What it costs to work with us, and why.
Engagement models, a frank comparison against the US market, the compliance frameworks we ship against, and a short note on why “I’ll just use Cursor for $20” is not a production strategy.
Four engagement models.
Every engagement starts with a two-week fixed-fee discovery. After that we agree the model that matches the risk, the unknowns, and your team’s appetite for managed scope.
For sharp, well-scoped work
Hourly
Architecture reviews, incident response, a specific technical question answered in writing, code audits. When the scope is small enough to name a number, this is the cheapest model for you.
- Weekly hour cap, no rollover
- Written, time-stamped changelog
- Async-first over Slack, Linear or email
- Cancel any week with 48 hours’ notice
The default for new builds
Fixed-fee milestones
Discovery, then a scoped SOW, then milestones with explicit acceptance criteria. You know the price before we write the first line. If scope changes, the contract changes — in writing, in advance.
- Written acceptance criteria per milestone
- Demo at the end of every milestone
- Source handed over milestone by milestone
- Runbooks delivered with the final payment
For an ongoing senior embed
Monthly retainer
A named senior engineer, or two, embedded in your team for an agreed number of hours a month. Code review, architecture office hours, on-call rotation, hiring loops.
- 20, 40 or 80 hours per month
- A named engineer, not a rotation
- Quarterly SOW refresh
- Optional fractional CTO add-on
For end-to-end delivery
Project SOW
You own the outcome. We own the build, the tests, the deploy, the runbooks and the 90-day on-call window. Fixed price, fixed date, fixed scope, with written change control for anything new.
- Deliverables, dates and acceptance in writing
- Change control for any scope change, either party
- 90-day on-call window after handover
- Optional managed operations afterwards
How our rates compare
The US column is the public rate band for senior consultants at Big-4 and US boutique firms (Toptal, Arc, A.Team, and the AWS, GCP and Azure partner directories, mid-2026). Ideaxa is India-based with USD billing.
| Discipline | US market / hr | Ideaxa / hr | What’s included |
|---|---|---|---|
| Senior Cloud & Solutions Architect | $250 – $400 | $100 – $120 | Multi-region Terraform, zero-trust, audit-ready evidence, on-call runbooks. |
| Senior AI / ML Engineer | $200 – $350 | $80 – $100 | RAG, evals and cost controls. Production agents with typed tool definitions and trace logging. |
| Senior IIoT / OT Specialist | $200 – $325 | $70 – $100 | OPC-UA, Modbus and S7, UNS topology, time-series storage, ISA/IEC 62443-aligned. |
| Senior Full-Stack Engineer | $150 – $250 | $60 – $80 | Next.js, Python and Go, typed APIs, auth, payments, dashboards, CI, observability. |
Why we cost more than the cheap market
Because we don’t ship a quick fix and walk away. We ship systems that survive their first compliance audit, their first on-call rotation, and their first paying customer.
- 12+ years in production
- Our principal engineer has been on the other end of a 3am page for a global SaaS, an IIoT plant and a healthtech pilot. You are not paying a graduate to learn on your stack.
- Compliance from day one
- SOC2 controls, GDPR data flow, HIPAA boundaries, FedRAMP baseline. We do not retrofit these in a panic two weeks before a pilot.
- Audit-ready, not just working
- Every IaC module, change log and access-review ticket collected in a format your auditor can read.
- Robustness over speed
- We will not ship it Friday and let you find the failure mode on Sunday. If a deadline is impossible without cutting corners, we say so before the demo.
- Three hats: sales, customer, engineering
- We have sat on all three sides of the table. We know which promises you can keep and how to write a contract that does not blow up on you.
- A team, not a contractor
- If your main engineer is sick on launch week you still get the project. Every engagement has a backup engineer and a written escalation path.
“Can’t I just build it myself with AI?”
Yes. For $20 a month you can have an AI assistant write you 4,000 lines of TypeScript that look like a product. It will pass a code review by another AI. It will demo well.
It will not pass your enterprise customer’s security questionnaire, your first SOC2 audit, your first HIPAA risk assessment, your first real production incident, or the contract renewal where the customer asks who built this and what happens when it breaks.
AI coding tools are excellent. We use them, we pay for them, and they make us 30 to 50% faster on routine work. They are not a substitute for a team that knows which patterns break at scale and which controls your auditor will actually ask about.
If our rates feel high, that is a fair signal — maybe you don’t need us yet. Come back when the pilot customer is asking for SOC2 and the pager is asking for a runbook.
Compliance frameworks we ship against
Compliance is not a checkbox at the end of a project. It is a constraint set in the first commit, so the audit becomes a paperwork exercise rather than a fire drill.
- SOC 2 Type II
- Trust services criteria across security, availability, confidentiality, processing integrity and privacy. Evidence collection in Drata or Vanta-compatible format.
- GDPR
- Data flow diagrams, DPIA, ROPA, Article 30 records, sub-processor management, breach notification playbooks.
- HIPAA
- Technical, administrative and physical safeguards. PHI data flow, BAAs, access controls, audit logging.
- ISO 27001 / 27017 / 27018
- ISMS design, statement of applicability, risk treatment plan, control ownership. Cloud and PII-specific extensions.
- FedRAMP (Moderate)
- NIST 800-53 control mapping, continuous monitoring artifacts, OSCAL where applicable. US public sector and regulated supply chains.
- NIST CSF 2.0
- Identify, protect, detect, respond, recover, govern. General cyber risk posture regardless of formal certification.
- DPDP Act (India, 2023)
- Data principal rights, consent management, breach notification, data fiduciary obligations. Required for any product serving Indian users.
- PCI-DSS v4.0
- Where card data is in scope. Network segmentation, encryption, access control, quarterly scans. SAQ-D for full merchant environments.
- ISA / IEC 62443
- Industrial automation and control systems. Zones and conduits, security levels, SL-T and SL-A targets. Required for IIoT and OT.
- NIST 800-171 (CMMC L2/L3)
- Controlled unclassified information for defense supply chains. 110 control families, SSP and POA&M delivery.
- EU AI Act
- Risk-based AI obligations. High-risk system requirements, transparency duties, conformity assessments, post-market monitoring.
- SEBI / RBI (India fintech)
- Outsourcing guidelines, digital lending norms, cyber security framework. For fintech serving Indian customers.
If your customer or auditor is asking for a framework not listed here, ask us. If it touches data, infrastructure, AI or industrial systems, we have almost certainly worked on it.
Questions we get asked
Why are your rates higher than a freelancer on Upwork?
Because we deliver production-grade, compliance-ready work — SOC2, GDPR and HIPAA controls baked in, audit-ready evidence, runbooks, on-call handover, and 12+ years of having been on the wrong end of a 3am production incident. A freelancer will write you the same code. They will not be on the call when your auditor asks for an evidence trail.
Can I just use Cursor or Claude Code and build this myself?
Yes, and we use those tools too — they make us 30 to 50% faster on routine work. The question is not whether AI can write code. It is whether the result survives its first enterprise pilot, its first compliance audit, and its first production incident. That second half is what you are paying us for.
Do you offer fixed-fee engagements?
Yes. Every engagement starts with a two-week fixed-fee discovery. After that we propose either fixed-fee milestones or a monthly retainer, both with explicit acceptance criteria and a written changelog.
Do you work on equity or deferred payment?
For pre-seed startups building a regulated product, sometimes. We can mix a reduced cash rate with a small equity grant as part of the engagement. Case by case.
What is the difference between a fractional CTO and a senior retainer?
A fractional CTO is ongoing strategic ownership — hiring, board narrative, architecture decisions — at four to eight hours a week. A senior retainer is a named engineer or two embedded in your team for 20 to 80 hours a month, writing and reviewing code.
Ready for a 30-minute scoping call?
No deck, no pitch. We read your repo, your dashboard, or your architecture diagram and tell you what we think — including the parts where the answer is “you don’t need us yet”.