Services
Deployed, hardened and reviewed by the people who build the images.
Three ways to work with us: take our scripts and run them yourself, hand us a fixed-scope job with a fixed price, or keep an engineer on retainer. Prices are public, the scope is written down, and you pay for your first package after it is delivered.
01Pricing
Three slabs, no hourly surprises.
Self-serve for engineers who want the scripts. Done-for-you when you want it finished this week. Custom when it needs a proposal.
Self-serve
from $10
one-time, instant download
Scripts, templates and pipelines you run yourself.
For engineers who want the exact scripts our images ship with, without booking anyone.
- First-boot and hardening scripts per image
- GitHub Actions and GitLab CI pipeline templates
- Terraform launch modules for the catalog
- Backup and restore scripts
- Free updates for a year
Done-for-you
Most popularfrom $149
founding rate, one-time
Fixed scope, fixed price, delivered in days.
For teams that want it deployed, migrated, hardened or reviewed by the engineers who build the images.
- Deployment of any catalog image
- Bitnami to ProvenCloud migration
- CI/CD pipeline setup
- Security and best-practice hardening
- AWS account review and cost audit
- Pay after delivery on your first package
Custom and ongoing
Custom
retainers from $1,500 per month
Bespoke deployments, retainers and yearly contracts.
For companies that need a named engineer, an SLA, or infrastructure that does not fit a package.
- Custom multi-service deployments
- Fractional DevOps engineer
- 24/7 managed operations with an SLA
- Private image builds for your own stack
- Yearly contracts with two months free
The first 20 done-for-you engagements are priced at the founding rate. It moves to the standard rate after that, and the standard rate is printed next to it so nobody is surprised.
Pay after delivery
On your first done-for-you package you pay after delivery, once you have verified the work in your own account.
30-day money back
Every fixed-price package carries a 30-day money-back guarantee. If the deliverable does not do what the scope says, you get a refund.
Scoped access only
We work through a scoped IAM role you create and can revoke at any time. We never ask for root credentials.
Your account, your assets
Everything is built in your cloud account. If we vanished tomorrow, you would keep every script, pipeline and server.
The same engineers build and maintain the 48 production images in the catalog. Every one lists its software and security posture before you launch.
02Self-serve
Scripts, templates and pipelines you run yourself.
For engineers who want the exact scripts our images ship with, without booking anyone.
The first-boot, hardening and health-check scripts behind any catalog image, packaged to run on your own instance.
- Install and configure script for the image you pick
- First-boot credential generation, the same model the AMI uses
- Nginx reverse proxy and TLS setup script
$19one-time
Instant download
CI/CD pipeline templates
Most popularReady-to-use GitHub Actions and GitLab CI pipelines that build, test and deploy to EC2, ECS or a plain VM.
- GitHub Actions and GitLab CI variants of each pipeline
- Build, test, container push to ECR, deploy to EC2 over SSM or to ECS
- OIDC role assumption so no long-lived AWS keys sit in CI
$29one-time
Instant download
A Terraform module per catalog image: instance, security group, EBS, Elastic IP and DNS, with sensible defaults.
- One module per image, pinned to the current image ID
- Security group with only the ports the image needs
- Encrypted EBS, IMDSv2 enforced, termination protection on
$29one-time
Instant download
Every script, pipeline template and Terraform module we sell, for every image, with a year of updates.
- Deployment scripts for every catalog image
- All CI/CD pipeline templates
- All Terraform launch modules
$99one-time
Instant download
03Done-for-you
Fixed scope, fixed price, delivered in days.
For teams that want it deployed, migrated, hardened or reviewed by the engineers who build the images.
Deploy any catalog image
Most popularWe launch the image in your AWS or Azure account with your domain, TLS, backups and monitoring, then hand over a runbook.
- Launch in your account, in the region and instance size you choose
- Your domain on HTTPS with automatic certificate renewal
- Security group locked to the ports the app needs
$149$299one-time
Founding-customer rate
3 business days
Move a Bitnami WordPress, Jenkins, Redis, Moodle or other server to the matching ProvenCloud image, with no data loss.
- Inventory of the existing Bitnami instance: versions, data, config and cron
- New instance from the matching ProvenCloud image, in your account
- Data and configuration migrated and verified against the original
$299$499one-time
Founding-customer rate
5 business days
A working build, test and deploy pipeline for your app on GitHub Actions, GitLab CI or Jenkins, deploying to EC2, ECS or EKS.
- Pipeline in your repository on the CI system you already use
- Build and test stage with caching, container build and push to ECR
- Deploy to EC2, ECS Fargate or EKS with zero-downtime rollout
$499$799one-time
Founding-customer rate
5 business days
One server or one small account, brought up to a written baseline: IAM, network, patching, backups, logging and alerts.
- IAM: root MFA, no long-lived keys, least-privilege roles
- Network: security groups reduced to what is used, no public databases
- Host: unattended security updates, SSH hardening, fail2ban, firewall
$599$999one-time
Founding-customer rate
5 business days
A scored review of one AWS account across security, reliability and cost, with a prioritised fix list you can act on.
- Security: IAM, exposed services, encryption, logging, GuardDuty findings
- Reliability: single points of failure, backups, multi-AZ, alarms
- Cost: rightsizing, idle resources, storage tiers, Savings Plans, data transfer
$899$1,499one-time
Founding-customer rate
7 business days
04Custom and ongoing
Bespoke deployments, retainers and yearly contracts.
For companies that need a named engineer, an SLA, or infrastructure that does not fit a package.
Multi-service stacks, private networking, Kubernetes, landing zones, compliance requirements. Anything a package does not fit.
- Architecture proposal with a diagram and a cost estimate before any work
- Infrastructure as code from day one
- Multi-account, multi-region or hybrid setups
Custom quote
Scoped together, usually 2 to 6 weeks
Fractional DevOps engineer
Most popularA named engineer for a fixed number of hours each month, with a shared channel and a two-business-hour response during your working day.
- 20 hours per month at the starting tier, more available
- Shared Slack or Teams channel with a named engineer
- Infrastructure changes, pipeline work, upgrades and reviews
from $1,500per month
Starts within one week
Monitoring, patching, backups and incident response for your production servers under a written SLA, on a yearly contract.
- 24/7 monitoring with an on-call rotation
- Security patching on a published cadence
- Backups verified by scheduled restore tests
Custom quote
Onboarding in two weeks
Your application, your hardening baseline, delivered as a private AMI or Azure image with a rebuild pipeline you own.
- Same clean-room build process as the public catalog
- Your packages, configuration and compliance controls baked in
- Rebuild pipeline so you can cut new versions without us
Custom quote
Scoped together, usually 1 to 3 weeks
05How an engagement runs
Scoped, delivered, then paid.
The order is deliberate. A company you have not worked with before should not be asking for money first.
Pick a package
Every package states its scope, what you get, what we need from you and the price. If it does not fit, the scoping call is free.
Grant scoped access
We send the exact IAM policy or Azure role. You create it, you can revoke it, and it never includes root.
We deliver, you verify
The work lands in your account with a runbook. You check it against the scope before anything is final.
Pay when it works
On your first done-for-you package the invoice follows delivery. After that, checkout is upfront with a 30-day guarantee.
Free to start
Not sure what you need? Start with a free AWS health check.
Ten automated checks on one account, read-only, delivered as a short written summary. No sales call attached. If it finds nothing, that is the answer.