Independence & standards
The page procurement can screenshot.
Vendor-neutral is a fiduciary position, not a brand color. These are the refusals the practice is built on.
Standards
No software. No kickbacks.
We do not resell platforms, models, or seats. We do not take implementation spiffs, alliance bonuses, or 'preferred partner' compensation from anyone we recommend. If a build partner is required, we introduce more than one and say why.
The artifacts are yours.
Scores, roadmaps, risk registers, and decks produced in an engagement remain yours if you never hire us again. That is written into the work. A report that only works if we stay is a hostage note, not a deliverable.
NDA is the default.
We will sign first. Case studies are published only with permission or as composites that cannot be reverse-engineered to a client. Confidential work stays confidential. If we cannot say the name, we do not imply it.
Data handling
Client data used in an audit or engagement is scoped, minimized, and deleted or returned per the SOW. We do not train public models on your corpus. We do not move PHI, CUI, or similarly restricted data into tools that cannot carry it.
Active-duty boundary
Cory Maffeo is an active-duty U.S. Air Force officer. Consulting is performed off-duty, in a personal capacity, and does not constitute an official endorsement by the Department of the Air Force, the Department of Defense, or the U.S. Government. Government affiliation is not used as a marketing claim of official status.
We will say no.
If we are not the right firm (wrong altitude, wrong constraint, a product you should not buy, a seat we cannot take) we will say so in the first half hour. That is a standard, not a personality.
Ask us on the record
Four questions. Four answers.
01
Do you sell software?
No.
02
Do you receive compensation from vendors you recommend?
No.
03
Will you put 'we are not the right firm' in writing when it is true?
Yes.
04
Do the artifacts remain ours if we never hire you again?
Yes.
We do not hold SOC 2, ISO 27001, or any similar third-party attestation, and we display no badge implying that we do. Where an attestation matters to your risk posture, we will tell you which of your vendors must hold it and how to verify it.
Next step
Hold us to this on the call.
If any of it is soft in conversation, walk. We would.