Three packages, a fixed price, retest included

Three levels of depth. After a short scope call you get a fixed price for your app, so you know the cost before we start.

The baseline every app should meet.

Scope: 1 web app or API, up to 25 endpoints, 2 user roles
Depth: OWASP ASVS level 1, every role
Included: Report, signed attestation letter, 1 retest within 90 days, same-day alert on critical findings
Report ready: 5 working days

Recommended

For apps that hold personal or business data.

For apps where a lot is at stake.

Scope: Up to 2 apps, 150 endpoints, 5 user roles
Depth: OWASP ASVS level 3 where it applies; source code read alongside the live test; a threat-model session first
Included: Everything in Standaard, plus a second retest
Report ready: 15 working days

We quote in EUR or USD. Report ready counts from the first test day.

What you provide

A scope list: URLs and API documentation
Test accounts for each user role
A test or staging environment, if you have one
Source code, for Diepgaand
Written permission from the system owner, and from your hosting provider where needed
A contact person during the test window