Frequently asked questions

Deploris delivers two service lines under one team: (1) hardware and infrastructure support from desktop support to data-center maintenance and (2) custom software development, including CRMs, RAG systems, AI agents and automation, and bespoke systems.

We serve businesses in the United States and Germany. All communication is available in English or German (formal Sie).

Send us your requirements via the contact form or the multi-step quote form. You receive a written scope, timeline, and price band within one business day no sales dance.

Deploris is registered as Deploris LLC in Colorado, USA (document 20268259375). For German clients we invoice and contract via that entity and offer EU-region processing where needed.

Yes. For German and EU clients the default is Frankfurt-region serverless + EU-hosted providers. US clients default to US-region. Residency is per contract.

Managed engagements default to P1 15-min response / 4-hour resolution target, P2 1-hour / 1-business-day, P3 1-business-day / 5-business-days. Infrastructure engagements target 99.9% monthly uptime for services under our operational control.

Fixed-scope projects use a written price band (e.g. $40k–$90k) with a fixed-fee structure once scope is signed. Managed-ops engagements use a monthly retainer tied to the SLA tier. Scoped-and-written response within one business day of enquiry.

Custom CRM development is designing and building a customer-relationship-management system that fits your sales process, integrations, and access-control needs, instead of forcing your team to fit off-the-shelf software.

Once per-seat licensing crosses roughly $50k–$150k per year, or once configuration work exceeds a few months per year to keep an off-the-shelf CRM aligned with your process, a custom system usually wins on 3-year TCO.

A useful first release is typically live for internal users at week 4–6 of the build. Full replacement of an existing system usually lands within 3–6 months depending on integrations and data migration.

We regularly migrate from HubSpot, Salesforce, Pipedrive, Zoho, and legacy in-house tools. Migration runs under change control with typed ETL and a reversible cutover.

Optional. Many clients take a monthly managed-ops retainer; others handle in-house and we return for scoped feature work. Either way the codebase, infrastructure, and documentation stay fully in your account.

You do. Repositories, cloud infrastructure, databases, and secrets live in your own accounts from day one. There is no shared tenant, no license lock, and no exit fee for terminating the retainer.

Email and calendar (Google Workspace or Microsoft 365), telephony and messaging (Twilio, Vonage, Slack, Teams), billing and payments (Stripe, QuickBooks, DATEV), e-signature (DocuSign, HelloSign), marketing (ActiveCampaign, Customer.io), and data warehouse (BigQuery, Snowflake, Postgres read replicas).

Role-based access control, audit logging on every write, encryption at rest and in transit, scoped API keys with rotation, OWASP ASVS checks before launch, and a security review signed off by a second engineer before each production deploy.

A one-week discovery sprint maps your sales process, data model, and integration surface, followed by a written scope with milestones, a fixed first-release date, and a weekly working session until launch. Nothing starts until you have signed off on the scope.

A RAG (retrieval-augmented generation) system grounds a large-language-model’s answers in your own documents. It retrieves the most relevant passages from your knowledge, then uses the LLM to answer using those passages and cites them so a human can verify.

Fine-tuning changes the model’s weights. RAG leaves the model as-is and instead feeds it your current documents at query time. RAG is faster to update, easier to audit, and safer for regulated content because you can prove which source drove which answer.

Only the retrieved passages that answer a specific question are sent to the model. With enterprise API tiers those passages are not used for training. If exposure must be zero, we can run the pipeline against an on-prem or EU-hosted model.

Tagged retrieval boundaries so retrieved content cannot override system instructions, system reminders at every turn, and tool-use allow-lists. Logging makes every attempt reviewable after the fact.

A labelled eval set that grows as real questions come in; retrieval precision, answer faithfulness (grounded in retrieved content), and refusal rate on out-of-scope questions. Weekly report during active engagements.

Confluence, Notion, SharePoint, Google Drive, Dropbox, S3 buckets, Postgres and MySQL databases, Zendesk and Intercom knowledge bases, GitHub wikis, PDF archives, and transcripts from Fireflies, Grain, or Otter. Every source respects its native permission model.

For actively edited sources (Notion, Confluence, Google Drive) we poll webhooks or change feeds and reindex within minutes. For slower-moving archives a nightly batch is enough. The refresh cadence is a configurable per-source policy.

Running cost scales with document volume and query load. For a knowledge base of a few hundred thousand pages served at modest query volume, infrastructure plus model inference typically lands in the low four figures per month. We publish the full cost model before you sign.

Claude (Opus, Sonnet), GPT-4-class models, Gemini, open-weights models via Together, Fireworks, Groq, and self-hosted deployments on vLLM or SGLang. The orchestration layer is model-agnostic so you can switch without rewriting the application.

An AI agent is a program that decides which tool to use, in what order, and what to do with the result to complete a task end-to-end. Good agents work under strict guardrails: a defined scope, a fixed set of tools, human-in-the-loop review at risky steps, and full logging.

We look for tasks that are repeatable, well-defined, cost measurable time, and have a clear success signal. Anything without a success signal or with high blast-radius on failure stays human-owned or gets a human-review gate.

Named scope (one-sentence job description), fixed tool list (specific APIs, specific write permissions), human review at risky steps, full trace logging of every decision and tool call, and a kill switch that stops the agent immediately.

Retrieved content is tagged as untrusted and cannot override system instructions. Tool calls run against an allow-list of exact function names and argument shapes. Any action that writes to a system of record passes through an approval queue reviewed by a human.

A pause-point in the agent run where a draft action (an email to a customer, a database write, a payment) is shown to a human in a review UI before it is executed. The agent cannot proceed until the human approves, edits, or rejects.

A dashboard shows every run, the tools it called, the arguments, the outputs, and the final decision. Errors and refusals are grouped so patterns surface quickly, and alerts fire on cost spikes, repeated failures, or any unusual escalation to a human reviewer.

Every write is reversible. The trace log identifies the exact tool call that caused the issue, we patch the scope, re-run the failing case against the eval set, and only re-enable the agent after the regression is covered.

Yes. Credentials stay in a secrets manager (AWS Secrets Manager, Vault, Doppler). The agent requests short-lived scoped tokens for each tool call and never sees the underlying secret. Access is audited per call.

Yes every managed engagement has a written SLA with response times, escalation paths, and reporting cadence.

Yes. We deliver desktop support, IMAC, break-fix, and data-center work remote-first, with on-site dispatch where physical presence is required.

Yes. We operate the technology you already own. We do not resell hardware as a primary business we advise on what to buy, but you keep the purchasing relationship.

Monitoring, patching, capacity planning, change control, and 24/7 incident response across servers, storage, networking, firewalls, and virtualization under a written SLA.

Priority-1 (business-impacting): 15-minute median first response. P2: 1-hour. P3: next business day. Resolution targets vary by contract.

Yes. We support on-prem, colo, AWS, Azure, GCP, and hybrid combinations. Infrastructure-as-code tooling (Terraform, Pulumi, Ansible) depends on client preference.

Cisco, Juniper, Aruba, Fortinet, MikroTik, pfSense, OPNsense, Ubiquiti UniFi, Meraki, and Palo Alto. Vendor-neutral we support what you own.

Every rule change is ticketed, reviewed by a second engineer, applied in a defined change window, logged, and reversible for at least 48 hours.

Yes. Deployment, policy design, and ongoing path selection + failover drills for Fortinet, Cisco Meraki, VeloCloud, Silver Peak and others.

Site surveys, staging, imaging, logistics coordination, cutover with reversible rollback plan, and post-cutover support.

Typical parallelism is 3–5 sites per week with a shared playbook; more with staged crews. All assets tagged and reconciled.

Both old and new systems ready to serve, DNS / traffic switch at a defined moment, 48-hour window during which traffic can be reverted without data loss.

Windows, macOS, Microsoft 365, Google Workspace, and identity providers Entra ID, Okta, Google. Linux desktop supported on request.

L1 first-touch (scripted) with 4-hour SLA, L2 specialist (remote) with 2-hour SLA, L3 senior (remote or on-site) with 15-minute SLA for business-impacting incidents.

Yes. On-site dispatch for anything that cannot be fixed remotely available in US and DE service regions.

Install, Move, Add, Change the everyday hardware work of installing, moving, adding, and changing endpoints, peripherals, and network gear.

Every IMAC action generates an asset-ledger entry with source location, destination, asset tag, and timestamp. Reconciled monthly against the client register.

Yes mounting, cabling, display + audio commissioning, room booking integration, and acceptance test against a written checklist.

Same-business-day 4-hour window; next-business-day 24-hour window. Weekend coverage optional per contract.

Yes a managed spare pool sized to the client fleet, with rotation policy and refresh cycle documented per contract.

Servers, network gear, endpoints, and peripherals. Vendor-specific repairs honored through our partnerships (HPE, Dell, Lenovo, Cisco, HP, Apple).

A software model of the site with AP placement, materials, and interference modeled. Catches obvious mistakes before any hardware ships.

Signal strength + SNR heatmaps, channel plan with rationale, interference report naming sources, bill of materials sized to actual load, and a roaming plan for the devices that matter.

Any time the environment has unknown interference (adjacent tenants, legacy radios, unusual materials) or when post-install SLA requires validated measurements. We recommend predictive + passive for every production deployment.

Physical tasks performed by Deploris staff on your behalf cable swaps, media insert/eject, button-press on remote console, visual inspection, photo documentation, hardware swap-in from spare.

99.95% monthly uptime target for services under our operational control, with 15-min P1 first response. Specific SLAs per contract.

Yes. Deploris operates in client-owned data centers and colos (Equinix, Digital Realty, CoreSite, Interxion, NTT, and regional providers).

An internal tool, data pipeline, SaaS backend, migration tool, or admin surface that no commercial vendor sells cleanly, built production-grade with security review and documented handover.

Buy when a commercial product covers 80%+ of the need with light config. Build when existing vendors force structural compromises or when the capability itself is a differentiator worth owning.

Written architecture decision records, test coverage on critical paths, deployment runbooks, and a documented handover session. Optional ongoing support under published SLA.

For German and EU clients, we default to EU-region processing (Frankfurt serverless functions, EU-hosted providers). For US clients we use US-region processing.

Every project ships with a data-request workflow. Article 15 (access) and Article 17 (erasure) requests are triaged within statutory windows and answered in writing.

Yes. We provide an Auftragsverarbeitungsvertrag (AVV) template compliant with GDPR Article 28 for German clients, and a standard DPA for US clients.

Hardened CSP, HSTS, Permissions-Policy, X-Frame-Options, Referrer-Policy on every public response. Server-only secret envelopes, no credentials in the client bundle.