Skip to content
Hlebourg
Services

Fixed-price services, each closing a place where deployments die

None of these is sold by the hour. Every one has a subject, a fixed fee agreed before any work starts, and a completion test that you run rather than we do.

Request a pilotAsk a question first

What a service has to have before we will sell it

We would rather these were the part you can check. Three rules, applied to every service:

  • One

    A subject, not an intention

    The deliverable is a thing you keep — a completed assessment, a configuration you own, an exported dataset. Not a recommendation and not a deck.

  • Two

    A completion test you run

    Your engineer rebuilds the environment without us. Your council signs — or states in writing what is missing. You read your own data back with software that is not ours. We do not grade our own work.

  • Three

    A scope printed here

    The subject, the deliverables and the completion test are on this page, before the call, and the fee is fixed against them.

The services

What we actually do

In the order they tend to happen: prove it, clear the legal path, install it, connect it to your agents, check that it works, and leave cleanly.

  1. 01

    Fixed-scope pilot

    Ninety days, one team, a criterion written down before we start

    Why this exists

    The category cannot distinguish a working deployment from an expensive one. Reporting turns on logins and participation, and a renewal conversation then settles whose anecdote is louder.

    One product, one real team, ninety days. We agree the success criterion in writing before installation — a number, a date and a threshold — and we publish the result against it whether or not it favours us. The pilot runs on your infrastructure with your data, because a pilot on ours proves nothing about the deployment you would actually buy.

    What you are left holding

    • A written success criterion, agreed and dated before any software is installed
    • A working installation in your environment, not a hosted demonstration tenancy
    • The measured result against the criterion, including the runs that went badly
    • Your data exported in a documented format, whether you continue or stop
    Done when
    You hold the measurement and the exported data. If the criterion was not met, we say so in the report.
    Commercial
    Fixed fee, quoted in the commercial proposal before any work starts. Credited in full against the first year if you continue.
    Duration
    90 days
  2. 02

    Regulatory clearance

    The works-council and DPIA file, produced as a deliverable

    Why this exists

    In Germany, Austria, the Netherlands and France this is where deals die — after the budget is approved. Works-council consent and the data-protection file are the longest pole in the deployment, and vendors rarely treat them as more than an afterthought.

    We produce the file your data protection officer and your works council actually need, for the specific processing the product performs, with the national overlay that applies to you. Not a template with your logo on it — a completed assessment naming the fields, the lawful basis per purpose, and the least-intrusive alternative we considered and rejected.

    What you are left holding

    • A completed DPIA for the specific processing, with necessity and proportionality reasoning
    • A system-capability disclosure written for co-determination: what the product can observe, not what we intend
    • A draft works agreement with the national overlay for your jurisdiction
    • An AI Act classification dossier, and the record that workers were informed before the system went into service
    Done when
    Your works council or its expert signs, or tells you in writing what is missing. We hold back half the fee until one of those two things has happened. This is not legal advice: we produce the engineering and data-protection file; you conclude the lawful basis and the works agreement with your counsel.
    Commercial
    Fixed fee per product per jurisdiction, quoted before any work starts. Half on delivery, half on the council's written sign-off or its written statement of what is missing, whichever comes first.
    Duration
    4–8 weeks, dependent on your council's own calendar
    Applies to Cadence only.
  3. 03

    Self-hosted deployment

    Installed in your tenancy, by people who will not hold your data

    Why this exists

    Self-hosted is our default, and the default is the hard part. Identity, data paths, sizing, key custody and the upgrade story are where a self-hosted product becomes shelfware.

    We install the product into infrastructure you control, wire it to your identity provider and your data sources, and hand over the runbook. The deployment is reproducible from configuration you own: if you rebuild it without us in eighteen months, it comes up the same.

    What you are left holding

    • A working installation in your own tenancy, air-gapped if that is what you need
    • Identity integration, role mapping and the access model written down
    • Declarative configuration you hold, from which the deployment can be rebuilt without us
    • A runbook covering upgrade, backup, restore and the failure modes we know about
    • A sizing note based on your measured volumes rather than a bracket on a price sheet
    Done when
    Your own engineer rebuilds the environment from the configuration, without us in the room, and it comes up. That is the acceptance test.
    Commercial
    Fixed fee per product, quoted before any work starts. Air-gapped installations quoted separately.
    Duration
    2–4 weeks
  4. 04

    Agent integration

    MCP servers wired into your agent estate, with the limits enforced server-side

    Why this exists

    Agent judgement degrades as the tool list grows, and MCP annotations are hints — a server can describe a destructive tool as read-only and nothing stops it. An integration that ignores either fact works in a demonstration and fails in production.

    We connect the servers you actually need to the agents that actually need them, scope each tool to what its human operator may already do, and put the enforcement in the server rather than in the annotation. Then we wire the audit trail into your own logging, so an agent action is attributable without asking us.

    What you are left holding

    • Server selection and tool scoping per agent role — sized to what the agent will actually use, not installed wholesale
    • Server-side enforcement of every read, write and act boundary, independent of client-side annotations
    • Audit records delivered into your SIEM with human identity, agent identity, arguments, authorisation context and lineage to the triggering request
    • Transport and authorisation configured to current practice, with no token passthrough
    • A written statement of what each agent can reach and what it cannot, reviewable by someone who did not build it
    Done when
    You run an agent against the estate and read the audit trail without our help, and a deliberately over-scoped request is refused by the server rather than by the prompt.
    Commercial
    Fixed fee for up to three servers, quoted before any work starts. Included with a pilot.
    Duration
    2–3 weeks
  5. 05

    Independent evaluation design

    We design the study that could show our product does not work

    Why this exists

    The best public evidence on individual wellbeing interventions finds them no better than nothing, and the usual vendor answer is a case study with a number in it. We design the study that could return a negative result, and hand it to someone who is not us.

    We design an evaluation with the outcome registered in advance, run by someone who is not us, capable of returning a negative result. You commission the evaluator directly; we supply the instrument documentation, the data extract and the methodology, and we do not see the analysis before you do.

    What you are left holding

    • A pre-registered evaluation protocol with the primary outcome and analysis fixed before data collection
    • Randomisation at the organisational unit, not the individual, where the design allows it
    • A documented data extract sufficient for an external analyst to reproduce the result
    • A written statement of what a negative result would look like, agreed before the study runs
    Done when
    The protocol is registered and the evaluator is contracted by you. What the study finds is then out of our hands, which is the entire point.
    Commercial
    Fixed fee for the design, quoted before any work starts. The evaluator is engaged and paid by you, not by us.
    Duration
    3–5 weeks to design; the study runs on its own clock
    Applies to Cadence only.
  6. 06

    Exit and migration

    Priced at zero — the exit path is part of the product

    Why this exists

    Locked question wording and proprietary formats mean leaving a vendor means losing your history. A product that is hard to leave makes every renewal conversation dishonest.

    Whenever you want to leave, we run the export with you: full history in a documented format, the instrument and question library that makes the history comparable, and a standalone decryptor for anything encrypted. We also run this on request while you are still a customer, because an exit path you have never tested is not an exit path.

    What you are left holding

    • Complete history in a documented, versioned format, with the schema published
    • The question library and instrument definitions, so longitudinal comparability survives the move
    • A standalone decryptor depending on nothing of ours, for any ciphertext we hold
    • Written confirmation of deletion from our side, and the retention we could not reach because it sits upstream
    Done when
    You read your own data back with software that is not ours.
    Commercial
    No charge, during the contract and for as long as we hold a copy for you.
    Duration
    1–2 weeks
The arrangement

What we will not do

Stated here because each of these is enforceable, and each one is how a services line stays honest.

No open-ended engagement

Every service above has an end date and a fee that does not move because the work took longer than we estimated. If we scoped it wrong, that is our error and we absorb it.

No failed pilot that becomes a subscription

There is no clause converting an unmet criterion into a paid year. The pilot fee is the whole commitment, and the criterion is agreed in writing before anything is installed.

No charging for the exit

Export costs nothing, during the contract and for as long as we hold a copy for you. A renewal conversation held with your history as collateral is not an honest one.

No grading our own homework

The evaluation service is designed so that the analysis happens somewhere we cannot see it, and the protocol fixes the outcome measure before the data exists. A study we could not lose is not evidence.

Start with the pilot

It is the one that makes sense on its own, and the rest are easier to judge once something is running.

Request a pilotAsk a question first

Hlebourg is a software design and systems consultancy in Dubai. Services are contracted from there; deployment happens wherever your infrastructure is.