Baltimore runs on a few very large institutions and a long tail of companies that sell into them. That shapes what software has to do here: it has to survive a procurement process written by a hospital or a federal contractor.
A supplier has a verbal yes from a health system and then receives a vendor security assessment: where does data live, who can access it, how long is it retained, what happens on breach. The product was built without any of that documented, and the answer to several questions is uncomfortable. Retrofitting access control and audit logging into a live system while a deal waits is the expensive version of this. Building it in from the start costs a fraction and shortens every subsequent sale, because the second questionnaire reuses the first one's answers.
Typically a company of twenty to two hundred people that sells into a hospital system, a university or a federal agency, and has just been handed a security questionnaire they cannot answer. Sometimes it is a device company, sometimes a services firm, sometimes a lab. What they share is a buyer who moves slowly and asks for documentation nobody prepared.
Selling to a hospital or an agency means answering a security questionnaire. Building with access control, audit trail and data handling from the start is much cheaper than retrofitting when the questionnaire arrives.
Anything touching patient data carries obligations that shape the architecture, not just the paperwork. Getting the boundary right early avoids a rebuild.
Companies moving goods through the port face the same status-call problem as any carrier: information exists, the customer cannot see it.
Major hospital systems, research institutions, the port and a dense layer of government and defense contracting. The buyers here are institutions, and institutions buy differently than small businesses: slower, with questionnaires, and with a compliance surface attached.
A lot of the local market is oriented toward government contracting, which leaves mid-size private companies with fewer options that fit their budget and timeline.
Also worth a look: what we do by industry, which goes deeper than this page on the specifics of each sector.
We design around them from the first architecture decision: access control, encryption, audit logging, minimum necessary data, and a clear boundary about what leaves the system of record. What we do not do is act as your compliance counsel. We build to what your compliance officer specifies and document it so the next questionnaire is easier.
Yes, that is how every engagement runs. We are in Costa Rica, on Central time, so the overlap covers your whole workday. Compared to a team ten time zones away, that difference shows up in how fast decisions get made rather than in a status report.
With a call about where the work is leaking, not about technology. If what you need is a setting in a tool you already pay for, we say so. If it is a build, you get a proposal with defined deliverables and a fixed price for the work.
Tell us where the work is leaking. If the fix is something you can do without hiring anyone, we'll say that on the call.
Tell us what you need and we'll get back to you. No commitment, no sales pitch.
Salomon Web Services