Question 1

What kinds of engagements do you take on?

Accepted Answer

Three main shapes: (1) bespoke builds where we design and ship a custom application or AI system end-to-end, (2) embedded engineering where we augment an existing team with senior engineers and architects, and (3) advisory / discovery work to define architecture, AI strategy, or compliance-supporting system design before a build kicks off.

Question 2

Do you provide audits, attestations, or legal advice?

Accepted Answer

No. We are an engineering consultancy. We build software and systems that support compliance programs — evidence workflows, control implementations, secure data flows, audit trails. Your auditors, legal counsel, and compliance officers remain the authoritative voices on attestation, certification, and legal interpretation.

Question 3

Which compliance frameworks do you work with?

Accepted Answer

Most commonly SOC 2, ISO 27001 / 27701, HIPAA / HITECH, PCI DSS 4.0, GDPR / CCPA, SOX ITGC, NIST SSDF, NIST CSF 2.0, NIST 800-53/171, HITRUST CSF, FedRAMP, CMMC 2.0, FERPA, GLBA, the EU AI Act, and the NIST AI RMF. We're framework-fluent — engagements typically map controls to whichever combination governs your environment.

Question 4

How do you price engagements?

Accepted Answer

Most engagements are fixed-scope phases or time-and-materials with a clear weekly cap. Discovery is usually a fixed-fee sprint that produces an architecture, plan, and estimate you can take anywhere. We try hard to avoid open-ended retainers that drift.

Question 5

What does a typical engagement look like end-to-end?

Accepted Answer

Discover → Architect → Build → Validate → Operate. Discovery and architecture are short and focused. Build happens in two-week increments with working software at the end of each. Validate covers functional, security, and (where relevant) AI behavior testing. Operate covers launch support, monitoring, and handoff or ongoing maintenance.

Question 6

Do you work with our existing team and tools?

Accepted Answer

Yes, almost always. We integrate with internal engineering, security, and compliance teams, and we work within the cloud platforms, data stores, IdPs, and ticketing systems you already use. We bring opinions but not religion about stack choices.

Question 7

Where is your team and how do you operate?

Accepted Answer

Wasatch Solutions is headquartered in Utah and works remotely with clients across the US, UK, EU, and beyond. We're comfortable operating across time zones and adapt to your access controls, NDAs, DPAs (including GDPR / UK GDPR transfer terms), and BAAs as required.

Question 8

How do you handle sensitive or regulated data during a project?

Accepted Answer

We don't ingest production sensitive data unless contractually required, and when we do we work inside your environment with least-privilege access. For HIPAA-covered work we sign BAAs. For GDPR-covered work we sign DPAs. See our Security page for more.

Question 9

Do you build with AI? Should we?

Accepted Answer

We build AI infrastructure, RAG systems, evaluation pipelines, internal copilots, and bespoke modeling — but only where it materially helps the business. We're equally happy telling you a problem doesn't need AI as we are shipping a production AI system. The goal is usable systems, not demos.

Question 10

How do we get started?

Accepted Answer

Send us a short note about the problem you're trying to solve. We'll typically reply with a 30-minute call to scope, and from there propose a discovery sprint or a direct engagement depending on how well-defined the work is.

Questions buyers usually ask first.

Still have a question?