Choose your scope
Start with the question you need answered.
Each review is independent, read-only and ends with findings you keep. Select a scope to see what it covers. Bounded reviews show a starting price; wider programmes are quoted after a scoping call.
Know what to fix first. And why.
10 business daysFor an established org where several issues interact and you need an independent plan before committing more budget.
- A risk-led review of one org across experience, engineering and security
- Detailed investigation of up to three priorities agreed at scoping
- A ranked list of other observed risks and a sequenced plan for next steps
- A written report and an architect-led walkthrough
A plan you own and can act on with your team or your current partner. Further deep dives are scoped separately if needed.
Allow around four to five hours across your team, plus the scoping call and read-only access setup.
No obligation
Request the full assessment.
Tell us what is happening. An architect will confirm the right scope and give you a fixed quote before any work begins.
From DKK 145,000 excl. VAT as an indicative starting price.
See an assessment we deliveredOrgs that already exist, and already hurt.
These reviews need an org to look at, so they are for platforms already running the business. Something about it is wrong, and the people who could explain it have moved on. We build new orgs too; that is a different conversation and a different shape of engagement.
You inherited it
The partner who built it has gone, or the admin who knew where everything was has moved on. It works, mostly. Nobody can tell you why.
Something is being reviewed
An internal audit, a security questionnaire from a customer, a new regulation, or a board that has started asking questions you cannot answer from the documentation.
A decision is stuck
A migration, a replatform, or an integration nobody wants to touch, with no independent read on whether the thing underneath it is sound.
Agentforce stalled
The pilot works in a demo and not on your data. The problem is almost never the agent; it is the model underneath it.
Why not just run a free scan?
You should. They are genuinely useful, they are fast, and several are free. A scanner will find your over-permissive profiles, your unused flows and your test coverage sitting suspiciously close to 75%. If that is all you need, you do not need us.
Two things a scan cannot do. The first is practical: most of them require you to connect your production org to a third-party vendor. If you are a bank, an insurer or a medical device company, that is not a quick win. It is a vendor security review of its own, and often a straight no. We work read-only, in your org, under your control, for a window you set.
The second is the whole job. A scan tells you what is there. It cannot tell you whether it would hold up: whether your sharing model can be explained to a risk committee, whether four integrations with one owner and no documentation is an acceptable risk at your size, whether that 75% is a test suite or a compliance artefact. That is judgement about a specific regulator and a specific business, and it is the part we are actually selling.
Three lenses in the full assessment.
The full assessment covers all three because they interact. A sharing model built for reporting becomes a security finding, and a security fix made in a hurry becomes an adoption problem. We screen one org for material risks across these lenses, then investigate up to three priorities agreed during scoping. If more issues emerge, we rank them and recommend separately scoped follow-up where deeper work is needed.
Experience
Where users work around the system instead of in it: shadow spreadsheets, abandoned screens, the reports nobody trusts. Adoption failures are design failures, and they show up in the data.
Engineering
Architecture, data model, sharing, test coverage, release process, and the technical debt you are paying interest on every sprint without seeing the invoice.
Security
Permissions, sharing, code and integration surface, read the way an external reviewer reads them. Our CEO is also our CISO, and that is the lens he cannot switch off.
You know what is happening at every step.
The full assessment has five checkpoints across 10 business days (about two weeks). You see the first findings halfway through and can add context before the report is final.
Before day 1
Agree the plan
A call with an architect to confirm the question, scope, fixed quote, access window and interview schedule.
Day 2
Confirm access
We confirm the read-only review is underway and raise missing access or context while there is time to resolve it.
Day 5
Share an early read
You hear what looks sound, which risks are emerging and what still needs checking. These findings are provisional.
Day 8
Discuss draft findings
We walk through the evidence with your team. You add context and correct anything we could not see from the org alone.
Day 10
Leave with a plan
You receive the final report, prioritised actions and estimated effort, followed by a walkthrough with your team.
Your team’s time: around four to five hours in total across four to six 30-minute interviews, a one-hour draft findings discussion and a one-hour final walkthrough. Allow additional time for the scoping call and read-only access setup.
Who stays with you: the architect on your first call remains involved through the review and final walkthrough. We raise urgent findings as soon as we confirm them.
A full report you keep, whatever you decide next.
- An executive summary your board or risk committee can read without a translator: what is sound, what is fragile, what is dangerous.
- The investigated findings with supporting evidence, so your admin or developer can act on them without taking our word for anything. Other observed risks are listed separately.
- A prioritised remediation plan, sequenced by risk against effort, with indicative effort for actions in the agreed scope.
- A straight answer on whether you need to change anything at all, including “no, this is in better shape than you think”, which happens.
It is yours. Take it to your current partner, use it to brief a new one, or hand it to your auditor. We would like the remediation work, but the report is not written to sell it. A report written to sell the next engagement is worth nothing to a risk committee, and they can tell.
Indicative starting price: DKK 145,000 excluding VAT for the full assessment. We agree the scope and final fixed quote before work begins, based on the size and complexity of your org. We invoice after completion, with no hourly billing during the agreed review.
A report you can act on, guaranteed.
Before we begin, we agree what the assessment will cover. Your final report will include evidence-backed findings for the agreed priorities, a clear view of other observed risks, and a prioritised plan with indicative effort for actions in scope.
If we miss an agreed area or a finding is not clear enough for your team to act on, we will put it right at no additional cost. If we cannot deliver the agreed report, we will not invoice you for the assessment.
This isn’t for you if…
- You are starting from nothing. There is no org to assess yet. Talk to us about the build instead. Architecture discipline is worth more before anything is configured than after.
- You already know what is wrong and just need hands. Skip the assessment, tell us the work, and we will quote it.
- You need a document to justify a decision already taken. We have written findings that clients did not enjoy. That is the point of an independent read, and it is the only reason the favourable ones mean anything.
- Your org is untouched out of the box. There is nothing to find yet. Come back when it has had two years and three admins.
Orgs we have been called into.
All case studies →
Eighty system administrators, and nobody had counted
An independent read on a Salesforce org that had grown for a decade. A Health Check score of 48%, more than two hundred Apex triggers, and a set of access findings the client had no way of seeing from inside.
A hundred and seventy business units, and no diagram
A marketing platform that ran a franchise network across three continents, held together by automations nobody had written down. We read all of it and drew the map.
What is a Salesforce org assessment?
It is an independent read of the org you already have. A focused review answers one agreed question with written findings. The full assessment screens one org across experience, engineering and security, investigates up to three agreed priorities in depth, then provides an executive summary, evidence-backed findings and a prioritised plan. Other observed risks are ranked for follow-up.
How long does an implementation take?
It depends on the scope, data, integrations, security requirements and availability of decision-makers. After discovery we provide a plan with phases, dependencies and milestones. Where possible, we deliver in smaller increments so evidence arrives before the whole budget is committed.
Can you take over a project that is already in progress?
Yes. We review the current solution, delivery status, documentation, risks and open decisions, then recommend whether to continue, stabilise or redesign. The first priority is to establish an evidence-based view of the project, not to defend or criticise the work that came before.
Can we start with an assessment before committing to a larger project?
Yes. An assessment is often the best first step when the symptoms are clear but the cause or priority is not. It gives you an independent view, a practical sequence of work and enough evidence to decide what to fund next.
Choose the scope that fits your question.
You do not need to prepare anything. Describe the org in a few sentences and we will tell you which review makes sense, whether or not you go ahead.