Managed IT for small teams, priced per person
Three packages, one clear price per user, and the same security baseline in every one. The difference is how much support you can call on without watching a meter.
Why Space Cadets
We're a Bay Area MSP based in San Francisco — close enough that when a call isn't enough, we show up in person.
And because this business is owner-run, accountability is built in. That's not a marketing line — it's the reason we build relationships that don't require a contract to keep.
Choose the right level of coverage
Every package includes Microsoft 365 or Google Workspace administration, daily cloud backup, endpoint detection and response, email security, phish-resistant MFA, identity and endpoint hardening, and a ticket portal for support requests. Pricing is per user, per month, and is provided in your proposal. Platform licensing (Microsoft 365 or Google Workspace) is separate from the package price. Where we can, we prefer to source it for you through our distribution partners, but that isn’t required: you can also keep paying the platform directly. Either way, we administer it.
- Microsoft 365 or Google Workspace administrationSecurity settings, user management, platform configuration
- Daily cloud backupMailboxes and file storage, restore beyond the platform's 30-day window
- Phish-resistant MFA + admin MFA enforcement
- EDR — endpoint detection & responseActive threat detection on all managed endpoints
- Identity + endpoint hardeningOn both Microsoft 365 and Google Workspace
- Email securityInbound filtering, anti-phishing, impersonation protection
- Ticket portal, business hoursDocumented environment
- Support: one complimentary hour per user per month, pooled1Additional remote support billed hourly; on-site billed at standard on-site rates
- Included remote support, business hours1Documented environment
- EDR, email security, MFA enforcement, identity + endpoint hardeningFull security baseline — the same as Essential
- Microsoft 365 or Google Workspace administration + daily backupAdmin, security settings, mailbox and file-storage backup
- After-hours support available, billed if needed; on-site billed at standard on-site rates
- Data loss prevention + message-level encryption available as an add-on
- Everything in CoreIncluded business-hours remote support1, identity + endpoint hardening, full security baseline, administration + daily backup
- After-hours / weekend supportBest-effort, no additional charge
- On-site escalations includedNo additional charge for escalations that start as remote tickets
- Upgraded endpoint security / telemetry (EDR+)Expanded detection, deeper telemetry, enhanced incident response
- Data loss prevention + message-level encryptionFor outbound email, on both Microsoft 365 and Google Workspace
- Password management + security awareness trainingIncluded for every user — add-ons on Essential and Core
1. Support allowances are set out under the package comparison below.
Microsoft 365 and Google Workspace are supported at the same per-user price. We work natively in whichever platform you run — we're not asking anyone to switch.
Package comparison
| Feature | Essential | Core ★ | Core++ |
|---|---|---|---|
| Security | |||
| EDR (endpoint detection & response) | Included | Included | Upgraded (EDR+) |
| Email security | Included | Included | Included |
| Phish-resistant MFA + admin enforcement | Included | Included | Included |
| Identity + endpoint hardening | Included | Included | Included |
| DLP + message-level encryption | Add-on | Add-on | Included |
| Password management | Add-on | Add-on | Included |
| Security awareness training | Add-on | Add-on | Included |
| Platform & backup | |||
| Microsoft 365 / Google Workspace administration | Included | Included | Included |
| Daily cloud backup (mailboxes + files) | Included | Included | Included |
| Contractor Admin | Add-on | Add-on | Add-on |
| Support coverage | |||
| Remote support (business hours)1 | One complimentary hour per user per month, pooled — additional hours billed hourly | Included | Included |
| After-hours / weekend support | Billable | Billable | Included (best-effort) |
| On-site support | Billable | Billable | Escalations included |
1. How support works. Business-hours remote support is included as follows. Where there's an allowance, it's shared across your whole team, and hours beyond it are billed at the standard hourly rate.
- Essential: one complimentary hour per user per month, up to 5 hours per month in total.
- Core and Core++, under 5 users: 5 hours per user per month.
- Core and Core++, 5 or more users: no allowance and no metering.
Core++ after-hours and weekend support doesn't count toward the allowance.
Add-ons that layer onto any package
Each of these can be added or removed with the next month's invoice. Core++ already includes password management and security awareness training.
Password management
A managed password vault across the business — replaces scattered personal password managers and browser-saved credentials with one administered solution. Encrypted vault for every user, shared team folders, role-based enforcement policies, and clean offboarding: access revokes when someone leaves.
Password management — Advanced
Everything in the standard vault, plus dark web monitoring, advanced reporting and alerts, and event monitoring. Suited to teams with compliance exposure or client data to protect.
Security awareness training
Short scheduled modules and simulated phishing campaigns for every enrolled user, on a monthly or quarterly cadence, with reporting so you can see where the gaps are. Increasingly expected on cyber-insurance applications.
Endpoint & server backup and recovery
Image-level backup of managed devices and servers, with an off-site cloud copy and a restore that doesn't depend on the device being present. Separate from the Microsoft 365 or Google Workspace backup already included in every package, which covers your cloud data. If you don't add it, backing up your servers remains your responsibility.
Contractor admin
Account administration for subcontractors in your Microsoft 365 or Google Workspace environment: provisioning, enforced MFA, structured offboarding, and a documented access record. Identity and access only — not device management for contractor-owned hardware. Any licenses a contractor account needs are billed separately.
Device & infrastructure management
Network gear, servers, cameras, and door access are managed per device, per month, alongside any package.
| Managed item | Billed | Notes |
|---|---|---|
| Network devices | Updates, monitoring, and remote configuration changes. | |
| Firewall | Per device / month | |
| Switch | Per device / month | |
| Access point | Per device / month | |
| Cable modem | Per device / month | |
| Server management | Per server / month | |
| Security camera management | Per camera / month + per location / month | Per-location charge covers the NVR or cloud service. |
| Physical access management | Per location / month + per door controller or reader / month | Door controllers and readers. |
À la carte
Advisory services that sit alongside any package — or on their own.
AI consultation & enablement
Practical help getting more out of AI without putting your clients' work at risk: choosing the right tools, configuring data-privacy and retention settings, building safe prompting and workflow habits, and keeping your team current as the landscape shifts.
How onboarding works
Onboarding brings your environment to a known-good baseline. We close it out with a walkthrough of what we found, what we changed, and your next-90-day priorities.
The process is mostly remote — we coordinate any hardware-adjacent work typically as one or two focused visits, not repeated interruptions.
- Cloud platform admin + security audit — Microsoft 365 or Google Workspace, including a sharing-rule audit across SharePoint/OneDrive or Drive
- MFA rollout across all core team and active subcontractors
- Device inventory and enrollment (Mac and Windows)
- A walkthrough of findings, changes, and next-90-day priorities
How the engagement works
Payment terms
- Month-to-month — 30 days written notice at any time, no fixed-term lock-in
- Onboarding invoiced at engagement kickoff, payable on receipt
- Monthly service invoiced on the 15th, Net 15 — each invoice covers the following month of service
- Platform licensing (Microsoft 365 / Google Workspace) is separate from the per-user package price. Where we can, we prefer to source it for you through our distribution partners and bill it on our monthly invoice as its own line; if you’d rather hold the account and pay the platform directly, that works too. Either way, we administer the subscription.
- Headcount and add-on changes are reflected on the next month's invoice — no contract amendment required
Early termination
- Months 1–6: early termination fee applies, as set out in your proposal
- Months 7–12: reduced early termination fee, as set out in your proposal
- After month 12: no fee
Fees continue to accrue through the end of the notice period; the early termination fee applies in addition. Onboarding gets your environment up and running; the fee reflects the setup work we continue to put in over the first months of service — it isn't a lock-in. After month 12 the relationship stands on the work, not the contract.
As a managed client
- Priority scheduling ahead of non-contract work
- Fixed-fee quotes for out-of-scope projects, so the cost is agreed before work starts
Out of scope for the monthly fee
Referred to specialists: website security (WordPress, Drupal, and other CMS platforms) — a different discipline, and we'll refer a specialist.
Separate engagement: regulatory compliance frameworks (HIPAA, PCI, SOC 2, CCPA). If a client contract requires a formal compliance program, that's a scoped engagement separate from managed services.
Always quoted separately as project work:
- Platform migrations (Google ↔ Microsoft 365), email or domain migrations
- Major network redesign, new infrastructure installations, structured cabling
- Large-scale workstation rollouts beyond standard onboarding
- Custom scripting, development, or automation
- Security system, A/V, or camera installations (unless separately contracted)
- SharePoint/Drive restructuring or large-scale permission redesign
Project work is billed at our standard project or hourly rates as defined in your proposal or service order.
Platform choice
All three packages apply to both Microsoft 365 and Google Workspace at the same per-user price. If you run Microsoft 365, we work in the Microsoft 365 admin center, Defender for Business, Exchange Online, and SharePoint/OneDrive. If you run Google Workspace, we work in the admin console, Google's security settings, and Drive/Gmail administration. Identity and endpoint hardening (all packages) and DLP with message-level encryption (Core++) are delivered natively on each. We're not asking any client to move platforms.
We can also work a different way
Managed services suit most teams — but not everyone wants a monthly plan, and that's completely fine. If a different arrangement fits you better, we also take on consulting, one-off projects, and block-hour support, shaped around what you actually need.
Consulting
Advisory help on a specific question or decision, without an ongoing commitment.
Project engagements
A defined piece of work — scoped, planned, and handled on its own.
Block-hour support
A set of hours to draw on as you need them, instead of a monthly plan.
Ready to talk through which package fits your team?
Book a discovery call — a short conversation to walk through the package comparison, your environment, and any open questions on scope, onboarding, or pricing.