FAQs.
Answers to the questions we are asked most often about our IT, security and compliance services.
57 questions
Working with us
How an engagement starts, who does the work and how it is run.
What services do you offer?
Software development, DevOps and DevSecOps, cloud and infrastructure work, cybersecurity, compliance (ISO/IEC 27001, NIST CSF, PCI DSS, GDPR, HIPAA, CCPA and others), quality assurance, IT outsourcing and staff training. The full list, grouped by area, is on the Services page.
How does an engagement start?
With a short call to understand what you need. We then propose a scope and a team setup in writing. Work starts once you approve it.
How fast can we start?
It depends on the skills you need and the team's current load. We give you a concrete start date with the proposal, before you commit to anything.
Do you take on both small and large projects?
Yes. We work on single assessments and short fixes as well as multi-year outsourcing arrangements. The scope is agreed with you up front, whatever its size.
Who manages the people working for us day to day?
For staff augmentation, our engineers join your team and work in your tools, meetings and process. For project work, we manage delivery and report to you at agreed milestones.
What if a team member is not the right fit?
Tell us and we will propose a replacement. How replacements are handled is written into the contract.
Which languages do you work in?
English, German and French. Documentation is in English by default; other languages can be agreed per engagement.
Pricing and contracts
How we price work and what goes into the contract.
How do you price your work?
Each engagement is quoted individually after we understand the scope. The price and payment terms are set in the statement of work. We do not publish a price list.
Which engagement models do you offer?
Fixed-scope projects, ongoing outsourcing of a team or a function, and staff augmentation with one or more specialists in your team. You can combine them.
Is there a minimum commitment?
Contract length and notice periods are set per engagement in the statement of work. We agree them with you before work starts.
Can we scale the team up or down?
Yes. How and when the team size can change is part of the contract, so both sides can plan for it.
Who owns the code and intellectual property?
You do. IP transfer is written into the contract, and code, documentation and credentials are handed over to you.
Do you sign an NDA?
Yes. We can sign yours before any technical discussion, or provide our own.
Who do we contact about invoices?
Write to billing@theorigamicorporation.com.
Security and compliance
Our security services and how we treat your systems and data.
What security services do you offer?
Penetration testing of web, mobile, network and cloud targets; security compliance work (ISO/IEC 27001, NIST CSF, PCI DSS, HIPAA and others); virtual CISO services; security awareness and social engineering training; and incident response and SOC management.
How do you keep us secure during a migration or a new build?
Security is part of the design from the start, not a check at the end. We review architecture, access and data flows at each stage, and can provide ongoing monitoring and incident response once you are live.
How do you protect client data?
We encrypt data, restrict access to the people working on your engagement and review that access regularly. Specific controls can be written into the contract where you need them.
Which compliance frameworks do you work with?
ISO/IEC 27001, ISO/IEC 27018, NIST CSF, PCI DSS, GDPR, HIPAA and CCPA. Each has its own service page describing what the work involves.
What is a virtual CISO?
A senior security lead who works for you part time. They own your security program, policies and risk decisions without you hiring a full-time CISO.
Can you certify us against ISO/IEC 27001?
Yes, together with our partners. We prepare you for the audit: gap analysis, ISMS, policies, controls and evidence. The certification audit is then run with an accredited certification body we work with, and we stay with you through it.
How do we report a vulnerability in your systems?
Write to office@theorigamicorporation.com. The address is also published in our security.txt file.
Data protection and GDPR
How we handle personal data and help you meet GDPR.
Does GDPR apply to companies outside the EU?
Yes, if you offer goods or services to people in the EU or monitor their behavior. GDPR applies regardless of where your company is based.
How does GDPR relate to other privacy laws such as CCPA?
They overlap in many areas. We build one privacy program that covers the regulations that apply to you, so you do not run separate projects for each.
Do you sign a data processing agreement?
Yes, where we process personal data on your behalf. The agreement is part of the contract for the engagement.
What does your GDPR work include?
Mapping where personal data is held and how it moves, gap analysis, policies and records of processing, data subject request procedures and staff training. The exact scope is agreed per engagement.
What personal data does this website collect?
Only what you send through our forms and what the cookies you consent to collect. The Privacy Policy and Cookie Policy list both.
How can I ask you to delete my data?
Write to legal@theorigamicorporation.com. Job applicants can also ask at any time to have their application deleted.
Cloud and infrastructure
Migrations, infrastructure design and running costs.
Can you migrate us from on-premises to the cloud?
Yes. We migrate from on-premises to the cloud and between cloud providers, planning the cutover to keep downtime low and checking cost and performance on the target platform.
How do you decide between cloud and on-premises?
Workload by workload. We look at performance needs, data location, security and compliance requirements, operating effort and cost. The result is often a mix of both.
Can you reduce our cloud bill?
We analyze your usage, right-size resources and remove waste without lowering performance or security. How much you save depends on your current setup; we report findings before changing anything.
Do you assess existing infrastructure?
Yes. We run network, system, and business continuity and disaster recovery assessments. Each ends with a written report of findings and recommended fixes.
Do you provide hosting?
Yes, through our hosting brand RSO Hosting (rso.dev).
What is DevSecOps and do you implement it?
DevSecOps adds security checks to every stage of the delivery pipeline, from code review to deployment. We set up and maintain CI/CD pipelines with these checks built in.
Software development and delivery
What we build and how we deliver it.
Do you build custom software?
Yes. We build web, mobile, IoT and cloud applications to your requirements, with security and scalability considered from the start.
How long does a typical project take?
It depends on scope. We estimate the timeline with the proposal and deliver in short iterations, so you see working software throughout.
Can you integrate with our existing systems?
Yes. Part of the initial work is mapping your current systems and their interfaces so new software fits into them.
Do you provide quality assurance and test automation?
Yes. We test web and mobile applications manually and with automated tests integrated into your CI/CD pipeline, either as part of a project or as a standalone service.
How experienced are your engineers?
The engineers we propose for client work have built and maintained production systems. You see their profiles and can interview them before they start.
What do we receive at the end of a project?
The source code, documentation and all credentials. You own all of it under the contract.
Support and SLAs
What happens after go-live.
Do you offer support after launch?
Yes. We provide ongoing maintenance, monitoring, incident response and optimization for software and infrastructure we build or take over.
What response times do you guarantee?
Response and resolution times are set per engagement in the statement of work or service agreement. We agree them with you based on how critical the systems are.
Are you available outside business hours?
Out-of-hours coverage can be included in the support agreement. Whether it applies, and on which systems, is set per engagement.
How do existing clients reach support?
Through the channel agreed in your contract, or by writing to support@theorigamicorporation.com.
Can you support systems we did not build with you?
Yes. We start with an assessment of the system and its documentation, then agree the support scope.
Can you train our team?
Yes. We run cybersecurity, DevSecOps, cloud and compliance training as workshops, on site or online, from half a day to several weeks, adapted to your stack.
Careers
Working at The Origami Corporation.
How do I apply?
Use the application form on the Careers page. You can apply for an open role or send an open application.
Do I need professional experience?
Not for internships. We look for curiosity and something you have built yourself, such as a course project, a home lab or an open source contribution.
Can I work fully remote?
Yes. Most of the team works remotely with flexible hours. The offices are there for those who want them.
What does the hiring process look like?
You apply, have a short intro call with the team lead, then a practical conversation about a real problem. There are no trick questions and no unpaid take-home projects. We reply to every applicant.
What language do you work in?
English with clients and in documentation.
What happens to my application data?
We use it only to assess your application, as described in the Privacy Policy. You can ask us to delete it at any time.
Company
Who we are and where we work.
Who is The Origami Corporation?
A software development, cybersecurity and hosting company founded in 2015 in Plovdiv, Bulgaria.
Where are your locations?
In Bulgaria, the Netherlands, Germany and the United Kingdom. Most of our work is done remotely.
Which brands belong to The Origami Corporation?
Beaver Development (software development), Black Fox Security (cybersecurity) and RSO Hosting (hosting).
Which kinds of clients do you work with?
Businesses of all sizes, from startups to established companies, many of them outside Bulgaria. Examples are on the Case Studies page.
How do we contact you?
Use the contact form, write to contact@theorigamicorporation.com, call +359 87 868 6627 or book a meeting online. Sales questions can go to sales@theorigamicorporation.com.
Where can we find your company details?
The legal entity and register details are on the Imprint page.