for. Thirty minutes, no charge, no obligation, and no quote pitched at you unless you ask for one.
Book a free Data Safety Check →
David Martin
Information Security Kentucky, LLC
Protect. Prevent. Prepare.
Hardin County, Kentucky