Scoped external scans, static app testing, email authentication, secure websites, data removal, and ongoing hygiene for SaaS teams and small businesses. Clear written findings. Explicit authorization. Nothing runs without your permission.
Internet-facing systems. Ranked findings. Short report. Good for a first look, insurance questions, or “are we exposed.”
No exploitationMFA, email security, backups, admin access, and basic policy gaps. Written gap list you can hand to insurers or customers.
Not a pentestWe locate your information on people-search and broker sites, prepare the requests, and submit them after you approve. Optional monitoring available.
You approve firstAuthorized static review of Android and iOS app builds — code, packages, and configuration — without running the app. Hard-coded secrets, insecure settings, and common issues. Findings ranked with clear remediation guidance.
Written authorizationScheduled checks on authorized domains. Findings delivered to you. Alerts if something material changes. Monthly or quarterly.
Authorization requiredSPF, DKIM, and DMARC set up correctly, then a guided move to DMARC enforcement. You keep ownership of your accounts; we work through delegated access with a backup and rollback before every change.
Signed authorization · Details →Small, fast sites built with HTTPS and security headers, privacy-friendly analytics, and accessibility targeting WCAG 2.2 AA. Migrations off hosted builders. You own the code and content once paid in full.
Our own site is the case study →Every engagement starts with explicit permission. Nothing runs against systems or records we have not been cleared to assess.
External scan, static app testing, hygiene review, email authentication, website work, or data removal — limited to the agreed scope. No surprise testing.
Ranked findings, severity, and a practical fix list. Suitable for insurers or customer questionnaires.
Remediation review or ongoing retainer to confirm what is closed and catch material changes.