Boulder, Colorado
IT consulting in Boulder for companies that grew faster than their controls.
Served from our Denver office at 720 S. Colorado Blvd, thirty minutes down US-36. Microsoft 365, SOC 2 readiness, and AI governance for research spinouts, funded startups, and the firms around them.
IT consulting Boulder
Boulder's density of technical talent is unusual for a city its size. CU Boulder, the federal laboratories including NIST and NOAA, NCAR, and Google's campus east of downtown all feed a steady stream of spinouts in aerospace, biotech, climate technology, and software. There are more companies here run by people with doctorates than almost anywhere.
What that produces is a specific failure pattern. A company starts as three researchers with excellent judgment about their science and no particular interest in identity management. It grows to forty people on a mixture of personal accounts, one shared admin login, and whatever SaaS someone signed up for with a company card. Then a customer asks for a SOC 2 report, or an investor's diligence checklist arrives, and none of it can be answered.
That moment is where most of our Boulder work starts. It is not a rescue, it is a maturity step, and the good news is that it is a well trodden one. We are also blunt about the parts we do not do: we are not your product security team and we will not pretend to be. We handle the corporate side, identity, Microsoft 365, device management, access governance, and the evidence, which is the bulk of what a first SOC 2 or a diligence pack actually asks about.
What we do for Boulder clients
Aimed at companies scaling through their first real compliance requirement.
- 01Microsoft 365 consultingTenant design, identity and access governance, device management, and managed services that scale with headcount.
- 02AI servicesAI governance and acceptable use, plus Copilot adoption for teams already using AI whether or not anyone approved it.
- 03IT consulting & vCIOVirtual CIO advisory for companies not ready to hire one, audit readiness, and project delivery.
What Boulder actually calls about
Spinouts, funded startups, and research adjacent businesses, in roughly that order.
- 01
A SOC 2 you promised a customer
Sales committed to a report and now the clock is running. Most of the controls an auditor tests are corporate hygiene: joiner mover leaver, access reviews, MFA, endpoint management, logging, and change records. We put those in place and produce the evidence, and we are honest that the audit itself belongs to an accredited firm rather than to us.
SOC 2Access reviewsEvidence - 02
Diligence questions nobody can answer
A term sheet arrives and with it a data room checklist covering security, data handling, and IP hygiene. Companies that cannot answer it lose weeks at the worst possible moment. Getting identity, offboarding, and repository access into order beforehand is cheap; doing it under diligence pressure is not.
DiligenceIP hygieneOffboarding - 03
Forty people and one shared admin account
The account that set everything up is still shared, and three of the people who know the password have left. This is the single most common thing we fix here. Proper administrative separation, privileged access, and a real offboarding process, done without breaking the systems that are quietly depending on that login.
IdentityPrivileged accessOffboarding - 04
AI already in use, with no policy behind it
In a town full of technical people, AI adoption is not a project you get to plan. It has already happened, in whatever tools individuals chose, occasionally with data that should not have left the building. We write governance that reflects reality, give people a sanctioned path that is actually better than the shadow one, and put the guardrails where they matter.
AI governanceShadow ITCopilot
From our Denver office down US-36
Reply to a new enquiry
No junior handoffs after the sale
Boulder, Louisville, Lafayette, Superior, Gunbarrel
Getting started in Boulder
Four steps, and the first two are usually enough to tell you what you are facing.
- 1
A conversation, not a pitch
Thirty minutes on what triggered the call, usually a customer, an investor, or an auditor. If the honest answer is that you need a specialist rather than us, we say so.
- 2
A look at the environment
Identity, tenant, device estate, SaaS sprawl, and offboarding. For a company facing an audit we map what you have against what will actually be tested, so nobody spends money on controls nobody asked for.
- 3
A plan with a number on it
Scope, sequence, timeline, and price, ordered by what your deadline actually requires. Fixed fee for defined projects, monthly for ongoing work as headcount grows.
- 4
Delivery you can watch
Work runs through our CloudGear365 client portal, and the evidence trail is built as we go rather than assembled in a panic later.
Coverage
Our nearest office is in Denver, at 720 S. Colorado Blvd, roughly thirty miles south east down US-36. Boulder is one of the easiest places for the Denver team to reach and onsite work here is routine: onboarding sessions, security workshops, and the meetings where a leadership team decides how much compliance they are actually buying.
Day to day the work runs remotely, which suits how Boulder companies operate anyway. Most of the businesses we work with here are distributed by default, with people in the office two or three days a week and the rest scattered across the Front Range and beyond, so a support model that assumes everyone is at a desk was never going to fit.
The same Denver team covers Boulder County and the US-36 corridor: Louisville, Lafayette, Superior, Gunbarrel, Erie, and Broomfield at the Denver end. If your company has a Boulder lab and a Denver office, or a Boulder office and people in three time zones, that is the normal shape here and it is designed for rather than accommodated.
No. Our offices are in Chicago and Denver, and Boulder is served by the Denver team about thirty minutes down US-36. We would rather tell you that than publish a Pearl Street address we do not sit at. Onsite work here is frequent and easy.
