The Things People Ask Before The First Call.

One 30 minute call. We need to know what the application does, how many user roles it has, whether there is an API, and what is driving the timing. You get a fixed price after that call, not an hourly estimate that moves.

Test accounts for every role, a staging or production environment, any API documentation you have, and a signed authorization letter. Nothing else. If documentation does not exist, that is normal and it does not change the price.

Yes, if you want that, and it is often the more honest test. Testing is non-destructive by default and we agree the boundaries with you in writing first. If you prefer staging, the only cost is that some findings will be environment-specific.

Findings and evidence stay on encrypted storage that we control, separated per client, and are destroyed on the schedule set in the contract. Nothing is stored with a third-party reporting vendor. No client data goes on a personal laptop.

Yes, one full retest of every finding is included within 90 days of the report. You get an updated report showing what is fixed, and a letter of attestation you can share with your own customers and auditors.

You receive the full record of what was tested, how it was tested and what was ruled out. That record is what an auditor or an enterprise customer actually wants to see, and a clean result against a documented scope is worth having in writing. We do not pad a report with low-value findings to justify the engagement.

We perform the penetration testing those frameworks require, and the report is written so an auditor can accept it. We do not issue certificates. SOC 2 reports come from a licensed CPA firm and ISO 27001 certificates from an accredited certification body. We work alongside whoever you have chosen.

Usually within one to two weeks. If you have a hard audit or customer deadline, say so on the scoping call and we will tell you honestly whether it is possible rather than agreeing and slipping.

Yes, and we will send you a mutual NDA before the scoping call if you prefer to talk in detail first.

The person whose published research you can read. Work is not handed to a junior with a scanner. If more than one tester is on an engagement, you are told who, and every finding is reviewed before it reaches you.