Some California companies are not the ones sending security questions, they are the ones answering them. Agencies, accounting and professional services firms, SaaS vendors, and contractors whose enterprise customers send a security questionnaire or a vendor audit before signing a contract need an IT provider that can back up what is on that form, not just keep the lights on. Ghosxt runs managed IT and cybersecurity built around that reality: SOC 2 documentation for every platform in our stack provided during onboarding, a written policy suite (a WISP, an incident response plan, a business continuity and disaster recovery plan, an access control and acceptable use policy, a retention and destruction policy, and an AI acceptable use policy), an annual independent risk assessment arranged through a third-party assessor, and a 4-hour notification commitment on any actual or reasonably suspected critical incident. Pricing is published upfront, and you talk directly to the owner, not a support queue.
Transparent managed IT pricing is published upfront, so you know the range before booking.
A customer's security questionnaire or vendor audit is usually asking about the same handful of things: who has access, how it is monitored, how it is backed up, what happens during an incident, and what is written down. This is the actual paperwork and controls behind those questions.
SOC 2 documentation for every platform in our stack, provided as part of onboarding, the subprocessor-level evidence a customer's security team typically wants to see about the systems we manage for you.
Learn moreA written policy suite: a WISP, an incident response plan, a business continuity and disaster recovery (BC/DR) plan, an access control and acceptable use policy, a retention and destruction policy, and an AI acceptable use policy, the documents a customer's audit or questionnaire is actually looking for.
Learn moreAn annual independent risk assessment, arranged through a third-party assessor rather than graded by us, so the review your customers see is not just our own opinion of our own work.
Learn moreA 4-hour notification commitment on any actual or reasonably suspected critical incident, the response-time line a customer's contract or questionnaire is usually asking about.
Learn moreWhen a customer's security questionnaire lands in your inbox, we help answer the technical sections about the controls we run for you.
Learn moreIf your customer's Data Processing Agreement flows security obligations down to your vendors, we support the technical side of that flowdown for the systems we manage.
Learn moreCyber liability insurance in force, $1M per occurrence and aggregate, plus general and professional liability, the kind of coverage line a vendor questionnaire usually asks a provider to confirm.
Learn moreGhosxt is registered in SAM.gov, and the owner holds an active DoD clearance and has prior DoD and federal contractor infrastructure experience. We do not publish the clearance level.
Learn moreThe paperwork itself is usually the easy part once the underlying controls exist; the hard part is answering it accurately and fast enough that it does not stall the deal.
Forward us the questionnaire or the audit request when it lands. We work through the technical sections together, identity and access, patching and monitoring, backup and incident response, using the controls we already run for you and the SOC 2 documentation for the platforms in our stack.
If the questionnaire or the underlying contract asks for a Data Processing Agreement that flows security obligations down to us as your IT provider, we complete the vendor side of that paperwork. The legal review of your own DPA language stays with you and your counsel; we support the technical controls and documentation, we do not provide the legal review.
Some questions on a customer's questionnaire are about your business specifically, such as data classification, staff training records, or your own policy acknowledgments, rather than about the IT stack; those stay yours to answer, and the written policy suite and risk-assessment documentation we provide are meant to support those answers.
Pricing is published upfront on our pricing page: Tiny Team is a flat $600 per month for 1 to 4 users. Core Managed IT is $125 per user per month, Secure Growth is $175, and Compliance & Continuity is $250. Onboarding is a one-time fee: $1,000 flat for a Tiny Team (1 to 4 users) or $1,500 for 5 to 15 users on the Microsoft 365 default scope; Google Workspace and Apple fleet onboarding is scoped and quoted separately. SOC 2 documentation for every platform in our stack, the written policy suite, and the annual independent risk assessment are contracted deliverables of working with us, not a separate line item.
This page is written for a specific shape of California business.
We are based in Salinas and work with businesses across California's Central Coast and the Bay Area, including San Jose, Santa Cruz, Monterey, Carmel, and Pacific Grove. Companies whose customers are outside California are supported the same way; the vendor documentation and controls on this page do not change based on where your customer is located.
30 minutes with an engineer with DoD infrastructure experience. Walk away with a clear picture of where your identity, device, backup, and documentation posture stand against what a customer's security questionnaire actually asks, plus a written punch list of what to fix first. No sales script, no obligation.
Book your free assessment