Every engagement starts with a free 30-minute call. Then a fixed-price diagnosis, then the fix, then, if you want it, a monthly check that it stays fixed.
IT and security: no AI required
Most small offices don't need an AI strategy first. They need the computers to behave, the backups to actually restore, and the paperwork the law already requires.
| Service | Price | Then |
|---|---|---|
| IT engineering & supportMicrosoft 365, Windows and Windows Server, Citrix and remote desktop, networks, backups, migrations. The IT help you would have on staff if you were bigger, or the weekend cutover your IT company can't staff. | $165/hr 2-hour minimum |
Same-day or after-hours: $275/hr, 3-hour minimum, agreed in writing first. Advisory: $225/hr |
| Security & HIPAA risk analysisFor medical and dental practices. The written security risk analysis HIPAA requires: asset and patient-data inventory, a risk register, a Microsoft 365 and MFA review, a tested backup restore, and a check of every AI tool your staff use (scribes, ChatGPT, phone bots) and whether each has a signed BAA. Two weeks, read-only access, a 45-minute readout. | $1,800 up to 15 staff $2,800 16–30 staff |
50% credited toward fixing what it finds, if booked within 30 days |
| Safeguards package for accounting & tax firmsThe written information security program the FTC Safeguards Rule requires, a risk assessment, MFA and encryption checks, an AI-use policy with an approved-tool list, and a 30-minute staff briefing. Done before tax season, not during it. | $1,500 up to 10 staff $2,400 11–25 staff |
Optional $450/mo: quarterly control checks, the annual report, new-tool reviews |
| Security & infrastructure assessmentFor any small office. A read-only review of your network, accounts and backups, scored and written in plain English. It only looks; it never changes anything. | $1,200 up to 15 devices, one site |
Leads into a fix, or into monthly oversight |
| Platform migrationOff an old WordPress site or a shared host, onto something that can't be hacked the same way: site, DNS and email moved without losing mail. | $2,500–4,500 | Fixed quote after the free call |
| Incident responseSomething already went wrong: a hacked site, a suspicious login, a ransomware note. We contain it, find out what happened, and write it down. | $2,500 engagement fee |
Then $275/hr |
AI, done safely
AI assistants can now do real work in your business: Copilot, ChatGPT, Gemini, Claude, Grok. The tool is cheap. Setting it up so it can't leak your files, and checking on it afterwards, is the part nobody sells you. We support whichever assistant fits your data. You buy the licence directly, and we never mark it up.
| Service | Price | Then |
|---|---|---|
| Safe AI rolloutNEWTurn on Copilot, ChatGPT or Gemini without handing it the whole file share. We pick the right assistant and plan for your data, fix oversharing first, set the admin and data-retention settings, write a one-page AI-use policy, and train your staff for an hour. | $1,500 up to 10 seats $2,500 11–30 seats |
Licences billed to you by the vendor, at cost |
| Agent production readiness reviewYou built an AI agent, or a vendor built one for you. We check what breaks when it goes live: its permissions, where your data goes, what it does when it's unsure, the logging, and how you roll it back. | $1,800 fixed |
Leads into a fix, or into supervision |
| One workflow, built safelyOne job you're sick of doing, automated, with a person approving anything that leaves the building. Built on whichever model fits the data, never on a personal account. | from $2,500 one workflow from $6,000 a full production agent |
For oversight clients; scoped in writing first |
| AI receptionistAnswers your phone 24/7, screens spam, and passes real callers to you. Call 800-422-2082 to hear ours. For healthcare we only use voice platforms that will sign a BAA. | Quoted | An add-on to oversight, not sold on its own |
Monthly: keep it fixed
| Service | Price | Terms |
|---|---|---|
| IT & AI oversightSomeone checks every month that the controls are still on: MFA, patches, backups, admin accounts, and any new AI tool your staff started using. A quarterly risk-register update keeps your HIPAA analysis current. Four engineering hours included. We work with your existing IT company, as the escalation point they don't have. | from $950/mo up to 15 staff $1,600/mo 16–30 staff |
3-month minimum, then month to month. Extra hours $165. Reply within one business day. Not a 24/7 help desk. |
| Agent supervision add-onNEWYour AI assistant has keys to your email and files. Once a month we review what it can reach, sample what it did, and keep a register of which AI companies have seen your data. Works for Copilot agents, Grok Bot, ChatGPT and Claude alike. | +$300/mo up to 3 agents |
Oversight clients only |
| vCIO advisoryA senior IT voice at the table: budgets, vendors, renewals, and the questions your insurer asks. | $1,000/mo | Month to month |
How we work
Fixed prices, published
The numbers on this page are the numbers. Where a job can't be fixed-price, you get a written quote before any work starts.
You keep your IT company
We work alongside them. An IT provider can't credibly audit its own work; we can, and we hand them the findings.
Read-only first
Every assessment looks and never changes anything. Nothing is touched until you've seen the findings and agreed the fix.
AI drafts, a person approves
Nothing an AI writes leaves your business without a human signing off. Our own permission rules are public at github.com/gershom-lewis/agent-guardrails.
Patient data stays protected
We sign your BAA before touching any system with patient data, and no patient data leaves your tenant.
Clear payment terms
50% to start, 50% on delivery. Monthly services billed automatically, cancellable with 30 days' notice after the minimum.
What we don't do
Home computers and personal laptops, password resets and printer support, 24/7 help-desk coverage, and reselling AI licences. A local repair shop or a staffed IT provider is the right call for those, and we'll happily tell you so.
Does any of this sound familiar?
“When did somebody last restore a backup to check it worked?”
If nobody can answer, that's the first thing we test. A backup you haven't restored is a guess.
“My staff are using AI tools and I don't know what they've put into them.”
They probably are, and it isn't carelessness — nobody gave them an approved option. We give you the
one-page policy that works: the sanctioned tool, the green-light / red-light list, who to ask, and what
gets logged. Banning it just moves it to a phone you can't see.
“Our AI scribe or phone bot — did anyone check it signed a BAA?”
Practices adopt AI tools faster than anyone reads the contracts. We list every tool, check each one's
BAA and data retention, and tell you which to keep, fix or switch off.
“I've got AI running somewhere and no idea if it still works.”
Silent failure is the real risk in automation — you built it so nobody has to watch it, which means
nobody notices when it stops. We monitor what you have running and tell you. Unknown is never reported as healthy.
“I want to use AI but our data can't leave the building.”
Then it doesn't have to. There are several real deployment options and only one of them is a public chatbot.
Medical practices, law firms and anyone holding client records have more choices than they've been told.
“Someone in my office types the same thing into two systems.”
That's the cheapest thing to fix and the most reliable source of errors you have. Often it isn't even an
AI problem — two systems just need introducing. We'll tell you honestly which it is.
Who we work with
Medical and dental practices, accounting and tax firms, property managers, and small offices of 5–30 people in Newark and Essex, Morris and Bergen counties, with remote work anywhere. Run by Gershom Lewis: thirty years of enterprise IT across hospitals, law firms and a sixty-branch library system.