Service Descriptions.
Unique offerings to fit your specific needs. What each service does, what it includes, and where it stops; your agreement lists the services you hold and the systems they cover.
Discovery Project.
A fixed fee project covering up to 15 hours of engineer time to see your environment and understand your goals, and the fee does not change if it takes us longer.
Before we quote proactive management or NOC coverage, we need to see the environment and understand your goals. The better our view of your systems and how they connect, the more accurately we can budget for getting you where you want to be.
What we do. An engineer is assigned to you and:
- Reviews the current situation: inventories the systems and documents the basics (kernel version, patch level, primary application).
- Goes over your IT business goals, and walks you through how budgeting works for our agreements.
- Performs an initial review of the infrastructure: servers, network, software.
- Architects an initial IT roadmap and timeline for moving forward.
- Sets out clear options on which technologies to use to reach your business goals.
- Delivers a report of our findings and a documentation space you keep, whatever you decide next.
What it is for. Discovery produces the picture everything else is quoted from: which servers belong under proactive management, what a cluster or cloud environment involves, and whether 24/7 coverage makes sense for you. Your specific objectives for the engagement are agreed with you in writing before it starts.
Proactive Managed Services.
Ongoing, scheduled care of your Linux servers: monitoring, patching, backups, hands-on health checks, managed configuration and regular reviews, for a monthly fee covering the servers listed in your agreement. Everything not listed here as proactive is reactive work drawn from your Reactive Flextime hours.
Server, application and network monitoring
Know what your servers are doing before your customers do. For every covered server we continuously collect and alert on the system metrics: CPU, memory, disk pressure, network connectivity and backup status. On top of that we watch what the server is for: individual application services, database internals, network performance and the scheduled jobs that keep your servers and applications healthy. The failure of those behind-the-scenes automations often goes unnoticed until it affects a critical process in your business, so we watch them to make sure they are doing their job. Which applications, databases and jobs we watch is worked out with you during onboarding.
All of it runs on CraftyStack, our own monitoring and automation platform, dedicated to you, which we build and maintain so you do not have to. Every alert it raises on a covered server is reviewed by one of our engineers, who assesses the severity and decides what to do; that triage never consumes your reactive hours. Your contacts get read-only access to the dashboards for your servers.
Patching
Frequent patching is one of the fundamentals of keeping your Linux servers secure and your clients' data where it belongs. We apply regular package updates from the upstream distribution repositories, on our standard patching cadence and inside your maintenance windows.
File-level backups
Rest easy knowing your files are backed up incrementally every day. No need to panic when something goes sideways, goes missing, gets corrupted, or gets deleted by accident. 200 GB of backup storage for file and database backups is included per covered server, with up to 90 days of retention.
Database backups
When you need to roll back the database or find something that was deleted a few weeks ago, you will hear: "we have it in the daily backups!" Daily backups run through database dump utilities for the supported database engines on your covered servers.
Engineer health checks
Automated monitoring catches a great deal, but not everything. Every quarter our engineers do a manual, hands-on-keyboard review of each covered server to find the issues that are hard for robots to detect. This surfaces design issues, capacity limits and human error before they affect your servers and your customers.
Managed server configurations
Traditionally, Linux servers are managed with unique configuration files and custom scripts built up over many years by many different smart engineers. That leaves your servers hard to rebuild, duplicate or fix. We call them snowflakes, because each one is unique. Instead, the configuration we manage on your covered servers is held in our configuration management tooling, so it is documented, consistent and can be reapplied. That makes it easy to add servers and lets a whole team support your servers rather than the one person who wrote the scripts. Which configuration goes under management is agreed with you during onboarding and can be extended at any time.
Business technology reviews
Periodic reviews with a technology advisor who knows your servers: the health of your infrastructure, your feedback on our service, our best-practice recommendations, and the roadmap ahead. Held at a frequency that suits the complexity of your business and how much is changing.
Regular IT meetings
Scrum-style check-ins at a cadence we set together: review the work recently completed, work out how we can both be more effective, and agree the commitments until the next meeting. A quick sync when things are quiet, a longer session when more is going on.
Reporting
Keep a pulse on your server health and the results of the proactive work with a monthly report covering server health, patching status, backup results and the management activities performed. Anything critical does not wait for the report; critical findings are escalated as soon as we find them.
Not included
Proactive Managed Services is the list above. In particular it does not include:
- Security coverage. Host-based SIEM, XDR or EDR agents, vulnerability scanning, penetration testing, firewall audits and access auditing are included in the High Security Add-on.
- Restoring a failed service or server. Whether our monitoring detected the failure or you reported it, getting it back is reactive work drawn from your Reactive Flextime hours.
- Servers not in your agreement. Your agreement lists the servers we cover. A host that is not listed there is not monitored, patched or backed up; we reach it only when you ask, as reactive work. Where it helps, the agreement can also name such hosts as not covered, so there is no ambiguity about what we are watching.
Engineering work for any of these is available from your Reactive Flextime hours or under a Statement of Work.
Layered coverage, when you need it.
Each add-on sits on top of Proactive Managed Services as its own line in your agreement, covering the servers or systems your agreement lists for it.
24/7 NOC Add-on
Are your servers critical to your mission? We will jump on any critical issue within the hour. Even at 3 in the morning.
An engineer on call, around the clock. An engineer is on call every hour of every day to respond to critical issues on your systems, with a one-hour initial response commitment written into your agreement and a service credit behind it.
Two ways in. Automatic: when a critical alert fires on a server or cluster your agreement lists for automatic dispatch, our systems dispatch to the on-call engineer without anyone at your end lifting a finger. Manual: your authorized contacts can activate the NOC at any hour by calling the 24/7 NOC line at 1-403-399-0790, where our answering service verifies the caller and dispatches to the on-call engineer, or through the dedicated request form in the client portal, which dispatches immediately. A message in a shared channel or an email is not an activation; it is picked up in the next business hours.
What counts as critical. A specific, measurable event our monitoring picks up automatically, such as a server unreachable, a service failure, a disk full, a hardware error or an out-of-memory condition; or a high-severity, service-impacting issue one of your authorized contacts reports for investigation.
What it unlocks. Holding NOC is what makes emergency work available to you: unscheduled work at night, on weekends and on holidays. Without it, a request that arrives outside business hours waits for the next business day.
Billing follows the clock. The initial response and triage are covered by the add-on. Engineering time to investigate and resolve the issue beyond that is reactive work drawn from your Reactive Flextime hours, at the band that applies to when the work is done: an activation during business hours is billed at the business-hours rate.
Where it stops. Automatic dispatch applies only to the servers and clusters your agreement lists for it; anything else raises alerts for review in business hours, and you can still activate the NOC manually for it. The NOC responds to availability and operational incidents; it is not a security operations centre.
Without proactive management. NOC can also be held on its own beside Reactive Flextime. We monitor nothing in that arrangement, so activations are manual and limited to a critical service failure: something you rely on is down or materially degraded and cannot wait for business hours. We offer it on that footing only after a Discovery Project, in which our team has assessed what responding to your systems would involve.
High Security Add-on
For companies with higher compliance and cybersecurity needs. The security layer on the servers you choose, with Managed Detection and Response included.
Everything in Proactive Managed Services continues to apply to the covered servers; the High Security Add-on adds the security layer on the servers you choose, whether that is every server or only the ones that face the compliance questions.
Host-based SIEM and XDR coverage. We deploy, configure and manage a host-based Security Information and Event Management (SIEM) and Extended Detection and Response (XDR) agent on your covered Linux servers. That gets you security event log aggregation, correlation rules, file integrity monitoring, rootkit and anomaly detection, host-based intrusion detection and configuration assessment, all in one place. Telemetry is collected to infrastructure we operate, for retention and analyst review, so there is history to look at when you need it.
CVE vulnerability scanning. Your installed packages and software components are automatically scanned against the CVE (Common Vulnerabilities and Exposures) database every six hours. New vulnerabilities are published every day, so cadence matters. What we find is triaged by our team and compiled into your monthly security report, and critical findings are escalated as soon as we find them rather than sitting in a queue.
Security penetration testing. Even if you hire a company to do a manual penetration test annually and remediate quickly, you can be exposed for up to a year in between. With automated and periodic manual testing we detect vulnerabilities, misconfigurations and human error on your covered servers much sooner.
Firewall audits. Your firewall is your first line of defence against the ever-present threat from the internet, and the rules you created need reviewing against what you actually run today. An engineer periodically reviews your firewall and load balancer rules and policies by hand, to make sure they are documented and designed with least privilege in mind.
Access and authorization auditing. Linux permissions, root accounts, sudo access and SSH keys can get out of control. We monitor and audit them on your covered servers, looking for the stray account that does not belong and the account holding more access than it needs.
Security reporting. Your monthly report gains an extended section for the security-specific metrics and the CVE scanning results, alongside your standard health metrics. Critical findings are escalated outside the monthly cycle.
MDR Add-on, included. The MDR Add-on is part of the High Security Add-on at no separate line: a third-party Security Operations Center watching your covered Linux servers around the clock, with threat hunting, real-time interception and containment when it matters. What it does, and where our part ends, is described under its own heading below.
Optional host-based antivirus scanning. Antivirus scanning is available on your covered Linux servers and can be turned on or off per server on written request at no change to your monthly fee. Worth knowing before you do: real-time, on-access file scanning can add significant input/output and CPU overhead, particularly on database servers, file servers, build hosts and busy application servers. Where you enable it, we set the scanning mode, scanning windows and exclusion paths with you to balance coverage against measurable performance impact.
Where the coverage ends. Our security coverage gives you detection and alerting for anomalous access patterns, known vulnerability signatures and host-based security events on your covered servers. The edges, plainly:
- Covered Linux servers only. It does not extend to Windows endpoints and servers, end-user workstations, network devices (firewalls, switches, load balancers, routers), identity providers and directory services, third-party Software as a Service platforms, cloud-native services, or anything else not listed as a covered server in your agreement. Your applications, endpoints, identities and permissions outside that list stay your responsibility.
- No configuration drift or compliance posture detection. Real-time security drift detection, configuration compliance monitoring and compliance-framework-specific posture assessment are not part of it.
- Compliance support, not a compliance guarantee. The monitoring and reporting support your compliance posture; they do not warrant compliance with any law, regulation or industry standard, and preparing compliance reports, audit responses or certification documentation is separate work.
- Penetration testing covers your covered servers and the network boundaries directly associated with them. Testing your applications, third-party integrations or end-user devices needs a separate Statement of Work.
- Enterprise SIEM platform builds are their own project. Designing, deploying, tuning and operating a dedicated enterprise SIEM platform that ingests from log sources beyond your covered Linux servers is scoped separately.
MDR Add-on
Included with the High Security Add-on. A Security Operations Center watching your covered Linux servers around the clock, so that detection turns into response at any hour.
What it is. We procure, integrate and co-manage a third-party Managed Detection and Response (MDR) service on your covered Linux servers. The service is operated by the provider's own Security Operations Center (SOC) and gives you 24/7 threat hunting, real-time threat interception and provider-initiated incident containment.
The subscription is on us to manage. We procure, supply and maintain the MDR subscription on your behalf. We are the licensee of record and we handle renewal, billing and the vendor relationship, so you are not managing another supplier.
Integration and co-management. We deploy, configure and co-manage the MDR coverage on your covered Linux servers; the detection and response itself is delivered by the provider's SOC under the provider's terms.
Console liaison. We hold the provider console access on your behalf and do first-line review of MDR alerts. If you want to look yourself, we coordinate read-only access with the provider. Where the provider contains a threat, we tell you what we learn of it through the console.
In your reporting. An MDR coverage summary is included in your monthly security report.
Where our part ends. Our responsibilities are subscription supply, deployment, integration and co-management on the covered Linux servers. The detection and response service is the provider's, under the provider's terms, and we do not answer for its performance, availability or detection efficacy. Coverage is the Linux servers listed in your agreement; Windows endpoints, workstations, network devices, identity providers, SaaS platforms and cloud-native services are outside it.
Getting started. We procure the subscription, provision the provider tenant, deploy the agent and integrate it with the provider console during onboarding.
Windows Custom Tooling Add-on
For environments where Windows servers live alongside the Linux estate we manage.
Custom by nature. Crafty Penguins is primarily a Linux engineering practice, so where your agreement covers Windows servers, we build the tooling for them: collectors, exporters and alert configurations on CraftyStack, built for your environment during onboarding and maintained after.
What we watch. For each covered Windows server: system metrics (CPU, memory, disk pressure, network connectivity, and backup status where a backup is in place), the Windows event logs we collect, and the application metrics identified with you during onboarding.
It keeps evolving. Alert thresholds, log filters and monitoring rules may need iterative tuning as your environment changes. Standard alert maintenance is included; refinement beyond it is reactive work drawn from your Reactive Flextime hours.
Platform boundaries. Patching, managed configuration, backups and health checks are designed for Linux servers. Windows servers receive the services expressly described for them, as we are able to deliver them on Windows; extending our Linux-native management to Windows needs a separate written agreement.
No security tooling on Windows by default. The host-based SIEM and XDR coverage in the High Security Add-on, and MDR coverage, apply to Linux servers only. Security coverage of Windows servers needs a separate scope.
DR Services Add-on
Turns "we have backups" into a recovery you can actually run.
DR Services define, document, maintain and operate the disaster recovery capability for the servers or clusters you have under proactive management: what is protected, how quickly it can be recovered, where it recovers to, and who performs each step.
A written DR runbook. A maintained recovery procedure covering the protected systems, the recovery sequence, dependencies, credentials handling and who is responsible for each step. Reviewed and updated at least annually and after any material change to your environment.
Agreed recovery targets. For each environment, a documented Recovery Time Objective (how long from a declared disaster to systems back in a defined operational state) and Recovery Point Objective (how much data loss, measured in time, is acceptable). They are the targets the whole capability is designed and tested against.
Backup validation. Periodic verification that backup jobs are completing, that they are restorable, and that they meet the documented retention period. Validation failures are escalated right away.
Replication monitoring and management. Where you replicate to a remote target, continuous monitoring of replication status, lag and integrity, with automated alerting on failures, excessive lag or integrity errors. Where we manage the replication pipeline, its configuration, maintenance and troubleshooting are included.
A documented failover and failback workflow. The steps, decision points and responsible parties for failing over to the recovery environment and for returning to normal operation.
Operating what we manage. Where we manage the backup servers, the configuration backup platform or the recovery environment, we operate them too: job configuration, schedules, capacity, keeping a warm environment current. Where you or a vendor own a piece, we document, validate and test it.
DR testing. Scheduled execution of the documented recovery procedure, quarterly, semi-annually or annually, or on request from your reactive hours, each concluded with a written result report.
A DR report. Periodic written reporting on backup validation results, replication health, DR readiness, gaps found and what to do about them. Critical findings do not wait for the report.
Cold or warm. A cold recovery environment has the infrastructure available but nothing pre-provisioned: lowest cost, longest recovery time. A warm one has systems pre-provisioned and kept current through replication or scheduled restoration, needing only activation and cutover: higher cost, shorter recovery time. Your runbook and targets are written for the one you choose.
Where it stops. Recovery targets are agreed objectives used to design and validate the capability, not a guarantee of recovery within a stated time. Engineering work during an actual disaster is reactive work from your Reactive Flextime hours; this add-on is what makes that recovery possible. Building, licensing or hosting a recovery environment is quoted separately, and copies of backup data are not a running replica that can be started in place of the original unless your agreement lists one. Gaps we find are reported with recommendations; implementing them, beyond routine configuration changes, is separate work.
Cloud Management
We administer the cloud account around your workloads: the organisation and projects, identity and access, networks, platform-level compute and storage, quotas and spend.
Cloud Management sits on top of Proactive Managed Services or Cluster Management; the servers and clusters inside the projects keep their own coverage, and this add-on manages the cloud provider's layer around them. Each component is named as your provider calls it in your agreement.
Organisation and project administration. We keep the organisation structure, folder layout, project settings and organisation-level policies in order, and create and retire projects at your direction.
Identity and access administration. We administer roles, groups and the service identities your workloads and automation use; run user onboarding and offboarding at your direction; and review privileged access, role bindings and service identity credentials every quarter, with critical findings raised immediately.
Network administration. Private networks, subnets, firewall rules, routing, load balancing and the private connectivity between your projects and to your premises.
Compute and storage administration. Machine instances, disks, images, object storage and file storage at the platform level: creation, resizing, scheduling, snapshot schedules and retirement at your direction.
Cost review. A monthly review of the bill: what changed, what is growing, what is idle, what commitments are coming due. Recommendations go in the monthly report; cost anomalies are raised immediately. We work to reduce your spend; we do not pay the bill and do not guarantee a savings amount.
Quota and capacity. We watch platform quotas and regional capacity for your covered projects and file quota increases at your direction.
Monthly report. One report per covered environment: the reviews above, the changes made, the hosts in your projects that are not under proactive management (and what they cost), and recommendations.
Where it stops. Cloud Management covers the cloud resources listed in your agreement and stops at the project boundary. The operating system inside a virtual machine is covered only where that machine is a covered server under Proactive Managed Services; a cluster inside a project only where it is a covered cluster under Cluster Management. Your applications, their code and performance, landing zone builds and migrations, third-party software, and the provider's own platform availability and pricing are outside it. You keep ownership of the organisation and the billing account, at least one break-glass administrator credential independent of us, and payment of your cloud spend to the provider.
Cluster Management.
Proactive management of the platform under your workloads: the control plane, the cluster nodes, the platform components and the platform lifecycle, for one monthly fee per cluster. Your team, or your vendor, keeps running the applications; the boundary between the two is written down in your agreement. Sold per cluster type.
What every cluster gets
Control plane management. Monitoring and management of the control plane components, their health, performance and storage.
Node management. Monitoring and management of control plane and worker nodes: capacity, resource utilization, node conditions, and taking nodes out of and back into service for maintenance.
Platform patching and upgrades. Platform updates within the current major version, inside the maintenance windows you approve and on the platform's supported upgrade paths. Major version upgrades are scoped separately as their own project.
Certificate management. Monitoring of platform and ingress certificate expiry, with alerting and renewal coordination before anything lapses.
Capacity monitoring. CPU, memory and storage utilization at the cluster and node level, with alerting on capacity thresholds and recommendations for scaling.
Cluster configuration backup. Regular backup of the cluster's own configuration and state, enough to rebuild the platform layer. Application data is not included; that is what your backups and DR Services are for.
Access review. Periodic review of platform roles, bindings and service identities for least-privilege alignment.
Reporting and meetings. A monthly report on cluster health, patching status, capacity trends and management activities, with critical findings escalated as they arise, and regular scrum-style check-ins at a cadence we agree.
Where the application operator comes in. Where someone other than us deploys and operates the applications on the cluster, your agreement names them and sets out who does what: we are responsible for platform upgrades, patching and platform failure remediation; they are responsible for application on-call, deployment, scaling, releases and application-layer performance; each is consulted on the other's work, and the escalation paths both ways are written down.
Where it stops. The operating systems on the nodes are covered under Proactive Managed Services only where the nodes are also listed in your agreement as covered servers; each platform below says what the usual arrangement is. Software-defined storage beneath the cluster, storage arrays and hypervisor replication, application code and delivery pipelines, application operation, the physical or virtual infrastructure the cluster runs on, major version upgrades, platform hardening and compliance tooling, and restoring a failed cluster or workload (reactive work) are outside it. Disaster recovery for your clusters is the DR Services Add-on.
Kubernetes
For clusters running Kubernetes, self-managed or as a managed service such as GKE, EKS or AKS. The control plane is the API server, etcd, scheduler and controller manager, plus the operators and add-ons your distribution ships. On top of what every cluster gets:
- etcd management. Health, performance and storage utilization of the etcd cluster, with periodic defragmentation and backup verification where we operate the control plane.
- Pod and workload monitoring. Pod health, deployment status, replica availability and resource consumption across namespaces, with alerting on crash loops, out-of-memory kills, pending pods and failed deployments.
- Networking and ingress. Cluster network health, ingress controller status, route availability and DNS resolution within the cluster.
- RBAC review. The access review applied to cluster roles, role bindings, service accounts and pod security settings.
The configuration backup is the cluster's resource definitions and, where we operate it, the etcd state. One monthly fee per cluster, up to an agreed worker node count where one is set.
OpenShift
For clusters running Red Hat OpenShift Container Platform. The control plane is the API server, etcd, scheduler and controller manager together with the cluster operators the platform ships; platform updates are the minor and z-stream releases on Red Hat's supported path, on the update channel recorded in your agreement. On top of what every cluster gets:
- Cluster operator health. Availability, degraded and progressing conditions of the cluster operators, with remediation of platform-layer operator faults.
- etcd management. Health, performance and storage utilization, with periodic defragmentation and backup verification.
- Pod and workload monitoring. Pod health, deployment status, replica availability and resource consumption across projects, with alerting on crash loops, out-of-memory kills, pending pods and failed deployments.
- Networking, ingress and routes. Cluster network health, ingress controller status, route availability and DNS resolution within the cluster.
- Machine configuration. Rollout of machine configuration and node pool state, with configuration changes that need node reboots coordinated inside your maintenance windows.
- RBAC and security context review. The access review applied to cluster roles, role bindings, service accounts and security context constraints.
- Platform security advisories. Review of the platform's security advisories for your clusters and scheduling of the corresponding updates.
The configuration backup is the cluster's resource definitions, including projects, operator configuration and application manifests, and, where we operate it, the etcd state. One monthly fee per cluster, up to an agreed worker node count where one is set.
Proxmox VE
For clusters running Proxmox Virtual Environment, including hyperconverged clusters with Ceph. Here the cluster is the infrastructure: a node is a hypervisor host that is a member of the cluster, and the control plane is the cluster configuration file system, the cluster manager and its quorum, and, where Ceph forms part of the cluster, the Ceph monitors and managers. Platform updates are Proxmox VE and Ceph point releases on the supported path in your maintenance windows, with virtual machines live-migrated between nodes where the cluster allows it. On top of what every cluster gets:
- Quorum and cluster membership. Monitoring of quorum, node membership and the cluster communication network; coordination of node additions, removals and replacements.
- Ceph health and operations. Where Ceph is part of the cluster: cluster health, monitor and manager state, object storage daemon state, placement group health, scrub status and capacity, plus the routine operations: scrub scheduling, rebalancing oversight, and replacing a failed object storage daemon on a healthy host.
- Storage lifecycle. The cluster's storage definitions and storage capacity at the cluster level, including expansion planning and retiring storage pools at your direction.
- Virtual machine placement and high availability. High-availability groups and placement rules at the cluster level, and live migration for maintenance.
- Backup server operation. Where a Proxmox Backup Server is listed as a cluster component: datastore capacity, job scheduling for the virtual machines you designate, verification and prune schedules, and its own updates.
- Hardware fault coordination. Detection of host hardware faults reported through the hypervisor and the host's management interface, and coordination of replacement with you or your hardware vendor.
- Upgrade planning. A written upgrade plan for major Proxmox VE and Ceph versions, maintained ahead of end of support; the major upgrade itself is its own project.
The configuration backup is the cluster configuration file system, node configuration and storage definitions, enough to rebuild the cluster layer; the virtual machines' own disks are protected by the backup server where your agreement lists one. The operating systems inside the virtual machines are not covered by Cluster Management: put the ones you want us inside under Proactive Managed Services, and the rest are reached on request. One monthly fee per cluster, up to an agreed node count where one is set.
Slurm
For Slurm clusters on your own servers or cloud virtual machines. The control plane is the controller daemon, the accounting daemon and its database, and the REST API daemon where deployed; the cluster nodes are the login and compute nodes. The nodes of a Slurm cluster are Linux servers, normally covered under Proactive Managed Services, which looks after their operating systems while Cluster Management looks after the cluster layer on them. On top of what every cluster gets:
- Scheduler management. Health, responsiveness and state save location of the controller daemon, and failover to a backup controller where one is deployed.
- Partitions and node state. Partitions and node definitions kept in step with the servers covered; monitoring of node states and drain reasons; draining and resuming nodes for maintenance in coordination with you.
- Accounting. Operation of the accounting daemon and its database, retention of job accounting records, and a utilisation summary by partition and account in the monthly report.
- REST API. Monitoring and version management of the REST API daemon where deployed. Version changes to the scheduler or the REST API happen only in a maintenance window you approve, because your tooling may bind to the API version.
- Idle-node suspend and resume. Where the cluster suspends idle compute nodes or creates them on demand, management of the suspend and resume programs and the node definitions they act on.
- Access review. Applied to accounts, associations and quality-of-service limits in the accounting database and to the shared authentication key.
The configuration backup is the scheduler configuration (cluster, partition, node and accounting configuration), the shared authentication key and the accounting database. One monthly fee per cluster, up to an agreed compute node count where one is set.
Reactive Flextime.
On-demand senior Linux hours for everything outside the proactive services: changes, troubleshooting, projects, consulting, and getting a failed service back.
Every client holds Reactive Flextime, on its own or alongside proactive services; it is how work gets requested and done.
How the hours work. You choose a monthly or annual allotment of hours. Monthly allotment hours are added on the 1st of each month and stay usable for two months from the month they are added; annual hours are added at the start of each twelve-month term and are usable through the term. Work above your available hours is overage, invoiced after the month at the overage rate in your agreement. You can raise or lower a monthly allotment with written notice before the 1st of the month it applies to, and if you switch between monthly and annual terms, unused hours carry across with their original expiry.
Prepaid or post-paid. A prepaid allotment is invoiced at the start of each period at a discounted hourly rate. Where your agreement states it, post-paid billing is available instead: hours are invoiced after the month in which they are worked, at the standard hourly rate.
Prepaid Block. For a busy stretch, a large project or a migration, a Prepaid Block adds hours beside your allotment: they are drawn after the allotment and before overage, and stay usable for two months from purchase.
What the hours cover. Configuration changes; emergency work and troubleshooting; restoring a failed service or system, including one our monitoring detected; special projects; documentation and discovery; software programming; project management; IT consulting; system remediation and stabilization; new user and computer setup; and similar tasks you authorize.
Requesting work. Your authorized contacts request work through our client portal, by email to our support address, or in the shared channel we provide for you. We do the work your representatives authorize. Clients with proactive services are scheduled first, then clients with a monthly allotment, then clients with an annual allotment.
When we work, and what it costs in hours. The multiplier follows the clock and whether the work was scheduled, not the channel you asked through.
| Work | When | Scheduled in advance? | Who may use it | Multiplier | Minimum per entry |
|---|---|---|---|---|---|
| Business hours | Monday to Friday, 9:00 AM to 5:30 PM Mountain Time, excluding statutory holidays | Not required | Every client | 1x | 0.25 hours |
| After-hours | Any day, 6:00 AM to 10:00 PM Mountain Time, outside business hours | Required; scheduled on a best-effort basis | Clients with proactive services or the 24/7 NOC Add-on | 1.5x | 0.5 hours |
| Emergency | Unscheduled work outside business hours, or any work between 10:00 PM and 6:00 AM Mountain Time | No | Clients with the 24/7 NOC Add-on | 2x | 1 hour |
A request that is not scheduled in advance and arrives outside business hours is handled in the next business hours, unless you hold the 24/7 NOC Add-on and activate it. An activation of the NOC during business hours is billed at the business-hours multiplier.
The practical details.
How working with us runs day to day. These are our standard practice; where your agreement says otherwise, your agreement applies.
When we work
Proactive work is scheduled with you and is included in your monthly fee when it happens in business hours or in the after-hours window above. If you need proactive work done in the emergency window overnight, that work is additionally recorded against your Reactive Flextime hours at the business-hours rate, with a one-hour minimum. On systems with NOC coverage, NOC response is included around the clock; engineering work beyond the initial triage is reactive work at the band that applies to when it is done.
Onboarding
Onboarding an environment covers deploying and configuring the CraftyStack collectors, baseline tuning, alert threshold configuration and initial validation. We apply our default alert thresholds at onboarding and tune them with you during the first month; either of us can ask for a threshold change afterwards. Onboarding is a one-time fee equal to one month's recurring fee for the services being onboarded, invoiced with the first monthly fee; monthly fees run from the start date of your agreement.
Reporting and billing
Invoices are emailed around the 1st of the month, dated and due on the 1st. Your work summary follows about five business days after month-end, listing the proactive work performed and the reactive time used. For billing questions, reply to the original email so it routes correctly; emails to individual project or account managers may delay the response.
Right-sizing as you grow
Your scope will change over time, so we review it: when you move systems between services, when the number of covered systems changes materially, and at a formal scope assessment at least every six months, sooner if you ask for more systems or wider coverage. Minor changes in count in the ordinary course do not move your invoice around. You get thirty days written notice before any pricing or scope adjustment.