Security and GDPR audit in 5 days.
Sooatek audits your application’s code and configuration: a score out of 100, ranked vulnerabilities, a Go/No-Go verdict and a fixed-price remediation plan. The team that audits is the team that knows how to fix.
§ 01 / What you receive
A report that says what to fix, and in what order.
- A security score out of 100
- Vulnerabilities ranked (CVSS, OWASP ASVS Top 10)
- Exposed secrets and vulnerable dependencies (Semgrep, Gitleaks, Trivy)
- Access control reviewed
- Technical GDPR points to address (Article 32)
- A Go/No-Go verdict
- A fixed-price remediation plan
- A 45-minute debrief
§ 02 / How it works
An 8-phase method, over 5 days.
A written method, run over 5 days (2 days for the express audit), ending with a score out of 100, a Go/No-Go verdict and a 45-minute debrief.
Method
An 8-phase method, followed in the same order for every audit. A human review validates each finding before the report.
§ 03 / Not included
What the audit does not cover.
§ 04 / Terms
Three options, at a fixed price.
- Scope
- Defined in writing before we start: applications, environments, access.
- Audit (5 days)
- Fixed price, on quote.
- Express audit (showcase site, simple application, 2 days)
- Fixed price, on quote.
- Extended audit (4 to 6 applications or sensitive data)
- Fixed price, on quote.
- Payment
- Depending on the amount of the quote: payment on order, or 40% on order and the balance on delivery of each work package. Monthly subscriptions: payable in advance.
§ 05 / Frequently asked questions
Frequently asked questions
Do you test our production environment?
No. Active testing is done only in pre-production, and only with your written authorization.
Is fixing the vulnerabilities included?
No, but it is priced in the report. The team that audits is the team that writes code: you can give us the fixes (Security hardening and NIS2 readiness offer) or give them to your own team.
Is this a penetration test?
No. It is an application security audit: code and configuration review, dependencies, secrets, access control. We do not perform PASSI-qualified penetration tests or internal infrastructure audits.
Let’s talk about your project.
Describe your need in a few lines. We get back to you in writing with a first opinion, the possible next step and its price.