A security review before the launch, or the big customer.
A fixed-price check of your app, cloud and AI agents: what we found, the fixes in plain words, and a plan. Read-only, in 1 to 2 weeks.
Not the right team for a formal ISO 27001 certificate or a penetration test report. Those need an accredited firm, and we get you ready for them.
- Price
- US$1,800 fixed
- Time
- 1 to 2 weeks
- Access
- Read-only
The support agent ignored it and flagged the ticket. Pass.
Six things we check.
Each review covers the parts that matter for your app and your deadline.
Access and sign-in
Who can sign in, what each role can see, and keys that can do more than they need.
Cloud and network
Open ports, public databases and services reachable from the internet that shouldn't be.
Code and packages
Secrets in code, old packages with known flaws, and risky handling of personal data.
AI agents and connectors
Every agent, MCP connector and key, what each can reach, and actions it could approve for itself.
Use case: agent and MCP audit →ISO 27001 and GDPR
Consent, where data lives, logging, backups and who can see what, against the checklist we run on every build.
How we build →A report your buyer can read
A one-page summary for leadership or a customer's security team, and a fix list for your engineers.
Two client platforms, reviewed.
An ISO 27001 and GDPR review for Parallel Completions, and a security brief for Tibra Health's clinical AI app.
- 01Blueprint
- 02Build
- 03Live
- 01Blueprint
- 02Build
- 03Live
Illustrations of the two builds · sample data
Find it, fix it, keep it clean.
The review has one fixed price. Fixes are a separate step, done by your team or by us.
Scoping call
30 minutes on the app, the deadline and who needs to see the result.
- Time
- 30 minutes
- Price
- Free
- Ends with
- A written next step
Review
App, cloud, code and AI agents checked on read-only access, with a ranked fix list.
- Time
- 1 to 2 weeks
- Price
- US$1,800 fixed
- Ends with
- A fix list and a one-page summary
Fix
The urgent fixes done with your engineers: narrower keys, closed ports, secrets rotated.
- Time
- 2 to 4 weeks
- Price
- From US$1,199 a month
- Ends with
- The urgent risks closed
Keep it clean
A monthly check for new risks, and patches when they appear.
- Time
- Monthly
- Price
- From US$599 a month
- Ends with
- A short report every month
In US dollars · monthly plans on the pricing page
Read-only, ranked, in plain words.
How each review runs, and what each choice costs you.
Read-only access
We look and change nothing during the review, so nothing breaks while we check.
Fixes come after, as a separate step.
Tests agreed first
Every test that touches a live system is listed and agreed with you before we run it.
Some tests wait for a time that suits you.
Ranked by real risk
Live exposure first, then what an attacker could reach, then housekeeping.
Low-risk items stay on the list for later.
Plain words
Each finding says what is wrong, why it matters and the fix, so leadership and engineers read the same list.
Engineering detail sits in the fix list, not the summary.
Scanners plus a person
Scanners find the known issues, and a person checks what they can't see, such as roles and agent permissions.
Scanners only cover what they are pointed at.
Where AI adds risk.
AI agents and connectors are the newest way in, so every review checks them.
Agents
What each agent can read, change or spend, and who approved it.
Agent audit →MCP connectors
Connectors that reach customer data or take actions, and who owns them.
Agent audit →Hidden instructions
Instructions planted in files, tickets or pages that an agent might follow.
Agent audit →Keys and tokens
Keys wider than needed, shared between tools, or with no owner.
Agent audit →Approvals
Actions an agent could approve for itself, moved back to a person.
How we build →Read-only, and removed when we're done.
Access is set up for the review and removed when it ends. Findings stay with you.
- Access we need
- Read-only access to your repos, cloud settings and AI tool admin pages, removed when the review ends.
- Where findings live
- In your own drive. Secrets we find are reported by location, never copied.
- Live secrets
- If we find one, we tell you the same day so you can rotate it.
- Who signs off
- Your engineering lead reviews the fix list with us and decides what is fixed first.
What people ask first.
Short answers here. The scoping call gets you the long ones for your app.
Will the review change anything?
No. It runs on read-only access, and every test is agreed with you first. Fixes are a separate step.
What do we get at the end?
A ranked fix list for engineers, a one-page summary for leadership, and a call to walk through both.
Do we have to use you for the fixes?
No. The fix list is written so your own team can do it. We can help on a monthly plan if you want.
Is this a penetration test?
No. It's a review of how your app, cloud and agents are set up, with a few agreed tests. If a customer asks for a penetration test report, the fix list gets you ready for one.
What if you find a live secret?
We tell you the same day, by location only, so you can rotate it. We never copy it.
How often should we repeat it?
Before each big launch or new customer review. If you add agents or connectors often, a monthly check keeps the list current.
Get this scopedin 30 minutes.
Bring the app, the deadline and who needs to see the result. You leave with a written next step and a start date for the review.
India time · confirmed on Cal ID