Who holds our sites, where do our data go, who answers when something breaks ?
Past a certain level of exposure the question is no longer whether somebody is taking care of it, but what the organisation can put on the table in front of an audit committee, a large client or an inspection. A governance contract brings a register kept current, a committee that actually meets, an incident standby and a named owner.
- Contractfrom 12 000 € to 45 000 € excluding VAT a year
- Setting up90 days, first committee held
- Term12 months, billed quarterly
11committees a year
Held by the cabinet, not by youThe agenda, the chairing, the minutes and the follow-up of decisions are the cabinet's responsibility. A committee the client has to prepare does not get held.
What an inspection, an insurer or a large client asks for is not a document of intent: it is a register kept current, decisions recorded with their date and their author, and a timeline of what happened. The cabinet holds that material for you. It keeps the register of your sites, your data flows, your vendors and your artificial intelligence systems, updated at every change rather than once a year, and exportable as it stands. It holds the committee on a fixed date, four times a year at the Essential tier and eleven at the central tier, with its agenda and its minutes. It opens an incident standby with a response time written into the contract, up to four hours seven days a week, and it names the person who answers the telephone. Three published tiers, 12 000 €, 25 000 € and 45 000 € excluding VAT a year, billed quarterly, plus a bespoke tier for a group that fits none of them.
12 000 €
The floor of a governance contractexcluding VAT a year, the auditable minimum for a firm of 10 to 50
11 committees
Held by the cabinet, not by youa year at the central tier, agenda and minutes included
4 hours
Time to answer, 7 days a weekat the Board tier, with thirty incident hours included
90 days
From signature to the first committeethe register built, the committee called, the standby open
A charter documents who to blame.
It prevents neither a delivery compromised by a provider nor a client file pasted into an online tool. What an inspection asks for is not a document of intent: it is a register kept current, decisions recorded with their date and their author, and a timeline of what happened. An organisation that improvises that material after the request always produces a file that contradicts itself. One that keeps it continuously answers within two hours.
A committee that meets, a register that lives.
Agenda, chairing, decisions, minutes: held by the cabinet, on a fixed date, because a committee the client has to prepare eventually stops being held. The register of sites, flows, vendors and artificial intelligence systems is updated at every change, not once a year. Impact assessments are examined between sessions. Eleven committees a year at the Governance tier, quarterly reporting to the board at the Board tier.
Someone whose role it is to answer.
An incident standby with a response time written into the contract, up to four hours seven days a week, and an hours allowance included. Training for the teams on what can and cannot be done with online tools. A timeline kept for your executive team from the moment something happens, usable as it stands in front of an insurer or a regulator. And a named owner in the contract: the person who surveyed the estate is the person who answers the telephone.
Three published tiers, and a bespoke one
The tier follows headcount and sector, because the obligation is what forces the register, the committee and the standby. Follow the link for the detail of each one.
| Engagement | What it answers | Published price |
|---|---|---|
| Essential | Quarterly committee, register of sites, flows, vendors and AI systems, standby within 48 working hours, sixty engineer hours a year. For a firm of 10 to 50 people. See this engagement | 12 000 € / year |
| Governance | Monthly committee, eleven a year, a live register exportable for an inspection, impact assessments, standby within 24 working hours, one hundred and twenty hours a year. See this engagement | 25 000 € / year |
| Board | Fortnightly committee and an annual board session, quarterly board reporting, contractual audit of vendors, standby within 4 hours seven days a week, two hundred hours a year. See this engagement | 45 000 € / year |
| Bespoke | A multi-entity group, an international perimeter, or a need outside the three published tiers. The price follows the real perimeter, with the same clauses. See this engagement | on quote |
All prices exclude VAT, are identical for every client, and are billed quarterly in advance over twelve months. The 2 900 € sovereignty diagnostic is deducted in full from the first quarter. Outside governance the cabinet sells no hours; inside it, the published hourly rates are 150 € from 9am to 5pm on working days, 300 € after 5pm, and 450 € at weekends and on public holidays. Reversibility is owed within thirty days and is never billed.
What an audit committee will ask you, and what you can produce today
In thirty minutes the cabinet goes through the list of items an inspection, an insurer or a large client asks for, and you say which of them exist. The exercise is short and it settles the question: it shows in one session whether governance is the right level for you, or whether a diagnostic comes first.
Where do you sit
Headcount is not the only criterion. Eight people handling health data belong under governance; a hundred and twenty people with no professional secrecy and no sector regulation do not. The thirty-minute call settles the real obligation, not the size on paper.
| Your organisation | Your situation | Where it leads |
|---|---|---|
| A regulated firm not yet ready for an annual contract | The obligations of a regulated body, a headcount that does not yet justify a monthly committee. | AEO and GEO programme from 290 € excluding VAT a month |
| Firm of 10 to 50 people | The same obligations as a large group, far fewer people to keep them. | Essential tier 12 000 € excluding VAT a year |
| Mid-cap, biotech, firm of 50 to 250 people | An audit committee that raises digital risk, and clients who audit their vendors. | Governance tier 25 000 € excluding VAT a year |
| Listed company, group, organisation under supervision | Digital risk is an item on the board agenda, and an incident is counted in hours. | Board tier 45 000 € excluding VAT a year |
The objections, answered.
Three reserves come back at every conversation. Here they are, with the cabinet's answer.
We already have a data protection officer.
A data protection officer handles personal data, and that is already a great deal. A governance contract covers a wider perimeter: the sites and what they expose, the hosting and its country, the vendors and their access, the artificial intelligence systems the teams use without saying so, and the incident response. In practice the cabinet works with the officer rather than in their place: it supplies the technical register and the timeline that are almost always missing.
12 000 € a year is the cost of a part-time employee.
A part-time employee does not hold a committee on a fixed date, does not open a weekend standby and does not produce an auditable register in their first year. The price first covers what is never billed by the hour: the register kept current, the committee held, the standby available and a named owner. Sixty hours of intervention are included at the Essential tier. A single badly handled incident costs more, without counting what a large client withdraws when its vendor audit fails.
Our perimeter fits none of your tiers.
Three legal entities, four countries, two regulators: past a certain point a published tier describes nothing. The cabinet then prices on the real perimeter, with the same method, the same contractual clauses and the same hourly grid. The published price is not a ceiling, and pricing a group under it would mean taking the difference out of the quality of the work. The scoping takes two sessions before any quote.
Who actually answers
A governance contract is worth what the person who signs it is worth. The cabinet publishes who runs the engagements, which rules it imposes on itself, and what happens if the mission director is no longer available.
A first conversation of 30 minutes
No obligation, no access to your systems. We look at whether the step you are considering is the right tool for your situation, and the cabinet says no when it is not.
A signed scoping letter
The perimeter, the read-only access, the people, the delivery date and the firm price. Nothing starts before your signature.
The report, then the decision
A dated report that holds up in front of a third party, a session with your executive team, and the list of gaps ranked. You then decide what follows, or you stop there.
8 questions, 8 answers.
The cabinet's answers, in plain terms. If your question is not here, ask it: the answer comes back to you in writing.
What exactly does a digital governance cabinet do?
It keeps the register of everything your organisation runs online and holds that register current: sites, forms, data flows, hosting providers, vendors, access rights, and artificial intelligence systems if your teams use any. It then holds a committee on a fixed date, keeps an incident standby, and signs every deliverable. It is not an agency: no hours are sold outside the governance contract, and the prices are published and identical for every client.
How much does a governance contract cost, and how is it billed?
12 000 €, 25 000 € or 45 000 € excluding VAT a year depending on the tier, billed quarterly in advance over twelve months, with a bespoke tier for perimeters that fit none of the three. The 2 900 € sovereignty diagnostic is deducted in full from the first quarter.
What happens if the cabinet is no longer available?
It is written into the contract: a documentary escrow updated at every committee, a named senior freelance briefed on the file, handover guaranteed within thirty days, and data hosted either with you or on French infrastructure under contract. On VERA OS, code escrow and on-premise deployment are available at the Enterprise tier.
Where is our data hosted, and who can reach it?
With you, or on French infrastructure under contract. No transfer outside the European Union, the list of sub-processors is supplied with the contract, a processing register is kept, and everything is returned in open formats when you leave. Your documents never pass through a consumer American tool.
Which tier is right for us?
The obligation decides before the headcount does. Essential for a firm of ten to fifty people that has to produce evidence to a client or an insurer, Governance for a mid-cap or a biotech whose audit committee raises digital risk, Board for a listed company where an incident is counted in hours. Eight people handling health data belong under governance; a hundred and twenty people with no professional secrecy do not.
We do not use artificial intelligence. Does the cabinet still have something to bring?
Yes: digital governance is first about your sites, your data, your hosting providers, your vendors and your incidents. The AI part, meaning the charter, the classification of uses and the AI Act, is added only if your teams actually use such tools. The cabinet's anchor client, a listed biotech, has no AI part at all.
Can we change tier during the year?
Upwards at any committee, with the difference prorated. Downwards at the annual term, with thirty days' notice. The tier follows your headcount and sector, so a change usually follows a change in the organisation rather than a change of mind.
Is an English-language contract available?
Yes. Magnetiks Digital is a French company (SASU) and engagements are governed by French law, but an English translation of the contract set is provided and the French version prevails. A Swiss edition under Swiss law, billed in francs, exists for engagements in French-speaking Switzerland.