How Our Engagements Work

The short version

Every engagement starts with a first look, then a written scope of work with a fixed price and timeline that you approve before anything starts. The signed scope of work is the agreement between us; this page explains what it normally contains, so you know what to expect before you contact us.

Getting started

• The first look is free: we check the site from the outside, and within one business day you get a written, fixed quote.
• For a hacked site, work starts the same or next business day after you approve the quote.
• A cleanup is a one-time job with no subscription. Ongoing care is optional.

What every scope of work states

• The systems in scope, and what we will do on each of them.
• What is excluded, so neither side assumes work that wasn't agreed.
• The deliverables: the reports, fixes and checks you receive at the end.
• The fixed price, the expected timeline and the payment terms.
• The named approver on your side, and the change windows for anything that touches production.
• The access we need and why, following our client access procedure.

What every engagement delivers

• A written report: what we found, what we changed, and what is left for you to decide.
• Security audits include a walkthrough of the findings and a retest once fixes ship.
• Malware cleanups include an incident report: how the attacker got in, what they changed, and what we removed.
• After a cleanup, we monitor the site for 30 days at no charge. If it is reinfected in that time, we clean it again at no cost, under the conditions set in your contract.
• Hardening and remediation work includes a record of every change, each with its verification result.

Changes and out-of-scope work

• If we find something outside the agreed scope, such as another infected site on the same hosting account, we report it to you and don't act on it.
• Extra work is quoted separately and only starts after your written approval.
• Ongoing care is a flat monthly fee for the scope listed in the agreement. You can choose month-to-month with no commitment, or a fixed term.

Communication

You get a single point of contact by email. Client messages are answered within two business days at the latest, and an active incident always goes to the front of the queue. You are kept updated at each step the scope of work lists. New enquiries go to contact@westoakbridge.co or through our contact page.

Your data

• We keep only what the work needs. Credentials you share with us are kept in an encrypted password manager and deleted when the engagement ends.
• Forensic copies and backups taken during a cleanup are stored encrypted and stay available to you for 30 days after the engagement ends, then are deleted, unless you ask us in writing to delete them sooner or keep them longer.
• Session records, which list who connected, when, from where and what changed, are kept for 3 months so either side can check later what happened.
• Reports are yours. We keep a copy for our records and never share it.
• We never name you as a client, or publish details that could identify you, without your written permission. Our case studies are anonymised.

Who you contract with

West Oakbridge is operated by CDKenda, LLC, and your contract is signed with that company. The contract sets out the scope, price, payment terms, warranties and liability, and it takes precedence over this page. Our registered office is listed in our privacy policy.