THE CONTRACTOR

AWS security for startups · Boston

Find the open doors.
Lock them in 10 days.

Fixed-price AWS security for startups with no security team. We find what is exposed in your account, rank it by business risk, and fix it with code you own.

Run the 60-second exposure check Book a Security Scan · $1,500
AWS Certified Security – Specialty AWS Certified Solutions Architect – Associate

TC-00 The part nobody told you

AWS secures the cloud.
You secure what you put in it.

This is the AWS shared responsibility model. AWS protects its buildings, servers and network. Every user, key, bucket and setting in your account is your job, and most startups never get to it.

Amazon's side

Security of the cloud

  • Data centers and physical access
  • Servers, storage hardware, network
  • The software that runs AWS itself

Your side

Security in the cloud

  • Who can sign in, and with which keys
  • Which buckets and databases are public
  • Whether activity is logged and watched
  • Encryption, alerts and billing limits

$10.22M

Average cost of a data breach in the United States in 2025, a record high.

Source: IBM Cost of a Data Breach Report 2025

$4,500

Fixed price to lock down the most common and most dangerous problems in up to 3 AWS accounts.

The Lockdown package · 10 business days

TC-01 Exposure check

How exposed is your account?

Six questions. Answer for your main AWS account. "Not sure" counts as a risk, because an unknown setting is an unchecked one. Nothing you enter leaves this page.

TC-02 What you receive

A report your CEO and your engineer can both read.

  • RankedYour top 10 risks, worst firstRanked by what could actually hurt the business, not by tool output.
  • PlainBusiness impact in one sentenceSo a founder can decide in minutes what to fix first.
  • ProofEvidence for every findingThe exact resource, setting and how we found it.
  • FixThe fix, ready to applyStep by step, and as Terraform code when you choose Lockdown.
  • Call45-minute walkthroughWe go through it together and answer every question.
THE CONTRACTOR · SECURITY SCANDEMO REPORT · PAGE 3 OF 14
CRITICALFinding TC-01 · IAM · account 1111-2222-3333

The root account has active access keys

Impact
Anyone who finds this key controls the whole account: data, servers, billing. It cannot be limited by any permission.
Evidence
1 active key, created 2 years ago, last used 9 days ago from a developer laptop.
Fix
Create named admin users with MFA, move the work to them, then delete the root key and add an alarm on any root sign-in.
Effort
About 1 hour. Included in Lockdown.
resource "aws_cloudwatch_metric_alarm" "root_login" {
  alarm_name          = "root-account-used"
  namespace           = "CISBenchmark"
  metric_name         = "RootAccountUsage" # CloudTrail metric filter
  statistic           = "Sum"
  period              = 300
  evaluation_periods  = 1
  threshold           = 1
  comparison_operator = "GreaterThanOrEqualToThreshold"
  alarm_actions       = [aws_sns_topic.security_alerts.arn]
}

Demo report from a test account built for this purpose. Client reports are confidential.

TC-03 Packages

Four packages. Fixed scope. Fixed price.

Start with the scan. If you then want the fixes, the full $1,500 counts toward Lockdown for 30 days.

Find

Security Scan

For teams that don't know how exposed they are.

$1,5005 business days
  • Read-only access, nothing changed
  • Automated and manual review of IAM, logging, storage and network
  • Top 10 risks, ranked, each with its fix
  • 45-minute walkthrough call
Book a scan
MOST CHOSEN

Fix

Lockdown

For teams that need the dangerous problems fixed, fast.

$4,50010 business days
  • Root account secured, MFA enforced
  • Unused users and old keys removed
  • CloudTrail, GuardDuty, Security Hub and Config on, with alerts
  • Public storage blocked, encryption on
  • Billing alarms
  • All as Terraform code you own

Up to 3 AWS accounts

Start Lockdown

Prove

Audit-Ready

For teams with a SOC 2 audit coming.

$7,5003 weeks
  • Everything in Lockdown
  • AWS controls mapped to SOC 2
  • Cloud gaps closed
  • Evidence pack for your auditor

AWS technical controls only. Not an audit or a certification.

Ask about Audit-Ready

Keep

Guard

For teams that want it to stay secure after the fix.

$750per month · 3-month minimum
  • Monthly scan, compared with last month
  • GuardDuty and Security Hub findings reviewed
  • Up to 2 hours of small fixes
  • One-page monthly report
  • Reply within 1 business day
Subscribe to Guard

Founding offer. The first 3 clients get 30% off any package in exchange for a short case study.

Claim a founding spot

TC-04 How it works

From payment to report in 5 days.

One call, no meetings in between. You spend about 30 minutes of your own time.

  1. DAY 0

    Pick a package, pay

    A short intake form arrives right after payment.

    your time: 10 min

  2. DAY 1

    Grant read-only access

    One click creates a limited role in your account. Remove it any time.

    your time: 5 min

  3. DAY 1–3

    We scan and review

    Automated checks, then a manual review of what tools miss.

  4. DAY 4

    Report delivered

    Ranked risks in plain language, each with its fix.

  5. DAY 5

    Walkthrough call

    You decide what to fix. We do it, or your team does.

    your time: 45 min

TC-05 How we work

Security work should not add risk.

Read-only first

The scan changes nothing. We never ask for passwords or root keys.

You approve every change

Each fix is a Terraform plan you review before anything runs.

You own the code

Every fix lands in your repository. No lock-in, no black box.

Fixed price, fixed end

You know the cost and the delivery date before we start.

The Contractor emblem: a shield holding a locked cloud

TC-06 Who you work with

One specialist. Start to finish.

The Contractor is an independent AWS security practice in Boston, run by Frankault Fandal, AWS Certified Security – Specialty and Solutions Architect – Associate.

It is small by design. The person on your first call is the person who reads your account, writes your report and ships your fixes. No hand-offs, no junior team, no sales layer.

One cloud, one job: making startup AWS accounts safe.

TC-07 Questions

Before you ask.

Do you need admin access?

No. The scan uses a read-only role you create with one click. For Lockdown, the role is limited to the services we change and is removed at handoff.

Will you break something in production?

Every change is a Terraform plan you approve first. We test outside production when possible, and every change has a rollback plan.

Is Audit-Ready a SOC 2 certification?

No. Only an accredited auditor issues a SOC 2 report. We prepare the AWS technical controls and the evidence the auditor will ask for.

We use Vanta or Drata. Do we still need this?

Those platforms show you what is failing. They do not fix your AWS account. Lockdown and Audit-Ready close the cloud items they flag.

Do you work on Azure or Google Cloud?

Not today. AWS only, so the work is deep instead of wide.

How do we pay?

By card or invoice, before work starts. The price is fixed in the written scope, so there are no extra hours on the bill.

TC-08 Start

Know your risks in 5 days.

Tell us about your AWS setup. You get an answer within 1 business day with next steps and a payment link.

Free check Book a scan