Securing the web, one system at a time.

Every plan includes a signed written scope, a review of the predefined domains and login roles in that scope, and a prioritized report mapped to OWASP standards. Each finding shows what is wrong, why it matters, the proof, and what to change—plus an 'Observed, Not Tested' list of external links we spotted. You also get Q&A support while your team fixes, one complimentary re-scan within 45 days (60 days on Infrastructure), and a signed 1-page Letter of Attestation once the re-scan finishes.

Never. In fact, we do not maintain a training dataset at all. We run our own open-weight models whose weights we modify directly for security testing, and our reviewers edit the system logic and prompts by hand based on human security findings. Your source responses, credentials, files, and findings are used solely to produce your report and are never fed into any model training pipeline.

Yes. In addition to traditional web and API vulnerabilities, we test the AI features you have built into your site or product. That includes checking whether User A can prompt a RAG assistant into quoting User B's documents, testing whether tool-calling agents can be tricked into running staff-only actions, testing indirect prompt injection through forms and uploads, and checking for exposed LLM API keys or unthrottled endpoints that attackers could drain.

We never push on or probe any domain that is not explicitly listed in your signed scope. An outbound scope filter restricts our models to your predefined domains. However, when our models see outgoing links, redirects, or script references to other hosts—like an internal ERP login, an old subdomain, or a third-party vendor—we list them in an 'Observed Outside of Scope (Not Tested)' section of your report so you know they are reachable from your site.

We combine human setup at the start with strict technical guardrails during the run. Before testing begins, a human reviewer configures rate limits and marks sensitive actions (like billing, account deletion, or mass email endpoints) off limits. During testing, discovery and read checks run autonomously, while state-changing requests (creates, edits, deletes) are restricted to canary test records created under the test accounts you provided. We also monitor response latency and error rates automatically so testing throttles immediately if your server slows down.

Yes. Because we do not perform remediation work ourselves, our review is an independent third-party assessment. Findings are mapped to recognized standards (OWASP WSTG, OWASP API Top 10, OWASP LLM Top 10, and PTES), and after your complimentary re-scan we issue a signed 1-page Letter of Attestation. That letter states the scope, dates, methodology, and verified remediation outcome—giving your customers, insurers, and auditors the proof they need without forcing you to hand over raw vulnerability details.