Approach
How we work
Peculiar Cloud is a small senior cloud, security and networking practice that works fixed-scope and hands over Terraform your team owns — no retainer, no lock-in. Everything you judge us on is public — our certifications, the sample Terraform on this site, this methodology, and our written technical positions. Engagements are fixed-price, agreed in writing, and start with a low-commitment Cloud Security Reality-Check.
How you contract with us
Peculiar Cloud is a company based in Toronto, Ontario, Canada. You sign with, pay, and are protected by a registered company that carries the liability for the work. (Professional indemnity / E&O and cyber-liability coverage is being put in place; we will provide proof of coverage once active.) Scope, price, deliverables, and the 90-day warranty are agreed in writing before any work starts.
Who you’re working with
We're a small senior practice. We don't publish bios or staff pages — you judge us on what is public and verifiable: our certifications, the sample Terraform on this site, our methodology, and our written technical positions — and on the fixed-scope contract you sign with the company. The work is the credential.
What never changes
You own the code
Every engagement ends with a Terraform/IaC repository in your version control, under your cloud accounts, with no dependency on us to run, change, or extend it.
No lock-in
No proprietary platform, no agent you keep installed, no portal you log into. We use the standard tools your team already knows (Terraform/OpenTofu, your CI, your cloud-native controls) so the next engineer can pick it up cold. The handover phase exists to confirm your team can apply, destroy, and extend the repo without us.
Fixed scope, fixed price
We define the deliverables and the boundary in writing before we start. For that agreed scope the price is fixed — no hourly creep. Any change to scope is a new, written, optional decision before any further work or cost.
We ship, not slide
The deliverable is working infrastructure-as-code and the documents an engineer needs to run it. If you wanted a slide deck and a recommendation to hire someone else to build it, that is not what we do.
Data handling
Discovery uses scoped, read-only IAM roles that you create in your accounts and can revoke at any second — never long-lived keys we hold. Where you must export configuration or state, it lands encrypted in storage you control, and we delete our working copies on a documented schedule with written confirmation. We use no sub-processors and nothing leaves the jurisdiction you specify. Wherever possible, implementation runs entirely inside your own tenancy and CI, so we never hold your credentials at all. We will complete your security questionnaire (we are comfortable with CAIQ/SIG-lite) before you grant any access. Specifics are agreed in writing before any work and documented on our privacy page.
Our method
The same four phases run on every engagement. The scope differs; the shape does not.
- 01
Discovery
We read your accounts, configs, and constraints directly (scoped read-only access or exported state), map the real current state, and agree on a written scope and success criteria before any code is written.
- 02
Architecture Decision Records
We write down the key decisions — what we’re doing, the options we rejected, and why — as ADRs in your repo, so the reasoning survives long after we’re gone and you can challenge it before we build.
- 03
Implementation
We build the solution as reviewable Terraform/IaC in small, tested pull requests against your CI, so you watch it land incrementally and nothing arrives as a black box.
- 04
Handover
We walk your team through the repo, the threat model, and the runbooks live, confirm you can apply/destroy/extend it yourselves, and then we leave. You own everything — there is no phase 5 where you still need us.
Pricing
Every engagement is fixed scope, fixed price, agreed in writing before we start — no hourly creep. We do not post a single number because the price tracks scope. Each service page publishes an indicative floor and the engagement shape so you can self-qualify; the Cloud Security Reality-Check starts at $9,500 USD. All figures on this site are USD.
FAQ
How we operate — common questions
Who am I actually contracting with?
Peculiar Cloud, a registered company based in Toronto, Canada. You sign with, pay, and are protected by the company, and it carries the liability for the work; scope, price, deliverables, and the 90-day warranty are agreed in writing before anything starts. And you can judge the engineering before you ever sign: our certifications, methodology, the sample Terraform on this site, and our written technical positions are all public.
Who actually does the work?
A small senior practice — whoever scopes your engagement writes the Terraform and hands it over. There is no junior bench, no offshore handoff, no solution architect who disappears after the sales call. We deliberately take on few engagements at once, which is how the seniority stays real.
What about availability and capacity?
We run a small number of engagements at once so each gets senior attention. That can mean waiting for a start slot; we give you a written start date during scoping, before you commit. Within an engagement, the scope and timeline are fixed and agreed in writing. If your real need is round-the-clock operational coverage, that is a managed-service retainer — which is not us — and we will say so rather than overpromise.
How does pricing work, and why won’t you just post a price?
Every engagement is fixed scope, fixed price — agreed in writing before we start, with no hourly creep. We do not post a single number because the price tracks scope (how many accounts/clouds, how strict the guardrails, how many access paths or connections). We publish indicative floors per service and the engagement shape so you can self-qualify, and the contact form shows our floor before it asks your rough budget so we do not waste each other’s time. Reality-Checks start at $9,500.
Won’t I be locked into you?
The opposite is the design. You own the repo, it lives in your version control and your cloud accounts, and it is built on standard tools (Terraform/OpenTofu, your CI, cloud-native controls) — no proprietary platform, no agent, no portal. The handover phase exists specifically to confirm your team can apply, destroy, and extend everything without us.