Permission and scope
Before an in-depth check, you sign a permission. It states which websites and applications we check, when, and what we don't touch.
We don't check anything outside the permission, even if we notice something suspicious. In that case we tell you and ask for a new permission.
Tools
We use recognised, widely used security tools such as OWASP ZAP, Nuclei, Semgrep, osv-scanner and gitleaks. Their databases update every day, so the check also covers vulnerabilities published yesterday.
Artificial intelligence
We use AI in two places:
- processing the tools' output, to remove false alarms and group findings;
- drafting the report and the fix instructions.
AI doesn't decide what goes into the report. The responsible reviewer checks and confirms every finding. The service providers we use are listed in the privacy policy.
Human review
A person reviews every finding before it goes into the report. For a critical finding we send you an alert the same day, without waiting for the report.
Your data
We don't copy or keep your customers' data. If a check shows that data can be accessed, we stop that part and tell you immediately.
We delete the report and working files after 12 months unless you ask otherwise.