We got tired of audits that sounded confident and meant nothing

The problem

A website audit is usually stitched together from several single-purpose tools and a spreadsheet. The scores do not reconcile with each other, nobody can reproduce them a month later, and the client receives a document that is impossible to argue with because it is impossible to verify.

The worse half is the confidence. A tool will report a security grade without knowing whether passwords are hashed properly, whether CSRF tokens exist, or whether row-level security is enabled - facts that are simply not observable from outside.

What we decided to build

A platform that separates what it measured from what it inferred from what it cannot know. That distinction runs through the entire product: the scoring model, the finding schema, the checklist and every report.

Everything else follows from it. Evidence on every finding. Confidence values on every inference. A manual attestation layer that is tracked, dated and reportable instead of quietly ignored.

How we operate

One person, funded by subscriptions rather than by selling data - /careers has no roles because there is nobody to hire, and the address on /contact reaches that person rather than a desk. Scans are read-only, respect robots.txt, and we never store page content beyond what a report needs.