Test the systems you own or are authorized to assess
We start by documenting the domains, applications, APIs, accounts and environments you authorize us to test. Together we agree on test windows, request limits, permitted techniques, excluded systems, an emergency contact and stop conditions. Owning an application does not automatically authorize testing its hosting provider or other third-party services. Production testing needs separate approval and operating limits; a representative QA environment is the preferred starting point.
What the assessment can cover
- Login, password recovery, sessions, permissions and separation between users, teams or customer accounts.
- Web and API input handling, file uploads, exposed configuration and unintended disclosure of sensitive data.
- Business logic and administrative workflows, using agreed test accounts and representative data.
- For AI-enabled products: prompt injection, retrieval permissions, sensitive-data leakage and tool actions that exceed the user's authority.
- Source code and dependency review when access is included in the scope, followed by remediation guidance and an agreed retest.
A private model assists the engineers
We can deploy a model on dedicated physical computers or inside your approved infrastructure to help inspect source code, group findings and analyze test evidence. Model selection depends on hardware, workload and evaluation on representative samples. Engineers approve test actions and validate findings: model output alone is not proof of a vulnerability. We document where code, prompts, credentials, evidence, logs and backups are stored, and agree on access and deletion. External model calls, telemetry and cloud sync are disabled for a fully local engagement; any exception must be approved in advance.
- Written scope
- Controlled tests
- Human validation
- Report & fixes
- Retest
Testing stays within the authorized assets and operating limits. Findings include evidence and a practical route to remediation.
A practical example
For a company with a customer portal, we could assess whether a test user can access another test organization's records, whether account recovery respects the intended controls and whether an AI assistant retrieves only authorized documents. We use approved test data, collect the minimum evidence needed and report reproducible findings without exposing real customer information.
What you receive
- An agreed scope and test plan naming assets, environments, constraints and the people responsible.
- A report with validated findings, severity and business impact, evidence, reproduction conditions and recommended fixes.
- A technical review with your developers and a remediation backlog ordered by risk.
- A retest of the agreed findings, identifying what was resolved, what remains and what was outside the assessment.
- A documented private AI configuration, data boundary and handover when a dedicated model deployment is included.
White hat only. We do not test assets without written permission, disrupt services or access data beyond the agreed proof. Testing reduces risk within a defined scope and time window; it cannot certify that a system has no vulnerabilities.
Integrations without a fixed catalog
Slack, Telegram, WhatsApp, email, Jira, CRM, ERP and your own software: we build custom integrations with no fixed list or predefined number of connections. The scope depends on available APIs, permissions and each provider’s conditions.
Send approved findings and remediation tasks to Jira, Slack, Telegram, WhatsApp or email. Credentials, sensitive evidence and model processing remain within the agreed private boundary; each external connection needs your approval.
Discuss an authorized security assessment, explore Private AI Computing or combine the work with a technical code audit. Custom AI Factory projects start at €10,000; scoped private capacity rental starts at €1,000/month. These are starting prices, not an unlimited testing service: the quote specifies testing scope, model setup, hardware, retest and any remediation work. External costs and applicable taxes are separate.
FAQ
Can you test a proprietary website?
Yes, if you own it or have explicit written authorization from its owner. We agree on the exact assets, accounts, techniques and testing window before starting. Third-party platforms and infrastructure require the appropriate permissions too.
Does our code go to a public AI service?
For a fully local engagement, model processing, evidence and logs stay within the agreed private boundary, with external model calls, telemetry and cloud sync disabled. Any external connector or service is documented and approved separately.
Do you test production systems?
We prefer a representative QA environment first. Production testing requires explicit approval, agreed traffic limits, stop conditions and an operational contact. We do not carry out destructive or availability testing unless separately authorized and scoped.
Are fixes included?
The proposal specifies the report, developer review and retest scope. Code changes, deployment and wider remediation can be included or quoted separately. An AI-generated alert is validated by an engineer before it is reported as a finding.
Can this guarantee that we cannot be hacked?
No. A pentest examines agreed assets and techniques during a defined period. The report records coverage and limitations; ongoing maintenance, access reviews, monitoring and follow-up testing remain necessary.