IT security, operations and governance for small and mid-size companies across Europe. Structured methodology. Senior expertise. Accountable delivery.
Named after Trimontium — the Roman name for Plovdiv, "Three Hills." Every service maps to one of three pillars.
Not ready for a full audit? The IT Health Check gives you a complete picture of your IT security posture — what is working, what is not, and what to prioritise — in 5 business days for a fixed €1,800.
No retainer required. No hidden extras. If the answer is that your environment is already in reasonable shape, we will tell you that. Most clients use it as the starting point before committing to a larger engagement.
Not ready for an assessment yet? Start with our free checklist.
Small and mid-size companies facing IT compliance pressure, growth without governance, or a security incident they were not prepared for.
A specialist IT consultancy named after Trimontium — the Roman name for Plovdiv. Named for three hills; structured around three pillars of expertise. Built to last.
Trimontia takes its name from Trimontium — the Roman name for Plovdiv, meaning "Three Hills." Our name reflects our structure: three pillars of expertise, one unified consultancy, built on foundations that hold.
We are an IT security, operations and governance consultancy based in Plovdiv, Bulgaria, working with companies under 100 employees across the EMEA region. We combine deep technical expertise with structured consulting methodology — delivering the kind of work that enterprise firms charge enterprise prices for, at a price point that growing companies can actually justify.
Every engagement is led by a senior consultant from day one. Structured deliverables. Clear scope. Documented outcomes. No ambiguity about what you receive and when.
"Three hills built Plovdiv over 8,000 years — one stone at a time. Deep foundations outlast everything built on sand. We build the same way: structured, documented, defensible — so what we deliver holds up long after the engagement ends."
Every service we deliver maps to one of three pillars. Every retainer spans all three.
We work with small and mid-size companies across EMEA — typically 20 to 100 people — that face real IT security, compliance, and governance pressure but don't have the internal capacity to address it.
No risk register. No incident response plan. No internal lead who owns it — and no board-ready answer when someone asks.
The NIS2 or ISO 27001 deadline is not abstract. It is already affecting your deals.
Here is where we come in.
We bring a decade of production IT security and infrastructure experience to companies that need it most. No agency overhead. No account manager layer. No enterprise price tag.
Five sectors where we most commonly work — each with their own compliance pressures and timelines.
Primary markets we serve:
The question comes up. Here is the direct answer — and why it works in your favour.
| Trimontia | London / Amsterdam boutique | |
|---|---|---|
| NIS2 assessment | €7,500–14,000 | €18,000–35,000 |
| IT security audit | €7,500–14,000 | €20,000–40,000 |
| Monthly retainer | from €950/mo | from €3,500/mo |
| EU legal entity | ✓ Bulgarian LTD | ✓ |
| VAT-compliant EUR invoicing | ✓ | ✓ |
| Senior-led delivery | ✓ Always | Varies |
| Time zone overlap (CET) | Full day (EET) | Full day |
| Deliverable quality | Identical | Identical |
Western European pricing sourced from publicly available UK/NL consultancy rate cards, 2024–2025.
A London boutique charges London rates because it has London rent, London salaries, and London business development costs. We have the same expertise — built through the same enterprise environments — without those overheads. The saving goes directly to you.
Trimontia is registered as a Bulgarian LTD — a full EU legal entity under Bulgarian law, which is EU law. Invoices in EUR with valid VAT documentation. GDPR-compliant. No legal exposure, no cross-border complexity.
Security audits, NIS2 assessments, and IT governance work are performed remotely because the work requires admin access to your systems — not physical presence. On-site engagement adds travel cost without adding quality. We travel when it genuinely matters.
"The methodology, deliverables, and depth of expertise are identical to what a London or Amsterdam boutique would deliver — at 2–3× the price."
IT security, operations, and governance — structured as a consultancy, not an agency. Every engagement is senior-led, fixed in scope, and documented for you to own.
No retainer required. Fixed-price, fixed-scope. Agreed in writing before work begins. 40% of one-time project clients move to a retainer within 60 days — over 60% for IT Health Check clients.
Two board-ready reports from one engagement. The most common entry point for companies facing investor scrutiny and compliance pressure simultaneously.
Structured review — endpoints, identity, access, cloud — with a prioritised remediation plan your team can act on.
Gap analysis, risk register, remediation roadmap, and board-ready documentation in plain language.
EDR and email security properly deployed and tuned. Tool-agnostic — we work with your existing stack or recommend the right fit.
Every company device enrolled, compliant, and centrally managed — with full handover documentation your team can operate independently.
Governance framework for your cloud environment and AI tools — DLP, access controls, and EU AI Act-aligned acceptable use policy.
Active Directory and hybrid identity assessed, redesigned, and hardened — with full architecture documentation included.
Cloud infrastructure designed, deployed, and documented — VMs, storage, backup, disaster recovery, and networking with an operations runbook.
IT operations documented from scratch — escalation flows, incident procedures, SOPs, and leadership reporting. Everything editable.
Standalone AI governance — risk classification, data handling rules, approved tools register, and EU AI Act alignment.
Professional wireless assessment using Ekahau Sidekick — coverage heatmaps, interference analysis, full action plan. Available across EMEA. Quote on request based on site size and location.
Specific outcomes tied to specific project types. Every figure is real.
Outcomes reflect the environments and starting conditions of each engagement. Individual results vary based on your infrastructure complexity, team availability, and the current maturity of your IT setup. We provide a realistic assessment of expected outcomes before any engagement begins — never a guarantee we cannot keep.
We are an IT consulting firm. Not a helpdesk, not a managed service provider, not a software reseller. Clear scope means better outcomes for both sides.
Every service Trimontia delivers is backed by hands-on production experience — grouped by what it does.
Twelve questions we hear most often — answered plainly. If yours is not here, send it to contact@trimontia.io.
Question not answered here? Send it directly and we'll reply within 1–2 business days.
No pitch, no deck, no obligation. A short description of your situation is enough to get a meaningful first response from our team within 2 business days.
If none of the packages are quite right, or you are not sure where to start — describe your situation and we will tell you honestly what we would do about it.
Thank you for getting in touch. You'll hear from us personally within 1–2 business days.
Dutch companies face enforcement from RDI. Trimontia helps Dutch companies in fintech, logistics, healthtech, software close their NIS2 gap — gap analysis, risk register, and board-ready report. Fixed fee, 3–5 weeks, remote.
The Netherlands implemented NIS2 (Wet beveiliging netwerk- en informatiesystemen 2) in October 2024. The Dutch Rijksinspectie Digitale Infrastructuur (RDI) is the primary supervisory authority. Dutch SMBs in energy, finance, healthcare, logistics, and digital infrastructure are in scope.
All deliverables provided in English. Dutch-language executive summaries available on request.
Need both a security audit and NIS2 assessment? The Security + NIS2 Bundle (€12,000–22,000) combines both into one engagement and is the most common entry point for companies facing investor or enterprise client pressure.
German Mittelstand faces BSI enforcement. Trimontia helps German companies in manufacturing, automotive supply chain, healthcare, software close their NIS2 gap — gap analysis, risk register, and board-ready report. Fixed fee, 3–5 weeks, remote.
Germany implemented NIS2 through the NIS2UmsuCG (NIS2-Umsetzungs- und Cybersicherheitsstärkungsgesetz) in October 2024. The BSI (Bundesamt für Sicherheit in der Informationstechnik) is the supervisory authority. German Mittelstand companies in critical sectors face mandatory registration and incident reporting.
All deliverables provided in English. German-language executive summaries available on request.
Need both a security audit and NIS2 assessment? The Security + NIS2 Bundle (€12,000–22,000) combines both into one engagement and is the most common entry point for companies facing investor or enterprise client pressure.
Swedish companies in scope from January 2025. Trimontia helps Swedish companies in energy tech, healthtech, fintech, SaaS close their NIS2 gap — gap analysis, risk register, and board-ready report. Fixed fee, 3–5 weeks, remote.
Sweden implemented NIS2 (Lag om cybersäkerhet) in January 2025. NCSC-SE (Swedish National Cyber Security Centre) and sector-specific authorities oversee enforcement. Swedish companies in energy, digital infrastructure, healthcare, and financial services are in scope.
All deliverables provided in English. Swedish-language executive summaries available on request.
Need both a security audit and NIS2 assessment? The Security + NIS2 Bundle (€12,000–22,000) combines both into one engagement and is the most common entry point for companies facing investor or enterprise client pressure.
Belgium implemented NIS2 early — CCB is active. Trimontia helps Belgian companies in financial services, logistics, healthcare, public sector suppliers close their NIS2 gap — gap analysis, risk register, and board-ready report. Fixed fee, 3–5 weeks, remote.
Belgium implemented NIS2 (Wet van 26 april 2024) in April 2024 — one of the earliest adopters in the EU. The CCB (Centre for Cybersecurity Belgium) is the national authority. Belgian companies have had the shortest runway and face active enforcement.
All deliverables provided in English. French or Dutch executive summaries available on request.
Need both a security audit and NIS2 assessment? The Security + NIS2 Bundle (€12,000–22,000) combines both into one engagement and is the most common entry point for companies facing investor or enterprise client pressure.
CFCS actively supervises Danish NIS2 compliance. Trimontia helps Danish companies in energy, maritime, pharma, fintech close their NIS2 gap — gap analysis, risk register, and board-ready report. Fixed fee, 3–5 weeks, remote.
Denmark implemented NIS2 (Lov om net- og informationssikkerhed) in November 2024. The Danish Centre for Cyber Security (CFCS) oversees implementation. Danish companies in energy, digital infrastructure, healthcare, and financial sectors are in scope.
All deliverables provided in English. Danish-language executive summaries available on request.
Need both a security audit and NIS2 assessment? The Security + NIS2 Bundle (€12,000–22,000) combines both into one engagement and is the most common entry point for companies facing investor or enterprise client pressure.
Plain-language guides on NIS2, IT security, and governance for European SMBs. No jargon. No vendor pitch.
NIS2 has been enforceable since October 2024. Most SMBs are still working through it. Here is a plain-language checklist of every requirement — and what having it in place actually looks like.
Companies often ask whether they need a security audit, a NIS2 assessment, or both. The answer depends on where you are and what is driving the need. Here is the honest breakdown.
The Netherlands transposed NIS2 in October 2024. RDI is the supervisory authority. Here is what Dutch SMBs in healthcare, fintech, and logistics need to do — and by when.
Enterprise procurement teams are sending longer security questionnaires before signing. Here is what they are actually asking, what they want to see, and how to prepare your answers.
The EU AI Act is in force. Most SMBs using AI tools have real obligations they are not aware of. Here is a plain-language breakdown of risk categories, prohibited uses, and what to put in place.
Not every company needs a full security audit straight away. For companies that are not sure where to start, the IT health check is a structured, low-commitment way to get a clear picture in 5 days.
8 min read · Originally June 2025 · Reviewed June 2026 · By Aleksandar Sevriyski
NIS2 (Network and Information Security Directive 2) became enforceable across the EU in October 2024. If your company operates in a covered sector — energy, healthcare, logistics, financial services, digital infrastructure, or software — you have obligations. Most SMBs are still working through what those obligations actually mean in practice. This checklist covers every major requirement in plain language.
NIS2 covers two categories of entities: essential entities (large companies in critical sectors) and important entities (medium companies in the same sectors). If your company has more than 50 employees and €10M in annual revenue, and operates in a covered sector, you are likely in scope. If you are a supplier to a covered entity — even if you are smaller — you may also be in scope through supply chain obligations. When in doubt, assume you are in scope and verify with legal counsel.
NIS2 requires that senior management takes responsibility for cybersecurity. This means: board-level sign-off on your security policies, named accountability for incident reporting, documented security objectives, and a process for regular review. This is not optional — personal liability for senior managers is one of the enforcement mechanisms in NIS2.
You need a documented risk management methodology — not just a risk register, but a defined process for identifying, assessing, and treating risks. This includes: a risk register with all identified risks, a risk treatment plan with named owners and deadlines, and a process for reviewing and updating the register when your environment changes.
NIS2 sets strict incident reporting timelines: 24 hours for an early warning to your national authority, 72 hours for a full incident notification, and 1 month for a final report. You need a documented incident response procedure, defined escalation paths, and evidence that your team knows what to do and how fast. The reporting obligation is not optional and the timelines are tight.
The directive requires appropriate and proportionate technical controls. In practice, this means: MFA on all admin accounts, endpoint protection (EDR) deployed and monitored, patch management with documented SLAs, network segmentation where appropriate, encrypted data at rest and in transit, and access control reviews at least annually.
NIS2 extends to your suppliers. You need to assess the security posture of third-party suppliers who have access to your systems or data, include security requirements in supplier contracts, and have a process for reviewing supplier risk. This is one of the most overlooked requirements — and one of the most frequently cited in enforcement actions.
If you are not sure where you stand, an IT Health Check (€1,800, 5 days) gives you a structured picture of your current state across the main NIS2 control areas. A full NIS2 Readiness Assessment (€7,500–14,000, 3–5 weeks) delivers the complete gap analysis, risk register, and board-ready report your company needs to demonstrate compliance to regulators and enterprise clients.
6 min read · Originally May 2025 · Reviewed June 2026 · By Aleksandar Sevriyski
Companies regularly ask whether they need a security audit, a NIS2 assessment, or both. The short answer: they are different things, they serve different purposes, and many companies benefit from both — which is why we offer a bundle. Here is the honest breakdown of what each delivers.
A security audit is a technical assessment of your current security posture. It covers endpoint protection, identity and access controls, cloud configuration, email security, and network perimeter. The output is a prioritised list of findings — every gap ranked by severity with a specific, actionable fix. It answers the question: what are the technical weaknesses in my environment right now, and what should I fix first?
A NIS2 readiness assessment is a compliance-framing exercise. It maps your current state against every applicable NIS2 requirement — governance, risk management, incident response, supply chain, and technical controls — and produces a gap analysis with a RAG rating per requirement. The output is a board-ready report suitable for leadership, regulators, and enterprise clients who ask for evidence of NIS2 compliance. It answers the question: where do I stand against the directive, and what do I need to document?
Both assessments look at technical controls — endpoint coverage, MFA, patch management. A security audit typically goes deeper on the technical side. A NIS2 assessment covers more governance and process ground. A company that does both avoids duplication by using the same discovery work to power both outputs, which is why the bundle (€12,000–22,000) is more cost-efficient than commissioning them separately.
If you are facing a specific regulatory deadline or an enterprise client asking for NIS2 evidence — start with the NIS2 assessment. If you are concerned about your technical security posture and want to understand and fix specific vulnerabilities — start with the security audit. If both apply — which is common for companies under investor scrutiny or preparing for enterprise sales — the bundle is the most efficient path.
The IT Health Check (€1,800, 5 days) is designed for exactly this situation. It gives you a structured picture of your environment and a clear recommendation on which engagement makes sense for your situation — without committing to a larger scope before you know what you need.
7 min read · Originally April 2025 · Reviewed June 2026 · By Aleksandar Sevriyski
The Netherlands transposed NIS2 into Dutch law through the Wet beveiliging netwerk- en informatiesystemen 2 (Wbni 2), which came into force in October 2024. The Dutch Rijksinspectie Digitale Infrastructuur (RDI) is the primary supervisory authority. Here is what Dutch SMBs need to know.
NIS2 applies to Dutch companies that operate in covered sectors and meet the size thresholds: essential entities (250+ employees or €50M+ revenue in critical sectors) and important entities (50–249 employees or €10–50M revenue in covered sectors). Covered sectors in the Dutch context include energy, water, transport, banking, financial market infrastructure, healthcare, digital infrastructure, ICT service providers, public administration, and space. If you supply to any of these sectors, you may also be caught through supply chain obligations.
The RDI has been clear that it expects organisations to: register their NIS2 status proactively, implement a risk-based security framework, document their incident response procedures, and demonstrate supply chain due diligence. RDI has the power to impose fines of up to €10M or 2% of global turnover for essential entities, and €7M or 1.4% for important entities.
Dutch fintech and financial services companies face dual obligations — NIS2 and DORA (Digital Operational Resilience Act) for financial sector entities. If you fall under both, there is significant overlap in the technical requirements. A properly scoped NIS2 assessment can be structured to cover DORA-relevant areas simultaneously, avoiding duplication.
Registration obligations came into force in October 2024. RDI has indicated that enforcement will be proportionate but active — particularly for companies that have made no visible effort to assess their NIS2 position. The window for a "we did not know" defence is closed.
If you are a Dutch company in scope and have not yet assessed your NIS2 position, the starting point is a gap analysis against the directive requirements. Trimontia delivers NIS2 readiness assessments for Dutch companies — gap analysis, risk register, and board-ready report — in 3–5 weeks at a fixed fee of €7,500–14,000. All deliverables in English; Dutch-language executive summaries available on request.
9 min read · Originally March 2025 · Reviewed June 2026 · By Aleksandar Sevriyski
If you sell software or IT services to enterprise clients — banks, insurers, healthcare systems, logistics operators — you have almost certainly received a security questionnaire before a contract was signed. These questionnaires are getting longer, more specific, and more consequential. Here is what enterprise procurement teams are actually asking, and how to prepare.
NIS2 has supply chain obligations. Enterprise companies in covered sectors are now contractually and regulatorily required to assess the security posture of their suppliers. This means your enterprise clients are not asking out of curiosity — they are doing it because their legal team, their compliance team, or their insurer is requiring it. The volume and detail of these questionnaires will increase, not decrease.
The most common question categories: do you have a documented information security policy? Is MFA enforced on all systems that access client data? How do you manage and apply patches? What is your incident response and notification procedure? Do you encrypt data at rest and in transit? Have you completed a security assessment in the last 12 months? Are you NIS2 compliant? The last question is appearing more frequently in 2025.
Enterprise security teams read hundreds of questionnaires. They know the difference between a genuine answer and a copy-paste response. A good answer is specific, evidenced, and proportionate. "We use MFA" is weak. "We enforce MFA via Microsoft Entra ID Conditional Access policies across all admin and user accounts; MFA coverage is reviewed quarterly" is strong. Evidence — a screenshot of your policy, a certificate, a recent assessment report — always outperforms a text answer.
An IT security audit gives you the technical foundation — documented findings, remediation actions, and a before/after comparison you can reference. A NIS2 assessment gives you the compliance framing. A completed security assessment report is the single most useful document you can attach to a vendor questionnaire. It answers dozens of questions at once and signals to the procurement team that you take security seriously.
Companies that can answer vendor security questionnaires confidently and completely win contracts that others lose. This is not theoretical — we have seen it happen with clients who went through a security audit and subsequently closed enterprise deals that had stalled on security due diligence. The audit paid for itself in the first contract it enabled.
10 min read · Originally February 2025 · Reviewed June 2026 · By Aleksandar Sevriyski
The EU AI Act entered into force in August 2024 and is being phased in through 2026. Most coverage focuses on large AI providers and high-risk AI systems. But SMBs using AI tools — Copilot, ChatGPT, AI in HR, AI in customer service — have real obligations too. Here is a plain-language breakdown of what applies to you.
The EU AI Act classifies AI systems into four risk categories. Unacceptable risk — prohibited entirely: social scoring, real-time biometric surveillance in public spaces, subliminal manipulation. High risk — subject to conformity assessment and documentation requirements: AI in HR decisions, AI in credit scoring, AI in healthcare diagnostics, AI in critical infrastructure. Limited risk — transparency obligations: chatbots must identify themselves as AI. Minimal risk — everything else: most productivity AI tools like Copilot fall here, with minimal obligations.
If you are using Copilot, ChatGPT, or similar tools for productivity, writing, or analysis — you are likely in the minimal risk category. Your obligations are: tell employees they are interacting with AI where relevant, do not use AI-generated content to deceive users in harmful ways, and keep track of what AI systems you are using and for what purpose. An approved-tools register is the practical starting point.
The risk increases when AI is used in HR decisions (screening CVs, assessing performance), customer-facing decisions (pricing, credit, service eligibility), or healthcare contexts. If you are building AI features into your product that affect users in these ways, you are in high-risk territory and need conformity assessment documentation, human oversight mechanisms, and accuracy monitoring. If you are unsure which category applies to your use case, an AI governance assessment will map it clearly.
Build an AI tools register — list every AI tool your company uses, who uses it, and for what purpose. Classify each tool by risk category. For any high-risk use case, document your human oversight mechanism. Draft an AI acceptable use policy — what employees can and cannot use AI for, especially for client-facing work and personal data. Review your data handling practices for AI tool inputs — what data is going into these tools, and is that consistent with your GDPR obligations?
If you are in a NIS2-covered sector, the EU AI Act governance requirements layer on top of your NIS2 obligations. A combined AI governance and NIS2 assessment is significantly more efficient than addressing them separately. Trimontia delivers AI governance frameworks aligned to the EU AI Act — risk classification, data handling rules, approved-tools register — in 5–8 weeks at a fixed fee of €9,000–22,000.
5 min read · Originally January 2025 · Reviewed June 2026 · By Aleksandar Sevriyski
An IT health check is a structured, time-limited assessment of your company's current IT security posture. It is designed for companies that know they should be doing more on security and compliance — but are not yet sure where to focus or whether a larger engagement is justified.
In 5 business days, a health check assesses: Microsoft 365 and cloud configuration — admin setup, sharing controls, and obvious security gaps. Endpoint coverage — are all devices enrolled and managed, and is the right tool running on them? Identity and access — admin privileges, MFA status, stale accounts. Email security — SPF, DKIM, DMARC, and anti-phishing configuration. NIS2 and ISO 27001 exposure — are you likely in scope, and what is the gap roughly? The output is a one-page security posture summary, a list of the top 3–5 priority actions ranked by risk and effort, and a 30-minute debrief call.
A health check is not a full security audit — it does not go deep on penetration testing, network architecture, or detailed technical configuration. It is not a NIS2 assessment — it does not produce the gap analysis, risk register, and board-ready documentation that NIS2 compliance requires. It is a structured starting point, not an end state.
The IT health check is designed for three situations: companies that have never had an external security assessment and want to understand their baseline before committing to a larger engagement. Companies that have recently changed their IT environment — new cloud tools, new staff, new processes — and want a quick check that nothing obvious has been missed. Companies that are early-stage and want to establish a security baseline before they start handling sensitive client data.
If you have never had an external security assessment, you almost certainly need one. The health check exists precisely because a full audit feels like a large commitment when you are not sure what you will find. The health check removes that uncertainty — after 5 days, you will know whether your environment is broadly in good shape, or whether there are specific areas that need attention. If the answer is that you are in good shape, you will have documented evidence of that. If there are gaps, you will know exactly what they are and what to do about it.
Monthly retainers with structured deliverables. Fixed-price projects. Every engagement starts with a signed scope. All prices in EUR, invoiced monthly in advance.
Monthly rolling contracts. Cancel with 30 days written notice. All tiers include an onboarding baseline report within 7 days of signing.
All retainers: Monthly rolling · 30 days written notice to cancel · Unused hours do not roll over · Overage: €150/hr (business hours) · Out-of-hours: €210/hr (Tier 3) / €240/hr (Tier 4) on prior written approval · Discounts available — see below.
Advisory hours are async time answering your specific IT or security questions — via email or Slack — on your schedule. They are not on-site hours. Unused hours do not roll over to the next month.
Every discount is designed to reward a specific behaviour — longer commitment, faster payment, introductions, or bundling. No discounts are given without a reason, and none are stackable beyond what is stated.
Fixed reports, fixed deadlines, a published response SLA that is contractually honoured. A substantive reply — not an automated acknowledgement — every business day.
| Tier | Monthly Fee | Response SLA | Advisory Hours |
|---|---|---|---|
| Enterprise Guardian | €5,000/mo | Same business day | ~10h/mo |
| Fractional IT Lead | €3,500/mo | Next business day | ~7h/mo |
| IT Co-Pilot | €1,900/mo | 2 business days | ~4h/mo |
| Security Watch | €950/mo | 3 business days | ~1.5h/mo |
Response means a substantive reply — not an auto-acknowledgement. SLA runs Mon–Fri CET. Advisory hours are included in the monthly fee; overage at €150/hr (business hours). Out-of-hours emergency advisory available on request for Tier 3 at €210/hr, Tier 4 at €240/hr — prior written approval required.
All project engagements are fixed-price, fixed-scope. Agreed in writing before work begins. Most clients who don't act on NIS2 or ISO 27001 findings spend more correcting the same gaps 12 months later.
Effective 1 June 2026 · Trimontia LTD · Plovdiv, Bulgaria
These Terms govern all services provided by Trimontia LTD, a limited liability company registered in Plovdiv, Bulgaria ("Trimontia", "we", "us") to its clients ("Client", "you").
By signing a Statement of Work or Master Services Agreement referencing these Terms, or by commencing an engagement, the Client agrees to be bound by these Terms.
Trimontia provides IT security consulting, governance advisory, infrastructure consulting, and related professional services as specified in a signed Statement of Work (SoW). Work begins only after a signed SoW is in place. Work outside the agreed SoW requires a written Change Request signed by both parties before it commences.
Trimontia does not provide: Level 1 IT helpdesk; 24/7 security operations centre or continuous monitoring; legal advice; software or hardware procurement; or managed IT services — unless separately and specifically agreed in a signed SoW.
Retainers: Invoiced monthly in advance on the 1st of each month. Payment due within 14 calendar days. Unused advisory hours do not carry over.
Projects: 40% of the total fee invoiced on contract signing. 60% invoiced on delivery. Payment due within 14 calendar days of each invoice.
Overage: Time in excess of the agreed monthly allocation is billed at €150/hour (standard, business hours). Out-of-hours emergency advisory is available on request for Tier 3 at €210/hour and Tier 4 at €240/hour, subject to prior written approval. Overage is added to the following month's invoice.
Currency: All fees invoiced in EUR. Wire transfer to the account specified on the invoice.
Late payment: Invoices unpaid after 30 calendar days accrue interest at 0.5% per month on the outstanding balance. Trimontia reserves the right to suspend services for accounts more than 30 days overdue.
Monthly retainer agreements may be cancelled by either party with 30 calendar days' written notice. The Client remains liable for retainer fees accrued during the notice period.
Upon full payment, all client-specific deliverables become the property of the Client. Trimontia retains ownership of all methodologies, templates, frameworks, and processes used to produce deliverables.
Both parties agree to hold in strict confidence all non-public information disclosed by the other party. This obligation continues for three (3) years after termination of the engagement.
A Data Processing Agreement (DPA) is signed before any system access is granted. All access is scoped to what is strictly necessary, MFA-protected, logged, and revoked immediately upon engagement completion or at the Client's request.
Trimontia's total cumulative liability shall not exceed the total fees paid in the three (3) months immediately preceding the event giving rise to the claim.
Trimontia shall not be liable for indirect, consequential, special, or punitive damages.
These Terms are subject to the laws of the Republic of Bulgaria. Disputes are submitted first to good-faith mediation, then to the competent courts of Plovdiv, Bulgaria.
Questions regarding these Terms: contact@trimontia.io
Trimontia LTD · Plovdiv, Bulgaria · Effective 1 June 2026
Effective 1 June 2026 · Trimontia LTD · Plovdiv, Bulgaria
Data controller: Trimontia LTD, Plovdiv, Bulgaria.
Contact: contact@trimontia.io
This Privacy Policy explains what personal data we collect, why we collect it, how we use it, and your rights under GDPR and applicable Bulgarian data protection law.
What: Name, work email, company name, and message content from our contact form.
Why: To respond to your enquiry and deliver requested services.
Legal basis: Legitimate interests (responding to a business enquiry); performance of a contract where services are engaged.
What: Contact person names and emails, contractual information (MSA, SoW, invoices), and any data shared to enable delivery of agreed services.
Legal basis: Performance of a contract.
This website does not use cookies, tracking scripts, or third-party analytics. Contact form submissions are transmitted over HTTPS to our own API (api.trimontia.io), hosted on Cloudflare Workers, and stored in a Cloudflare D1 database within Cloudflare's infrastructure. Confirmed enquiries may trigger a notification email via Brevo (brevo.com). See Cloudflare's privacy policy at cloudflare.com/privacypolicy and Brevo's at brevo.com/legal/privacypolicy.
Enquiry data (no contract): Deleted within 12 months of last contact.
Client data (active engagement): Retained for the duration of the engagement plus 5 years for statutory compliance.
System access credentials: Revoked immediately upon engagement completion.
We do not sell or rent personal data. We share data only where strictly necessary with: Cloudflare Inc. (infrastructure — Workers API, D1 database, hosting); Brevo SAS (transactional and marketing email delivery); our accountant (invoicing data for statutory compliance); law enforcement where required by law or court order.
Where Trimontia accesses or processes the Client's personal data, a DPA is signed before any access is granted. The DPA governs categories of data accessed, purpose, security measures, sub-processors, and deletion obligations.
Contact contact@trimontia.io to exercise any right. We respond within 30 calendar days.
Request a copy of the personal data we hold about you.
Ask us to correct inaccurate or incomplete data.
Ask us to delete data where there is no lawful basis for continued processing.
Suspend processing while a dispute is resolved.
Receive your data in a structured, machine-readable format.
Object to processing based on legitimate interests.
We apply MFA on all business accounts, end-to-end encryption where applicable, and minimum necessary access to all data. Data breaches are reported to the CPDP within 72 hours and to affected individuals where required.
If unhappy with how we handle your data, contact contact@trimontia.io. You may also lodge a complaint with the Bulgarian supervisory authority: CPDP — www.cpdp.bg.
Material changes notified to active clients by email at least 14 days before taking effect.
Trimontia LTD · Plovdiv, Bulgaria · Effective 1 June 2026 · contact@trimontia.io
Access your retainer progress, projects, invoices, and documents. All in one place.
Forgot your password?
Restricted access. This login is not linked publicly from the website.
Not a Trimontia team member?
| Client | Tier | MRR | Since | SLA | Health | Last report |
|---|
| Company | Country | Stage | Est. value | Last contact | Next action |
|---|