Questions answered straight

Yes. Every service publishes its fixed price and full scope, and no call is required. Checkout is hosted by TrustOps — you review your order before any payment step. You can ask us anything by email first.

TrustOps confirms your order and opens the intake form for your service. You provide the agreed inputs (for example repository access and your intended client list), we validate scope, and we confirm your start date with you during intake. If we conclude the engagement is not a fit before commencement, the amount paid is refunded in full.

If you are unsure, start with the MCP Readiness Audit (£395). It produces a severity-ranked findings report and remediation plan, and it tells you precisely whether a Migration Sprint, identity work or an Enterprise Pilot is worth buying. The free scanner also maps its findings to a recommended next step.

No. The professional services on this site are fixed-price engagements and are never discounted — the published price is the price everyone pays. Any platform credit offered elsewhere in the EcoCitizenz ecosystem applies to eligible TrustOps subscription payments only, never to these engagements.

No. Every one of the four services is a fixed-scope engagement with a defined completion: no subscription, no auto-renewal and no recurring charge is attached to any of them, and buying one never enrols you in anything ongoing. The ongoing ECZ-ID MCP packages shown lower down the page are separate optional products, priced monthly and operated by TrustOps under their own terms. They are a continuation route you choose after delivery, not part of these engagements.

Prices are shown exclusive of VAT. Any applicable VAT is calculated and shown at TrustOps checkout before you pay.

Usually not. Audits work from repository read access and configuration with secrets redacted. Implementation work happens in branches and staging environments under your control. Production access is requested only if the agreed scope requires it, with least-privilege credentials that you issue, control and can revoke — and only with explicit written authorisation.

No. EcoCitizenz is not an identity provider. The EMA/ID-JAG engagement designs and pilots authorization flows against your existing identity infrastructure — for example Okta, Microsoft Entra ID or Ping — and hands the result over to your team.

This website never writes canonical ECZ-ID state — no page, badge or scan here creates, activates or amends it. What a successful purchase does do: payment plus successful account provisioning trigger the contracted ECZ-ID backend activation path, and the backend automatically creates and activates your included Parent Business Passport entitlement. The public Resolver remains a read-only projection of proof. Payment does not verify, certify or approve you or your MCP implementation, does not complete service delivery and does not establish customer acceptance.

Every paid MCP professional service includes a 90-day Parent ECZ-ID Business Passport. Once your payment succeeds and your account is provisioned, the ECZ-ID backend automatically creates and activates the applicable included entitlement — there is no KYC, KYB, eligibility assessment, qualification, identity check, assurance step or operator approval to pass. The 90 days run from that automatic activation, and dashboard access, your Parent Resolver page, badge and QR are included. Nothing renews automatically and nothing is charged at day 91. Adding self-declared, verified, bound or referenced profile evidence is a separate, later matter — it is never created by the purchase.

The scanner is passive by design. The configuration analysis runs entirely in your browser — nothing you paste is uploaded, stored or executed. It never runs your code or packages, and any future network-based checks require your explicit consent before a single request is made. The scanner's results page states exactly what was and was not examined.

No. These services do not provide certification, regulatory approval, compliance attestation or a security guarantee — no consultancy honestly can. What you receive is documented, reproducible evidence of what was assessed, changed and verified, in a form your security and procurement reviewers can evaluate against their own standards.

No — and nobody outside Microsoft can. Microsoft operates its own MCP server certification process for its supported surfaces, and Microsoft alone decides review, approval and publication. EcoCitizenz is independent: we are not Microsoft, we do not act for Microsoft, we are not a Microsoft certification authority, and we are neither Microsoft-approved nor Microsoft-endorsed. What the £395 Readiness Audit can include, where your agreed scope and available evidence make it relevant, is an independent readiness matrix mapped against Microsoft's published requirements — publisher and package readiness, authentication, documentation consistency, telemetry and responsible-AI exposure — plus prioritised remediation guidance. That is preparation and evidence mapping, not certification, and it does not guarantee that a submission will be accepted.

MCP 2026-07-28 is a published stable specification release. It introduces a stateless protocol core, per-request version and capability metadata, server/discover, subscriptions/listen, Multi Round-Trip Requests, versioned extensions, authorization changes, caching metadata and formal feature deprecation. Ecosystem adoption varies, and clients and servers may continue to support and negotiate earlier protocol versions — publication is not a deadline, and it does not mean existing MCP servers stop working. The Audit can map your implementation's exposure to it — stateless-core assumptions, the removed handshake and protocol-level sessions, routing and version metadata, Extensions, Tasks, MCP Apps and authorization hardening — reported against the protocol revision you actually target.