First, we check your current site
from the outside, free of charge.

It's free. There's no billing later. The check costs us nothing but our own time — no outside payments are involved. That's also why we cap it at five companies a month.

We only examine a site after you've applied. And what we look at is limited to what anyone can see: search results, published pages and the like. We never enter IDs or passwords, never hunt for admin panels, and never run vulnerability-scanning tools. If any of that is needed, we do it only after receiving permission in writing.

Yes. In fact, this is written with exactly that kind of company in mind. We explain things without jargon. All you need to decide is what's giving you trouble, and all you need to prepare is your site's URL.

Yes. In fact that's the most common request. We can help even when you've lost contact with the company that built it. It does have to be a site your own company manages, though — we don't take on requests to examine another company's site without their knowledge.

No. Once the results are sent, we make no sales contact and no sales calls. Only if you want to know the costs, tick "I'd also like a rough cost estimate" on the form. If you don't tick it, we won't send you any pricing.

We tell you: "Within what is visible from the outside, there was nothing of concern." That is a result in itself. We don't invent problems to report. But remember that a ○ doesn't mean "safe" — it means "nothing was visible from the outside." We're honest about that in writing.

The check is US$0. Fixing your current site starts at US$650, rebuilding it from the look upwards starts at US$3,200, and building the whole internal system is quoted individually. The figure is set largely by three things: how many pages need fixing, how many forms there are, and whether it runs on WordPress or a bespoke system.

The check is done within 3 business days of your application. For the work itself, fixing your current site takes about 3–4 weeks and rebuilding it about 6–8 weeks. We issue a schedule before starting, and we work to the dates written on it. We don't put down dates we can't keep.

From the outside, the most we can say is that use of an older version is suggested — we can't state it as fact, because that information can be altered. That said, if you are still running a generation whose official support has ended, no fixes are being issued for it, so we'd recommend updating. Establishing it for certain requires checking the live environment, and for that we obtain permission in writing.

We write neither the URL nor the values anywhere in the proposal documents. We simply say there's something we'd like to discuss urgently, and pass it to the person in charge directly. If we cannot reach anyone and determine that it qualifies for IPA's vulnerability-reporting scheme, we follow that scheme.

Left alone, it will. That's why we offer monthly maintenance. It isn't compulsory, though. You can choose to have work done only in the months you need it, and if you'd rather run it in-house we'll hand over the manuals. We won't tie you to us.

We don't perform full vulnerability assessments that simulate attacks. We'll introduce you to a specialist firm, because that's more reliable than us taking it on halfway. What we do is check what's visible from the outside, and fix what turns up there.