Engagement scope

Who this page is for

Product owners, platform engineers, and security leads who need clear boundaries before hiring consultants. This page explains how we structure API security and authentication work — not a generic marketing checklist.

Scoped project work

Project engagements begin with a written scope that lists:

• Endpoints, environments, and identity components in scope (and explicitly out of scope)
• Deliverables (report, workshop notes, configuration recommendations)
• Access requirements (read-only repo, staging URLs, IdP admin read access)
• Calendar duration and review meetings

We do not bill open-ended “hours until done” without a change process. If discovery reveals materially more surface area, we pause and agree a change order before continuing.

Ongoing technical advisory

Advisory blocks suit teams mid-implementation. Hours are drawn down against email, scheduled calls, or async review of pull requests related to authentication. Unused hours expire per your statement of work (typically 90 days) — proposed terms are confirmed before purchase.

What we do not include

• 24/7 incident response or SOC services
• Guaranteed compliance certification (PCI, ISO) — we can align technical work to your compliance goals
• Unlimited production changes on your behalf unless explicitly contracted as implementation support

Location and delivery

API Haven Consulting is based at 68, Jalan Tebrau, 80300 Johor Bahru, Malaysia. Most delivery is remote across Malaysia; workshops in Johor Bahru can be arranged.

Next step

Review services formats, then contact us with your API context and preferred engagement type.