Process | Resolve Health Tech

Week by week

The full sprint timeline.

Week 1

Intro, access, and review

We receive access to your codebase, infrastructure, and data, and run a key-stakeholder kick-off call to align on scope and risk. Within days we're reviewing security and compliance across your application — not scheduling discovery workshops. The work starts immediately.

Week 2

Critical remediation

We identify the critical security and compliance issues that need to be addressed now, and deliver an immediate action plan. This is also where the Two-Week Test resolves: we find a specific AI security exposure in your environment and get a fix underway — or the engagement ends and you owe nothing.

Weeks 3–6

Prioritized build sequencing

We work through the immediate action plan while conducting key stakeholder interviews and completing the full five-pillar review. The sprint culminates in your 90-day prioritized build sequence and a phased investment framework — so you leave with both the fixes in motion and a clear plan for what to build next.

Deliverables

What lands in your inbox.

Critical issues report — day 14

Urgent security and governance findings with a fix already in motion.

Five-pillar technical review

Infrastructure, data, security & governance, team readiness, product opportunity.

90-day prioritized build sequence

What to build first, second, and next — sequenced, not a wish list.

What we'll need from you

A light lift on your side.

Engagement requirements

Access to codebase, infrastructure and data
Interviews with your tech team and key stakeholders
A one-hour weekly alignment meeting
A kick-off meeting and an end-of-sprint review

That's the whole ask. We're built to operate with minimal disruption to your team's existing work — the sprint runs alongside your roadmap, not on top of it.

◆ The Two-Week Test

The guarantee, in plain terms.

In two weeks, we find a specific AI security exposure in your environment and get a fix underway. If we don't, you owe us nothing. The engagement ends, full stop. We take the risk so the decision to start is easy.

Questions, answered

What VPs of Engineering ask us first.

No. The sprint is designed to run alongside your existing work. The only standing commitment is a one-hour weekly alignment meeting plus the kick-off and end-of-sprint reviews. Stakeholder interviews are scheduled around your team's availability, and our engineers work in your stack without pulling your people off their own deliverables.

We scope access to exactly what the review requires and work within your existing controls — your SSO, your repo permissions, your environments. For anything touching PHI, we follow least-privilege access and can work against de-identified or staging data where it's sufficient for the review. We'll align on the specifics during the week-one kick-off before any access is granted.

A concrete, demonstrable risk in how AI is being used in your environment — for example, an integration sending PHI to a third-party model without a BAA, prompts or logs persisting sensitive data, an unreviewed dependency with data-handling implications, or missing governance around what engineers can ship with AI tools. Specific and fixable, not a generic "you should think about security" observation.

Senior engineers and architects who've worked in regulated healthcare software environments. The sprint is a high-touch, expert-led engagement — the people reviewing your system are the same people who would help you build what comes next. There's no junior bench doing the real work behind the scenes.

You own everything: the findings, the fixes in motion, the five-pillar review, and the 90-day build sequence. Many teams continue with us as embedded engineering partners to execute that sequence — but there's no obligation to. The sprint is a complete, standalone engagement that leaves you better off whether or not we keep working together.

Yes. One fixed scope, one fixed fee, no retainers and no surprise change orders. And it's backed by the Two-Week Test — if we don't find an exposure and get a fix underway in the first two weeks, the engagement ends and you owe nothing.

Six weeks. Engineering work from day one.