Services
Managed IT, 24x7 NOC, cloud, virtual desktops & managed AI
White-glove IT operations, around-the-clock network management, private cloud and virtual desktops, managed enterprise AI, and compliance-grade data protection, built for SEC and FINRA-regulated firms.
White-glove IT operations
Helpdesk, endpoints, M365 or Google Workspace, communications, backup, onboarding, procurement, and vCIO advisory in one per-user subscription.
Managed network & monitoring
Around-the-clock monitoring, remediation, and optimization of firewalls, switches, wireless, and SD-WAN at every site.
Managed security services
One platform: 24/7 MDR, SentinelOne EDR, Duo, email security, cloud and identity protection, SIEM, and Suricata NIDS, aligned to NIST CSF, ISO 27001, and MITRE ATT&CK.
Hosting, continuity & projects
Option One Virtual Private Cloud with East-to-West replication and a 99.99% uptime SLA, managed Azure, AWS and AI platforms, plus fixed-scope onboarding and security projects.
Fixed-scope or SOW-based · onboarding often waived on annual agreements
Everything one per-user subscription covers
A managed seat is not just a helpdesk number. It is the full operational surface of a regulated firm's technology: records and retention, investor collaboration, communications, data protection, hardware, joiners and leavers, the applications your investment team lives in, and the advisory layer above all of it.
Helpdesk & endpoint management
- Live helpdesk with named-engineer follow-through, 8x5 or 24x7x365
- L1 triage, L2 engineering, L3 senior escalation
- Continuous RMM monitoring of endpoints, servers, and cloud
- Bi-weekly operating system and third-party application patching
- Endpoint hardening, encryption enforcement, and policy drift correction
Purview compliance & records
- Microsoft Purview archiving and immutable journaling configuration
- Retention policies mapped to FINRA 4511, SEA 17a-4, and Advisers Act 204-2
- eDiscovery and legal hold administration for counsel and examiners
- Supervision and review workflows for regulated communications
- Retention reporting that separates vendor-side from firm-side capture
Investor & anchor-LP collaboration
- Secure SharePoint collaboration sites for anchor LPs and investors
- Dedicated data rooms with per-document permissions and expiry
- Guest and external-sharing governance with access reviews
- Secure tunnels and site-to-site connectivity for LP and administrator systems
- Managed file transfer for fund administrators and auditors
Communications & voice
- Managed Microsoft 365 or Google Workspace tenant administration
- Microsoft Teams Phone with domestic and international calling plans
- Zoom and RingCentral administration, provisioning, and call routing
- Conference room and trading-floor audio-video support
- Mobile device enrollment and secure email on personal devices
Data protection & continuity
- Managed backups with daily verification and monthly restore tests
- Microsoft 365 and Google Workspace backup, per user
- Server and virtual machine application-consistent backups
- Encrypted cloud backup repository with immutable options
- Documented recovery runbooks and annual DR validation
Asset lifecycle & procurement
- Full asset inventory with warranty, age, and refresh tracking
- Curated Lenovo ThinkPad catalog with Premier Support
- Standard images, encryption, and security agents pre-installed
- Direct-to-employee shipping with tracked deployment
- Secure decommissioning, wipe certificates, and disposal
Onboarding & offboarding
- Same-day new-hire provisioning: identity, mailbox, MFA, applications, hardware
- Standardized checklists per role and per business unit
- Immediate offboarding with credential revocation and session termination
- Mailbox and data preservation for departed employees
- Documented evidence for access-control audits
Line-of-business applications & vCIO
- Bloomberg, OMS, EMS, PMS, CRM, and accounting application helpdesk
- Vendor liaison and escalation on your behalf
- Trading platform and market-data connectivity support
- Technology roadmap, budget forecasting, and refresh guidance
- Executive checkpoints and quarterly business reviews
What a managed engagement includes
The same commitments, in writing, for every client.
- A named engineering team that knows your environment, not a rotating queue
- Documented escalation from L1 triage to L2 engineering to L3 senior engineers
- Contractual SLAs with a 20-minute Priority 1 acknowledgement
- Licenses from Microsoft, Google, and hardware vendors passed through at cost with no markup
- One Master Services Agreement with a single ordering document per service line
- Quarterly compliance reporting and vCIO roadmap sessions with your leadership
Choose the coverage, then extend it where you need to
| Essentials · 8x5 | Advanced · 24x7 | |
|---|---|---|
| Helpdesk coverage | Mon–Fri, 8 AM to 6 PM | 24x7x365 incl. nights, weekends, holidays |
| Environment monitoring | Business-hours response to alerts | 24/7/365 endpoint, server, and cloud monitoring |
| Patching | Bi-weekly OS and third-party | Bi-weekly OS and third-party |
| Compliance reporting | Quarterly | Quarterly plus executive checkpoints |
| Mobile device management | Add-on | Included via Intune, Jamf, or Kandji |
| Trading platform & OMS support | Helpdesk support | Deeper integration and escalation support |
| vCIO roadmap & budgeting | Annual review | Roadmap, forecasting, and quarterly business reviews |
| P1 acknowledgement | 20 minutes | 20 minutes |
Managed IT add-ons
Disaster recovery testing
Scheduled failover and restoration exercises with audit-ready results, run annually or semi-annually.
Business continuity tabletop
Facilitated continuity simulation with an executive summary and prioritized recommendations.
Onsite technician days
Scheduled or on-demand onsite engineering for builds, moves, events, and hands-on troubleshooting.
Mobile device management
Intune, Jamf, or Kandji management for iOS, Android, and company-owned devices, per device.
Managed antivirus
Managed AV for firms not on the Apollo SOC endpoint stack, per endpoint.
Managed print services
Printer and copier monitoring, driver management, and vendor coordination, per device.
Office build-out & relocation
Cabling, network and rack design, AV, and trading-desk setup delivered as a fixed-scope project.
After-hours project work
Migrations, cutovers, and maintenance scheduled outside business hours to avoid trading impact.
Onboarding & implementation
| Microsoft 365 tenant setup | Tenant build, identity and MFA, mail flow, licensing, security baseline, and migration from the incumbent platform |
| Purview configuration | Archiving, journaling, retention policies, legal hold, eDiscovery, and supervision workflows |
| Anchor-LP secure tunnel | Site-to-site or point-to-site connectivity to anchor LP, administrator, or counterparty systems |
| Endpoint & server onboarding | Agent deployment, imaging, encryption, patch baseline, and documentation of the estate |
| Network & site onboarding | Firewall, switch, wireless, and SD-WAN discovery, configuration backup, and monitoring enrollment |
| Hardware provisioning | Curated Lenovo catalog, Premier Support, standard imaging, and direct-to-employee shipping |
Onboarding is quoted as a fixed-scope project and is frequently waived on annual agreements.
Watch, Manage, Optimize
Three levels of network ownership. Watch gives you eyes on glass around the clock, Manage hands us the operations, and Optimize adds SD-WAN performance engineering and continuity assurance.
| Capability | Watch | Manage | Optimize |
|---|---|---|---|
| Monitoring & visibility | |||
| 24/7 up/down monitoring with alerting to your team | |||
| Asset tracking and inventory reporting | |||
| Automated daily configuration backups | |||
| Quarterly scheduled firmware updates | |||
| Bandwidth, latency, and capacity trend reporting | |||
| Remediation & management | |||
| Unlimited remediation of network outages | |||
| Unlimited firewall rule, VLAN, and SSID changes | |||
| Managed firewall web-content filtering and threat prevention | |||
| Vendor liaison: ISP, Cisco, Meraki, Fortinet, Palo Alto | |||
| Wireless survey and RF optimization | Annual | Semi-annual | |
| Performance & continuity | |||
| SD-WAN traffic shaping, jitter correction, multipath routing | |||
| Annual network failover testing with validation reports | |||
| Yearly vCIO capacity and lifecycle review | |||
| Priority SLA engineer response | 30 min notify | 20 min | 15 min guaranteed |
| Security add-ons | |||
| Suricata network IDS with exfiltration and insider detection | Add-on | Add-on | Add-on |
| Quarterly site-level threat and posture reporting | Add-on | ||
Pricing is per site. A standard site includes two high-availability firewalls, one switch, and two wireless access points; additional devices are priced incrementally.
Private cloud with built-in resilience, plus managed AI
Option One Technologies operates a private cloud for client infrastructure servers and virtual desktops, and manages public cloud and enterprise AI platforms such as Microsoft Azure, AWS, and Amazon Bedrock. Workloads are hosted in a primary region and continuously replicated to a secondary region, so a disaster scenario becomes a recovery procedure rather than a crisis.
Option One Technologies virtual private cloud
Hosted infrastructure with geo-replication
- Production virtual machines sized to your workload: domain controllers, file servers, application and database servers, virtual desktops
- SSD-backed production storage metered per gigabyte, with replicated storage in the secondary region
- Cross-region data replication (East to West) of every protected VM and volume
- 99.99% uptime SLA on hosted infrastructure
- Standard disaster recovery plan for all hosted servers, with recovery from the last backup within 24 hours and often sooner
- Daily backups of infrastructure servers and virtual desktops, with annual DR testing
Managed public cloud
Design, migration, cost governance, and day-to-day operation of Microsoft Azure and AWS environments, integrated with your identity, security, and backup platforms.
Compliance-grade data retention
Retention architecture that separates vendor-side retention from firm-side capture obligations, with automated exports from AI and collaboration platforms into your archive of record.
Backup & recovery services
| Workload | What is protected | Verification |
|---|---|---|
| Workstations & laptops | Per-endpoint image and file backup with retention policies and self-service restore | Daily success checks |
| Microsoft 365 / Google Workspace | Mailboxes, OneDrive, SharePoint, Google Drive, Teams and chat data, per user | Daily success checks |
| Servers & virtual machines | Application-consistent backups of physical and virtual servers, on-premises or hosted | Monthly restore tests |
| Backup storage | Encrypted cloud repository, metered per terabyte, immutable options available | Capacity reporting |
| DR test & reporting | Annual or semi-annual failover and restoration exercises with audit-ready results and a business continuity tabletop | Documented evidence |
Continuity that passes diligence. Recovery runbooks, DR test results, and business continuity documentation are structured for SEC examinations, investor operational due diligence, and cyber-insurance underwriting.
DaaS, VDI, and application streaming
Instead of the desktop living on a laptop, it lives in Option One Technologies' private cloud. Users connect from any managed or unmanaged device to a persistent virtual desktop, or to a single streamed application, with data never leaving the data center.
Desktop as a Service (DaaS / VDI)
Persistent virtual desktops hosted in the Option One Technologies private cloud, sized per user profile from light knowledge worker to multi-monitor trading desk. Includes the full managed IT stack: patching, EDR, backup, and helpdesk on the virtual desktop itself.
- Persistent or pooled desktops with roaming profiles
- Multi-monitor and high-DPI support for trading layouts
- Access from Windows, macOS, iPad, or thin client
- Geo-replicated to a secondary region with a 99.99% uptime SLA
- Session recording and access logging for supervision
Apps as a Service (SaaS / app streaming)
Individual line-of-business applications published to users without a full desktop. Ideal for market data, order management, portfolio accounting, and legacy applications that must stay close to the data.
- Publish a single app: OMS, PMS, Bloomberg tools, accounting, legacy software
- Runs next to the data, eliminating slow VPN round trips
- Licensing and version control centralized on your terms
- Contractors and third parties get one app, not your network
- Instant revocation on offboarding with no device to collect
Why firms move to virtual desktops
Data never leaves the data center
No fund data on laptops, no exposure when a device is lost, stolen, or handed back by a contractor
Onboarding in minutes
A new analyst or a temporary contractor is productive from any device the same day
Trading-grade performance
Applications sit next to market data and file systems instead of across a VPN
Audit-ready access control
Centralized authentication, conditional access, session logging, and immediate revocation
Predictable cost per seat
Per-user monthly pricing that includes compute, storage, backup, and management
Business continuity by default
Any device becomes a workstation during an office outage or relocation
Enterprise AI inside your own boundary
Investment teams want AI in their research and operations workflow without handing proprietary data to a public model. Option One Technologies runs managed enterprise AI platforms, primarily Amazon Bedrock, inside your own cloud boundary, with retention controls, governance, and an acceptable-use policy your compliance team can defend.
Private model access
Access to leading foundation models through Amazon Bedrock within your own AWS account and VPC, so prompts and documents never leave your boundary and are never used to train a public model.
Retention & records controls
Configurable prompt and output retention, automated export of AI interactions into your archive of record, and a retention design that distinguishes vendor-side retention from your own capture obligations.
Governance & acceptable use
Acceptable AI Use Policy, approved use-case register, role-based access to models and data sources, and vendor due-diligence documentation for every AI platform before it touches client data.
Assistants over your own data
Retrieval over approved document sets such as research libraries, IC memos, and policy repositories, with per-source permissions inherited from your identity platform.
Monitoring & cost governance
Usage, cost, and consumption dashboards by team and use case, with guardrails and budget alerts so AI spend stays predictable.
Operations & support
Platform build, model enablement, integration with M365 and internal systems, and ongoing management by the same team that runs your cloud.
Platform management is billed separately from AI consumption, so you see model usage costs at cost and management as a predictable monthly fee.
Two tiers of white-glove IT. Three levels of network ownership.
Select the coverage window and level of ownership that matches how your firm operates. Every tier is backed by documented SLAs.
Essentials
Managed 8x5 White Glove IT Support
- Live helpdesk Mon–Fri, 8 AM to 6 PM, named-engineer follow-through
- L1 triage, L2 engineering, L3 senior escalation
- Continuous RMM monitoring, bi-weekly OS and third-party patching
- Quarterly compliance reporting: patch, encryption, EDR, policy drift
- Managed M365 or Google Workspace, SharePoint and file systems
- Managed backups with daily verification and monthly restore tests
- Full asset lifecycle, hardware catalog, procurement
- Bloomberg, OMS, CRM and accounting application helpdesk
Advanced
Managed 24x7 White Glove IT Support
Everything in Essentials, plus- Round-the-clock helpdesk incl. nights, weekends, holidays
- 24/7/365 environment monitoring of endpoints, servers, cloud
- Deeper trading platform and OMS integration support
- MDM via Intune, Jamf or Kandji for iOS, Android and company devices
- Technology roadmap, budget forecasting, lifecycle refresh guidance
- Executive checkpoints and quarterly business reviews
Priced per user per month; servers, VMs and extra backup workloads per device. Contact us for a tailored proposal.
Response commitments you can hold us to
Every Option One Technologies agreement includes documented SLAs. Response times are contractual and backed by service credits; resolution targets are measured goals pursued on a continuous-effort basis.
Transparent reporting
Clear visibility into service performance, ticket activity and operational trends through client portal dashboards and reports.
Named delivery team
An account manager, technical lead and executive escalation contact, plus a dedicated helpdesk line and portal.
Transparent terms
One-year terms with annual renewal, monthly invoicing, change orders for scope changes, and a Data Processing Addendum.
Next step
From first call to fully managed in weeks, not quarters.
Start with a 45-minute discovery. We respond within one business day with a slot and a preliminary tier recommendation.