Let’s talk The company
Enterprise customers ask enterprise-level questions before an enterprise-sized cybersecurity team exists. Grey Wing carries the controls, evidence, and operating work those questions require.
We’re based in Sacramento, California, and work with teams anywhere.
Our mission
Every company asks to be trusted. Customers hand over their data, partners connect their systems, and buyers sign contracts on the strength of a security questionnaire and a handshake. Too often, that trust rests on promises: a policy nobody follows, a checkbox nobody verified, an answer written to close a deal.
We think trust should be earned the same way it’s tested, with real controls, clear ownership, and evidence anyone can check. That shouldn’t be a privilege reserved for companies big enough to hire a full security team. A ten-person startup answering its first enterprise review deserves the same footing as the giant it’s selling to.
So we do the work behind the answers. We set up the controls, run the systems, keep the records, and stay honest about what’s done and what isn’t. When a customer asks “can we trust you?”, our clients don’t have to hope. They can show it.
Proof over promises. That’s the whole idea.
How we work
The program stays tied to the systems, milestone, and decisions in front of your company.
We start with the system gap, deadline, or customer request you’re facing, and scope the work around it.
We carry out the agreed implementation directly with your team, in the tools and accounts behind the program: identity providers, endpoint consoles, SaaS administration, cloud accounts, code repositories, and evidence systems.
Progress reports list completed work, unresolved risk, dependencies, and the next decisions that need your input. Deliverables, configuration records, and evidence stay connected to the systems and people who will use them.
When the work calls for an independent SOC 1 or SOC 2 audit, we can introduce you to a CPA firm we know, and connect its guidance to the work in your systems.
See our partnersStrategic partner
Render Compliance
Render Compliance is a licensed CPA firm specializing in SOC 1 and SOC 2 examinations for technology companies.
Meet the team
They set up the controls, maintain employee systems, and keep the records.
Damian founded Grey Wing after more than a decade in IT and security at fast-growing fintech and SaaS companies. Most recently he was Director of Information Security at Routable, after leading IT there and at BlockFi and Funding Circle.
Eric has spent over a decade in cybersecurity, leading security at Patreon, Blockdaemon, and BlockFi. He advises Grey Wing on security strategy and how programs scale as AI changes the work.
Jason has run IT engineering and operations at Routable, Trax Retail, and Funding Circle. His work centers on Okta, device management, and IT automation.
James has built and matured security GRC programs for more than nine years, mostly at fintech companies including Gemini and BlockFi. He turns frameworks and regulations into compliance programs with the evidence to back them up.
What you can count on
The proposal spells out how we’ll work together before any work begins.
Each proposal lists the systems, deliverables, milestones, communication cadence, boundaries, and your responsibilities.
Changes that affect people, production systems, vendor contracts, or risk acceptance need your approval.
The proposal states the fee for the approved work, whether that’s a defined phase or a continuing program.
Systems or deliverables outside the agreed scope are discussed and approved before they become additional work.
Third-party costs, licenses, hardware, and specialist work are identified separately where they’re needed.
Access is requested for the approved systems and limited to the work it supports. Your team keeps control of its tenants and production decisions.
At the end of an engagement, access can be reviewed and removed according to the agreed handoff plan.
Your architecture, findings, and incident details are handled under the engagement’s confidentiality and data-handling terms.
Tell us about your systems and deadline. We’ll reply within one business day.