Fixed fees and published scope, before you sign.

Many landing zone designs deploy Azure Firewall and Azure Bastion on day one. Both are billed by the hour, even before any virtual machines or databases run. Tier 1 deploys only control-plane constructs: management groups, the subscription hierarchy, Entra ID role assignments, tagging policies, and Cost Management budget alerts. Azure does not charge for these. You start paying Azure when you launch compute and data workloads.

• Tier 1, Cloud Governance Foundation, if you are starting clean on Azure or need subscription isolation between teams, without paying for network firewalls you do not use yet.
• Tier 2, Compliance Guardrail Pack, if customers are asking for a SOC 2, ISO 27001, PCI-DSS, HIPAA, or NIST report, or your board wants policy guardrails before launch.
• Tier 3, Platform Transit Hub, if you are connecting an on-premises datacenter over ExpressRoute or VPN, need central egress filtering, or are migrating production workloads that need network isolation.

Yes. Together they are $36,000, the sum of the two fixed fees. You get the hierarchy and subscription vending of Tier 1 with your framework's policies enforced from the start, and your Azure idle cost stays at $0 a month until workloads are deployed.

Yes. Tier 1 and Tier 2 establish the management group hierarchy and subscription vending that Tier 3 builds on, so the transit hub is added later without restructuring your hierarchy or subscriptions.

Time-and-materials billing leaves the final cost open: discovery, rework, and scope changes all add hours. We work from pre-built blueprints, so each tier has a defined scope, a fixed price, and a delivery window of 5 to 15 business days, with the deliverables listed in the statement of work.

• An architecture design document covering the landing zone topology
• High-level and low-level diagrams of subnets, route tables, and the resource hierarchy
• Architecture decision records explaining each trade-off, such as Virtual WAN versus hub-and-spoke
• A RACI matrix and runbooks for subscription vending, policy exceptions, and incident escalation
• In Tier 2 and Tier 3, a control traceability matrix mapping each Azure Policy to the framework clause it enforces

One of SOC 2 Type II, ISO/IEC 27001:2022, PCI-DSS v4.0, HIPAA / HITRUST, or NIST SP 800-53 Rev. 5. If you need two at once, for example SOC 2 and ISO 27001, an additional framework can be added as a modular add-on.

Two things: an Azure tenant with Global Administrator or Management Group Contributor rights granted to our deployment identity for the delivery window, and an empty repository in GitHub, Azure DevOps, or GitLab. No existing infrastructure is needed. If you are starting from a new tenant, we build everything from the root down. Tier-specific prerequisites are listed above.

No. There are no retainers, subscriptions, or platform fees. You pay the fixed fee once, and the code and documentation are committed to your repository, with no closed-source components. Azure bills you directly for what runs in your tenant; for Tier 3 that is about $1,400–1,800 a month at idle.

You do. Intellectual property is assigned to your organisation once the fee is paid, under our Master Services Agreement. Every module, pipeline definition, and diagram lives in your repositories.

Every tier ends with a workshop with your technical leads: we walk through the repository, run subscription vending live, rehearse a policy exception, and review the runbooks. Tier 1 is a half-day workshop. Tier 2 is a half-day workshop, including a walkthrough of the evidence pack for your auditor. Tier 3 is a full-day workshop and 14 days of post-handoff support.

Email hello@vitcamp.com with your chosen tier, legal entity name, and preferred start date. We reply with our mutual NDA, Master Services Agreement, and statement of work. Once they are countersigned, delivery begins on the agreed start date.