Domain
RequiredStaging by default. Never put a password in this brief.
Order
Build the test, see what you get, then order it — without a call. The scope comes back in writing. Nothing runs until you sign.
Scope in writingNDA + written consentReport card in 72 hours
The flow
Every step stays on this page. The order leaves as an email you read before you send it. Nothing else happens.
Staging by default. Never put a password in this brief.
One line is enough.
Add your product’s URL to continue.
The button opens a draft in your mail app; nothing sends until you press send. We reply with a fixed quote. Nothing runs until you sign.
This page takes no payment and asks for no card. A fixed quote arrives by email. The invoice follows your signature.
The proof
Every finding on the card carries the evidence behind it. A senior reviewer signs the card. You can check.
Each finding names where it sits and what we saw. Found by agent, confirmed by hand.
A screenshot of the screen where it happened. A screen record of the steps that got there. The request and the response beside them.
We write what it means for your data and your customers. No severity score standing on its own.
Every finding arrives with what to do next, ranked. You don't translate it into a ticket. The fix plan comes attached.
A person's name sits on the call that a finding is real. Not a tool's confidence score.
Your team fixes what the card ranked first. We retest, and you read the new card against the last. You see what moved.
Standard
The same safeguards arrive with every engagement, whatever the scope says. They sit outside the quote, and outside the negotiation. You sign first.
Consent first
Sending this order does not start a test. Scope and consent do, in writing.
Read-only on production
Production is read-only, and only when the scope says so. We test on staging by default.
Stop any time
The scope is yours to amend, in writing. Say stop and we stop.
Send it
A URL and one line is enough. We reply with a fixed quote. Nothing runs until you sign.
Send a URL, never credentials or secrets.