Pricing

Fixed quote. No day rate.

You get a fixed quote before anything starts. The quote comes back in writing, with the scope beside it. Nothing starts until you sign.

Get a fixed quote How it works

Engagements

Three ways to engage.

All three end the same way: a fixed quote, in writing. Pick the one that fits the release in front of you. Then send the brief.

Report card

Who it's for

A founder or product lead about to launch or relaunch.

Included

All four subjects, security graded first
A scoped security test across the six sub-categories
Every finding confirmed by hand
A report card in 72 hours, signed by a senior reviewer
A fix plan attached to every finding
Evidence, impact and priority in plain language

Not included

Fixing what we find
The deeper Retest Cybersecurity test

How it starts

Send a URL and two sentences. The scope comes back in writing.

Get a fixed quote for Report card

Retest Cybersecurity

Who it's for

A team facing a security questionnaire with no third-party test to name.

Included

A deeper third-party security test of the company
Hands-on help with the fixes
A written scope, and the environment agreed in advance
A retest of what you fixed

Not included

Any access before you sign the consent
A certification, an audit or a compliance badge

How it starts

It is a separate contract, scoped in writing. Consent and approval come first.

Get a fixed quote for Retest Cybersecurity

Retainer

Who it's for

A team shipping often that wants each release read against the last.

Included

Retests on a schedule you set
The same four subjects every time
A card you can read against the last one
A standing scope you amend in writing

Not included

Fixing what we find
The deeper Retest Cybersecurity test

How it starts

One report card comes first, so the retests have something to read against. Then you set the schedule.

Get a fixed quote for Retainer

Report card

Its security subject is a scoped test: testers and controlled agents work the agreed scope. A senior reviewer confirms each finding by hand.

Retest Cybersecurity

It is a separate contract: a deeper third-party test of the company, then hands-on help with the fixes. You approve the scope and sign the consent first.

The number

What moves the quote.

The number follows the scope, not a clock. Name what you can in the brief. We ask the rest.

Size of the scope: How many pages, flows and endpoints are in it.
Environments: Staging only, or read-only production as well.
Depth on security: A pass over the six sub-categories, or a deeper test.
Number of subjects: Security alone, or all four on one card.
Devices and locales: Which phones your customers hold, and in which languages.
Retest: One card, or a retest after your team fixes.

Standard

What does not change.

These sit outside the quote, and outside the negotiation. They arrive with every engagement.

An NDA, standard on every engagement.
Written consent, signed before anyone touches anything.
A senior reviewer signs every report card.
Plain language: what it is, why it matters, what to fix.
No hidden line items. The quote names everything.

Money questions

Questions before you sign.

The questions below arrive before a signature. The answers are short.

Why not a day rate?

A day rate grows while you watch it. A fixed quote does not move.

What if the scope grows?

New scope gets a new quote, in writing. The first number stays.

Is this a scan?

A scan cannot tell a confirmed finding from noise. Controlled agents cover breadth inside the agreed scope. A senior reviewer confirms each finding by hand.

Will you touch production?

We test on staging by default, and go read-only on production only when the scope says so. We never assume destructive testing.

Do you fix what you find?

Hands-on fixing is a separate contract, never a hidden line item. Every finding carries a fix plan.

Do we need an accredited audit?

If you need a certificate for an auditor, you need an accredited audit. A report card tells you what to fix. It does not certify you.

Read the FAQ

The sequence

How an engagement starts.

You send a brief — a URL and two sentences about what worries you.
We send back a fixed quote. The number does not move once you accept it.
We agree the scope in writing and you sign the consent. Nothing starts before that.
We test, and your report card lands within 72 hours — every finding in plain language, a fix plan attached.

Retest Cybersecurity contracts get their own timeline, in writing, before work starts.

Get a quote

Get a fixed quote.

A URL and two sentences is enough to price it. The scope comes back in writing. Nothing starts until you sign.

Get a fixed quote

Send a URL, never credentials or secrets.

Report card in 72 hoursNDA + written consentSigned by a senior reviewer