Portal
What was tested, what we fixed, what you can show.
One place for your products and sites: findings by severity, fixes in progress, the evidence file and a private link for each buyer. The portal is in preview. Until it opens, you get the same work as a signed report every month.
Inside the portal
- Findings confirmed by an engineer, never raw scanner output
- Fixes linked to pull requests in your repository
- The evidence file: tests, patches, policies, dates
- A private, expiring link for each buyer IT team
- Your fix credits, used and left
- HighOutdated TLS library on the update serverFix in review · PR #142
- MediumDebug port reachable on stagingFixed and retested
- MediumKnown flaw in a third-party componentNot reachable in your build · noted
- RulesEU CRA reporting clockNo open reports
What the agents run
Only on assets you own and list in a signed scope letter. Testing that could disturb a live system runs on a staging copy.
| Agent | What it does | How often |
|---|---|---|
| Exposure scan | What is reachable on your domains, cloud endpoints and device-facing services | Daily |
| Component watch | New CVEs and known-exploited flaws matched against your software bill of materials | Daily |
| Release scan | Each firmware build, app release or site deploy checked for keys, old libraries and weak settings | Every release |
| Cloud check | Cloud settings read through a read-only role | Daily |
| Site health | Uptime, certificates, headers, malware, speed | Daily |
| Evidence and answers | Tests, fixes and policies in one place; questionnaire drafts from that evidence | On request |
| Rules watch | EU CRA clock, FCC lists, FDA 524B, state privacy laws | Daily |
How we work
AI agents do the volume. Engineers own the result.
The agent finds
Scans run every day inside the scope you signed.
An engineer confirms
An engineer checks every finding before it reaches you. Each gets a severity and an owner.
An engineer fixes
The fix lands as a pull request in your repository. You review and sign.
The agent retests
The same check runs again. Fixed means the check passes.
The record is dated
Test, fix and retest go into your evidence file and the buyer link.
What we commit to
- Written scope before work starts.
- Every deliverable dated and kept in your evidence file.
- Vulnerability reports acknowledged within one business day; on Respond and Secure, received 24/7 with an engineer on call.
- A first answer to any request within one business day, Vancouver time.
- A named lead you can escalate to.
You own your product and its security. We own the work we deliver, in writing. No one can promise a site or product will never be hacked. Doing nothing is far riskier. We shorten the time you stay exposed, and we keep the record.
Tell us what you run, and what keeps you up at night.
Write in your language or in English. We reply within one business day with first questions and a time to talk; calls in English, by appointment.