How we test, and how we keep your systems safe

The standard

We test against the OWASP Application Security Verification Standard (ASVS): level 1, 2 or 3 depending on the tier. We follow the OWASP Web Security Testing Guide, and test AI features against the OWASP Top 10 for LLM applications.

Every role on every endpoint

Most serious app vulnerabilities are access-control flaws: one user reading another user's data, or a normal user reaching an admin function. So we try every user role against every endpoint in scope, and record the result in the coverage matrix.

How a finding is proven

A finding goes in the report only after a person has reproduced it. Each one comes with the request and response, a screenshot where it helps, the impact in plain words, and the fix.

Rules of engagement

• We start only after the order and a written authorisation from the system owner are signed.
• We test only the hosts and accounts in scope, in the agreed window.
• Request rate is agreed per target. The default is five requests a second.
• Staging first where possible. No destructive actions in production, no denial-of-service tests.
• You get an emergency phone number. One call stops all testing.

Your data

We use test accounts and test data where we can. Evidence is stored encrypted in the EU and deleted after the engagement on a schedule set in the order. Source code is used only for Diepgaand, and only with your written consent. A processing agreement is part of every order.