A Defined Process, From Scope To Retest.
Three phases, six steps. No discovery questionnaire, and no stage where you wonder what is going on. What happens at each step is agreed before the engagement starts.
Scope
Agree what will be tested, in writing, before anything runs.
- 01
Scoping call
We go through the application, the roles, the API surface and what is driving the timing. No sales pitch, no discovery questionnaire.
- 02
Fixed proposal
A written scope with a fixed price, explicit exclusions, dates and deliverables. The price does not change unless you change the scope.
- 03
Authorization
A signed authorization letter and rules of engagement: what is in scope, what is off limits, the testing window, and who to call if something breaks.
Test
Manual assessment against the agreed surface.
- 04
Testing
Manual testing against your environment. You get progress updates, and anything critical is reported the day it is found rather than held for the report.
Report & retest
Evidence, remediation, and verification that it is closed.
- 05
Report
Executive summary for the people who sign things, technical findings with reproduction steps and a working proof of exploit for the people who fix them.
- 06
Retest included
When you have fixed things, we verify each one and issue an updated report plus a letter of attestation you can hand to customers and auditors.
What we need from you
- Test accounts for every user role, ideally two accounts per role so we can test between users.
- An environment to test, staging or production, and your preference between them.
- Any API documentation that exists. If none exists, that is normal and it does not change the price.
- A signed authorization letter, and confirmation you own or can authorize every asset in scope.
- One technical contact who can answer a question within a day, and one contact for emergencies.
That is the whole list. If your environment is not ready, tell us on the scoping call and we will book the window around it rather than starting and stalling.
Prove what your product exposes
A 30 minute scoping call, then a fixed price. No discovery questionnaire, no pressure to buy.