For 12 months, we test your product, help your engineers fix what matters and monitor your systems. You get evidence to show customers and investors.
- Price · USD
From$5,000USD / year
Starting price. We agree the final fee before work begins.
- Term
12 months
Billed once a year
- Monitoring
Included
For the full 12-month term
- Best for
Startups and small product teams
Annual security program
Who it's for
Made for small teams that move fast.
For startups with a clear product and someone who can act on the findings. Larger companies usually need Business Security or Enterprise Security.
Early-stage and growing startups
You have a product people use and no security team yet.
Founders selling to larger companies
Big customers send security questions. You'll have answers and evidence.
Teams preparing for a funding round
Investors ask about risk. You can show what was tested and fixed.
Proof you can share
Show customers and investors what you've done.
Your security summary explains what we tested, what you fixed and what we watch. Switch the reader to see how it changes.
A buyer wants to know their data is safe. The summary shows what we test, what you fixed and that monitoring is on.
Example startup
Security summary
- What we test
- Our app, its API and our cloud account
- Latest review
- Baseline review complete
- What we fixed
- Every high-risk issue, tested again
- Monitoring
- Active for the full year
- More detail
- Full report on request
Prepared with Riftweld · Example
AI in your product
AI features are part of the review.
If the application in scope uses AI models or agents, we check what they can do and what data they can reach.
Then we help you set sensible limits, and check them again in the retest.
search_help_articlesPublic help pagesKeepread_accountAny customer's accountLimit to usersend_emailAny email addressAsk firstrun_sql_queryThe whole databaseRemove
What you get
Five things you keep from the year.
- 01
A clear map of what's in scope and a security backlog in priority order
Your team always knows what to fix next.
- 02
Technical findings and a retest report
Proof that each fix works.
- 03
A security summary you can share with customers and investors
One page that answers the questions buyers and investors ask.
- 04
Notes from each quarterly session, with owners and next actions
Decisions written down, so nothing slips.
- 05
Monitoring findings, alerts we raised and next actions for the full term
What changed, what we flagged and what to do about it.
The details
The fine print, in plain words.
Twelve months, with one baseline review, one retest and four advisory sessions. Monitoring runs for the whole term.
What's included6 items
- One main application with its API, plus one cloud environment
- One baseline security review during the 12-month term
- Logins, secrets, dependencies, deployment and backups for the systems in scope
- One retest to confirm the baseline fixes
- Four advisory sessions across the year
- Ongoing monitoring of your systems for the full term, with alerts sorted and sent to your contacts
What we need from you5 items
- A product owner and a technical owner
- Architecture notes, code repository and cloud access for the review
- Written permission to test, and a safe test environment where needed
- An engineer who can make the fixes
- Monitoring access or data feeds, alert contacts and who to call when something is urgent
Where we stop4 items
- The starting price covers one application, its API and one cloud environment. We quote extra products or environments separately.
- Your team makes the fixes. We can scope hands-on help separately.
- A 24-hour security operations centre, incident response and certification are separate engagements.
- Monitoring covers the systems and signals we agree, for the 12-month term. We write down methods, triage hours and escalation times before it starts. Monitoring does not guarantee that an incident will be contained.
Questions from founders.
What does the annual price cover?
One application with its API, one cloud environment, one baseline review, one retest, four advisory sessions and monitoring for 12 months.
Will we get a certification?
No. We don't certify. We give you findings and evidence that a customer or auditor can use.
Who makes the fixes?
Your engineers, with our help. We explain each fix, then test again to prove it worked.
Do you look at our AI features?
Yes, when they're part of the application in scope. We check what your AI models or agents can do and what data they can reach.
Is ongoing monitoring included?
Yes. We monitor the systems in scope for the full 12-month term. We agree access, reporting, contacts and triage hours before it starts.
Startup Security
Build security in while you grow.
Tell us about your product, your cloud and any customer or funding deadline. We agree the scope and fee before work begins.