How it works
Six steps from purchase to deletion. The parts that protect you — consent, isolation, human review, and the deletion clock — are enforced by the system rather than promised in copy.
1. Purchase and complete intake
You pay for a tier, then answer a short questionnaire about the application: what it does, what built it, whether it handles real customer data or payments, and what is currently blocking you. You also make two explicit choices — whether we may run your code in a sandbox, and how your source code may be processed.
Neither optional choice is bundled into the mandatory terms. Declining both is a valid, supported path.
2. Provide authorised read-only access
In order of preference: a read-only invitation to our dedicated audit identity, a time-limited encrypted archive upload, or a temporary read-only credential you control. We never ask for your normal account password.
You confirm you are authorised to share the code. We refuse repositories that were not lawfully obtained.
3. We inspect and run approved checks safely
Static review always comes first: file inventory, secret scanning, dependency manifests, authentication and authorisation flows, data isolation, deployment configuration, payments and webhooks, error handling, and the test inventory. Your code is never installed or executed on our machines.
If you consented to execution, we build and run it inside a disposable container with no network access by default, resource limits, dropped privileges, and a read-only copy of your source. The container is destroyed afterwards.
4. A human reviews the evidence and the verdict
Automated analysis produces candidates. It does not produce your verdict. Every critical and high finding is validated by the operator, false positives are removed, and the customer-facing wording is checked before anything is generated.
The report generator refuses to run while any critical or high finding is still unreviewed. That is enforced in code, not by discipline.
5. You receive the report and a next-step plan
A confidential PDF with the verdict, the score, every launch blocker with its evidence, the priority findings, a remediation roadmap in phases, and an honest record of what was and was not checked.
Next steps always include doing it yourself, and doing nothing. The rescue sprint is an option, not the point.
6. We delete what we hold
At the end of the retention period — 30 days after delivery by default — the repository copy, extracted workspace and temporary evidence are deleted, and a deletion record is produced. You can ask for that earlier at any time.
We keep a minimal commercial and audit record: the job, the findings register, and the report. Not your source code.
When the clock actually starts
Paying does not start the delivery clock. The clock starts when all five of these are true: payment is confirmed, we have accepted the project, your access works, your consents are complete, and the project is within scope.