PatchClock

The EU Cyber Resilience Act forces PHP vendors shipping into Europe to produce CycloneDX SBOMs, publish support periods, and file Article 14 incident reports against 24-hour, 72-hour, and 14-day clocks. PatchClock automates all four from Composer and npm lock files, so an agency can sell compliance as a recurring retainer instead of a one-off audit. The Agency plan at 79 € per month covering 20 products and 15 team members lets a single seat carry 3-5 mid-market clients.

PatchClock's pricing scales by products and seats, not by client logos, so an agency's retainer margin depends on how many client products it can stack inside one plan. The Agency plan at 79 € per month covers 20 products and 15 team members; the Studio tier sits well below that. Map each client engagement to its product count before quoting: a WordPress plugin shop shipping one plugin consumes one product slot, while a Shopware extension catalogue with six extensions consumes six. Three mid-market clients averaging five products each fit inside a single Agency seat with room to spare, which is where the margin lives. The ladder breaks when a client's product count creeps past the plan ceiling, because the next tier jump lands mid-retainer and eats the spread. Reconcile product counts at every renewal, and price the CRA Starter Setup at $2,500 against the 20h of configuration it actually takes.

Framework Portability Premium is the margin gained when one set of collected controls satisfies several certifications at once. A control mapped to SOC 2 access reviews often covers the matching ISO 27001 clause and much of a HIPAA requirement, so the second and third audit cost a fraction of the first. Agencies that treat evidence as a reusable asset price compliance retainers on framework count rather than hours, and they survive the moment a client adds a new market or regulation. The opposite posture, buying a single-framework workflow and rebuilding for each new standard, turns every expansion into a fresh delivery project. Sprinto's coverage of 200+ frameworks and Secureframe's mapping across SOC 2, ISO 27001, HIPAA, and CMMC show what portability looks like in practice. The premium is real only if the agency owns the control map, not the vendor's default template.

Evidence Decay Rate is the speed at which compliance evidence loses validity after collection. A screenshot of an access review is stale the moment permissions change; a policy PDF is outdated when the org chart shifts. Agencies that treat evidence as a one-time deliverable watch audit costs climb as auditors request fresh samples. Those that instrument continuous collection turn decay into a managed variable. The framework asks: for each control, how fast does proof expire, and what is the cost of re-collection? High-decay controls (user access, infrastructure config) need automated monitoring; low-decay controls (policy sign-off) can be batched. Platforms like Vanta and Drata pull real-time data from AWS, Okta, and GitHub, shrinking the re-collection window. Sprinto extends this to 200+ frameworks, but each added framework introduces new decay curves. Agencies that map decay rates per client can price retainers around monitoring frequency rather than audit events, converting a reactive cost into a predictable line item.

Scope PatchClock to clients with EU-market PHP or npm products and no security owner, price it as a compliance retainer, and start each engagement on the smallest plan that covers their product count.

Before committing a client's audit evidence to any compliance platform, document how controls, evidence, and reports export out of it, and price the migration into the engagement.

IF your agency delivers PHP products (WordPress plugins, Shopware extensions, Laravel SaaS) to clients selling into the EU and you need CycloneDX SBOMs, CVE alerts, and Article 14 incident drafting, THEN start on the Founding member offer at 15.83 € per month (annual billing, 3 products, 5 people, price locked while you stay) and move to the Agency plan at 79 € per month once you pass 3 products or 5 seats. IF a client needs only one product and two people, Solo at 19 € per month (15.83 € annual) covers SBOM and CVE alerts with 1,000 security emails a year. IF your client base is US-only or non-software, skip: PatchClock's value is entirely tied to CRA obligations and PHP lock-file scanning.

Stand up a repeatable PatchClock workspace that turns Composer and npm lock files into CycloneDX SBOMs, CVE alerts, support period pages and Article 14 incident drafts, then resell it as a monthly CRA compliance retainer to PHP vendors shipping into the EU.