Your buyer sent a security questionnaire. Within a week you get it answered with sources, a report on your code and perimeter mapped to SOC 2 and ISO 27001, and fix guidance.
No credit card for the free scan · read-only GitHub access · EU hosting
The screens below are the product, with demo data. Pick a package to see which steps it covers.
Deal Pack — everything one deal needs: questionnaire, expert-validated findings, the report and follow-ups.
Install the read-only GitHub App on the repositories you pick and verify your domain with one DNS record. Nothing else gets access.
Each scanner runs in its own locked-down container. The run page shows what was checked — and what was not — before any finding.
Every finding is triaged against your code: false positives are closed, real ones get step-by-step fix guidance. One advisory in three lockfiles is one issue.
AI never closes a critical or high finding on its own. A security expert reviews them, writes the note the buyer reads, and re-checks a sample of what AI decided.
Drop the Excel file. Every answer cites your policy or a scan result and goes back into the original cells. You approve each one; approved answers go to your library.
A PDF mapped to SOC 2 and ISO 27001: scope and coverage first, then issues by area, with who verified each one.
Your team fixes the code with our guidance, marks findings as fixed and runs the re-scan: the buyer sees “fixed — confirmed by a re-scan”, not your word for it. Follow-up questions from the buyer are answered too.
Install the read-only GitHub App on the repositories you pick and verify your domain with one DNS record. Nothing else gets access.
In: Free scan, Quick Check, Deal Pack, Continuous, Pre-pentestThe same seven steps, side by side. Full comparison with every limit on the pricing page
| Step | Free scan €0 | Quick Check €490 | Deal Pack €1,900 | Continuous €3,480/yr | Pre-pentest €490 |
|---|---|---|---|---|---|
| Connect your code and domain | Your repositories and a domain, no card needed | Repositories and domains of the deal | Repositories and domains of the deal | Every repository, every push | Repositories and domains of the deal |
| We scan code, secrets, dependencies, containers and the website | Dependencies and website | Code, secrets, dependencies, containers & IaC and website | All 5 areas, plus your organizational measures | All 5 areas, plus your organizational measures | Code, secrets, dependencies, containers & IaC and website |
| AI sorts real issues from noise | AI triage of every finding | AI triage of every finding | AI triage of every finding | AI triage on every push | AI triage of every finding |
| An expert confirms what matters | — | Critical and high findings | Expert validation and fix guidance | Expert validation | Expert validation |
| The buyer's questionnaire, answered with sources | — | — | One questionnaire, up to 300 questions | Up to 4 a year, from your answer library | — |
| A report the buyer accepts | — | Short report: findings and fix guidance | PDF, valid for 90 days | Updated every month | Findings handed to the pentest partner |
| You fix, we confirm with a re-scan | — | One re-scan | One re-scan, buyer follow-ups for 30 days | Scan on every push | Introduction to a certified partner (fee separate) |
Every report shows the same table: each area checked, checked in part or not checked, and what is outside the review. Nothing is implied beyond it.
A Deal Pack is a fixed price for the deal on your desk. Continuous is a yearly plan that pays off from the second questionnaire.
Prices exclude VAT: EU business customers are billed under the reverse charge.
Need a pentest? Pre-pentest (€490) gets you ready for it, and we introduce a certified partner. The partner's fee is separate.
