Scalable IT Solutions for Independent Software Vendors

IT services for independent software vendors, to build, modernize and scale secure software products. This page follows a product through the four service lines above, sets out the engagement models side by side, names the secure development frameworks and the attestations enterprise buyers ask a vendor about, and covers what moves the cost and what to ask any firm bidding for the work, including us.

On this page

• A product's life, and the service line for each stage
• Engagement models compared
• Multi-tenancy, the decision that shapes a SaaS product
• Secure development frameworks and the attestations buyers ask for
• How an ISV engagement runs
• What drives the cost of product engineering
• What to ask any firm before you hire one
• What you receive
• Frequently asked questions
• Related pages

A product's life, and the service line for each stage

The cards above describe a software vendor's product from first build to long-term support, with engineering support alongside every stage and a choice of engagement models underneath.

Engagement models compared

The engagement models card lists PODs and Guilds, fixed-time and material, outcome-based engagements and flexible scaling. Across this site the same choice is set out as four commercial shapes, and the engagement model decides the number more than the vendor does.

Where the work is continuous product work over quarters rather than a single project, that is the dedicated team row. The full comparison, with what each model commits in the contract, is on our software development services page.

Multi-tenancy, the decision that shapes a SaaS product

Multi tenancy is a cloud computing model where a single shared system serves multiple customers, called tenants, while keeping each tenant's data and settings isolated from the others. It is a spectrum, not a switch: some systems share almost everything, others share only the hardware and keep a separate database per tenant, and the right level depends on your security and performance needs. Our multi-tenancy explainer sets out the terms, and strong isolation between tenants is what keeps shared systems safe.

Secure development frameworks and the attestations buyers ask for

NIST SSDF, the Secure Software Development Framework

Who issues it, and whom it binds. The National Institute of Standards and Technology, in SP 800-218, which describes “a core set of high-level secure software development practices that can be integrated into each SDLC implementation”. Its first audience is “software producers (e.g., commercial-off-the-shelf [COTS] product vendors, government-off-the-shelf [GOTS] software developers, custom software developers, internal development teams) regardless of size, sector, or level of maturity.” NIST adds: “This publication may be used by nongovernmental organizations on a voluntary basis and is not subject to copyright in the United States.”

What it asks of the build. NIST's own summary of the point: “Following such practices should help software producers reduce the number of vulnerabilities in released software”. On this page, DevSecOps on the engineering support card and release and build management on the sustenance card are where those practices live.

CISA Secure by Design

Who issues it, and whom it binds. The Cybersecurity and Infrastructure Security Agency: “Every technology provider must take ownership at the executive level to ensure their products are secure by design.” CISA's pledge page says “This pledge is voluntary and not legally binding.”

What it asks of the build. In CISA's words: “Out-of-the-box, products should be secure with additional security features such as multi-factor authentication (MFA), logging, and single sign-on (SSO) available at no extra cost.” For a vendor that is a product and pricing decision as much as an engineering one.

SOC 2 and ISO/IEC 27001, what an enterprise customer asks a vendor for

Who issues them. A SOC 2 report comes from an examination performed under AICPA standards, part of what the AICPA calls “a suite of service offerings CPAs may provide in connection with system-level controls”, covering controls relevant to security, availability, processing integrity, confidentiality or privacy. The IEC listing for ISO/IEC 27001:2022 says that standard “specifies the requirements for establishing, implementing, maintaining and continually improving an information security management system”.

What they ask of the build. SOC 2 is frequently required by a contract or a procurement process, which is not the same thing as being required by law, and ISO/IEC 27001 certification binds a vendor when a customer makes it a condition. The controls behind them are ordinary engineering: access, logging, encryption, change management and vendor management, evidenced continuously rather than assembled in the month before an audit. Our SOC 2 explainer sets out the five trust services criteria.

How an ISV engagement runs

The four steps below condense the stages published on our custom software development page. We work in two week sprints, so working software arrives every two weeks and a first production release typically lands in three to six months, as published on our about page.

1. DiscoveryThe problem, the constraints and the success criteria are mapped before a line of code. It ends with a written scope and a costed roadmap, which is the point at which a fixed price becomes possible.
2. Architecture and designThe data model, where state lives, how the system fails, how it scales, and how a reviewer will later verify its security posture.
3. Build and releaseTwo week sprints that end in something reviewable, then hardening, testing and a controlled release with the rollback path decided before the deployment.
4. Handover and supportThe repository and the cloud accounts in your name, then monitoring, maintenance and a roadmap tied to business outcomes.

What drives the cost of product engineering

Our rates are $150 to $250 per hour, depending on the seniority and mix of the team, and a typical project runs $50,000 to $200,000. Where the scope is clear we quote a fixed price for a defined outcome, with a costed roadmap before any build starts.

• Team size and how long the engagement runs. The same total effort costs differently spread over two quarters than compressed into one, which is the question the engagement models answer.
• How settled the scope is. A settled scope can be quoted as a fixed price; an unsettled one priced as though it were settled is where the buffer comes from.
• How many systems it has to talk to. API-first architectures are on the engineering card, and every integration adds a counterparty whose availability, data quality and release calendar you do not control.
• The control framework the contract names. Work scoped against SSDF, SOC 2 or ISO/IEC 27001 carries evidence, review and documentation the same build would not otherwise need.
• The seniority and mix of the team. This is the stated reason our own rate band has a range at all.
• What happens after launch. L1 to L3 support and reliability engineering are on the sustenance card; a quote that stops at go-live is not cheaper, it is shorter.

What to ask any firm before you hire one

Every one of these is already published on this site, so you can put all of them to us as easily as to anybody else.

• Ask who owns the code and the cloud accounts, and whether any licence runs back to the builder.
• Ask who reviews the code, and whether that person can veto a merge.
• Ask what the code looked like when someone else took it over. What the next team inherited is the real review.
• Ask which certifications are audited and which are self declared, then ask for the report date.
• Ask for named engineers on the contract, and a notice clause if they change.
• Ask what documentation is a contractual deliverable, not what they promise to write.

What you receive

• The repository and the cloud accounts, in your name from the first commit, with no licence back to us.
• A written scope and a costed roadmap, before any build starts.
• Working software every two weeks, not a status report about software.
• Architecture and a security posture you can put in front of a reviewer.
• Infrastructure your own engineers can run once we hand it over.
• Monitoring, maintenance and a roadmap after launch, priced up front.

Frequently asked questions

What is multi-tenancy in a SaaS product?

Multi tenancy is a cloud computing model where a single shared system serves multiple customers, called tenants, while keeping each tenant's data and settings isolated from the others. The right level of sharing depends on your security and performance needs.

What is the NIST Secure Software Development Framework?

NIST SP 800-218 is a core set of high-level secure software development practices that can be integrated into each SDLC implementation. It is written for software producers of any size, sector or level of maturity, and nongovernmental organizations may use it on a voluntary basis.

What does CISA's Secure by Design ask of a software vendor?

CISA says every technology provider must take ownership at the executive level to ensure their products are secure by design, and that out of the box, products should be secure, with features such as multi-factor authentication, logging and single sign-on available at no extra cost.

Does Sthenos hold a SOC 2 report?

No. As of September 2026 Sthenos holds no SOC 1 or SOC 2 report, PCI DSS attestation or ISO 27001 certificate of its own. We build to these controls and we hand you the evidence; formal certifications and audits are the vendor's own to hold.

What does product engineering for an ISV cost?

Our rates are $150 to $250 per hour, depending on the seniority and mix of the team, and a typical project runs $50,000 to $200,000. Where the scope is clear we quote a fixed price for a defined outcome, with a costed roadmap before any build starts.

Who owns the code and the cloud accounts?

You do, entirely, from the first commit. The repository and the cloud accounts are in your name, with no licence back to us and no dependency on us continuing to exist.

Related pages

• SaaS development services, for products sold as a service.
• Product development, from concept to launch.
• DevOps consulting, for DevSecOps and release management.
• Cloud migration and optimization, for modernization.
• Production readiness checklist, the standard we hold our own delivery to.

Talk to an engineer. We are happy to answer any questions you may have and help you determine which of our services best fit your needs. Talk to our engineers.