Plain English
A report your whole team can read, with what to fix first.
Nothing changes without you
We test safely, and ask before anything that would touch your live records.
You keep the keys
The system stays yours. We help you own every login it depends on.
Home-grown, and proud of it
You grew something that works. That’s the hard part.
Tools like Lovable, Replit, Bolt, Cursor and Base44 let a business build in weeks what used to take a software house a year. Nobody should apologise for that. An order portal, a booking system, a job planner: if it saves your team hours every day, it has earned its place.
But it got there quickly, and nobody has checked it since. That’s what we do. We won’t ask you to rebuild it or hand it over unless you want to. We make it safe to keep.
What the audit covers
Three questions most home-grown systems can’t answer yet.
Who holds the keys?
Every login, account and outside service your system depends on, and who really controls them. A whole business can end up resting on one free email account and one person’s memory.
What could a stranger see?
Open data, exposed passwords and secret codes, weak sign-ins, and anything that lets someone reach further than they should. Then we test what we safely can.
Does it hold up on a real day?
We follow the work through the system as your people use it, at the office desk and on the phone in the van, and find what breaks and what nobody has noticed.
The business risk
If one person holds it all together, that’s a business risk.
A home-grown system usually lives in one person’s head and one person’s accounts. If they leave, fall ill or just go on holiday, your business depends on what they remembered to write down.
How it works
A clear job, with a clear end.
We talk
Tell us what you’ve built and what it connects to. We agree the scope and the price before anything starts.
We map it
We draw how your system really fits together, including the spreadsheets, connectors and outside services around the app.
We check and test it
Security, ownership and safe testing. If something is urgent, we tell you straight away instead of saving it for the report.
You get the report
Clear and graphical, in plain English: what could go wrong, what to fix first, and what’s worth doing later.
Example report
See exactly what you’d get.
Read a full report for a fictional builders’ merchant, from the summary to the runbook. It has 37 pages, and you won’t need an IT department to read them.
Looking after it
Go on holiday.
The person who built it shouldn’t be all that stands between your business and a bad Monday. After the audit, we can stay on and keep an eye on things, or take the whole system on for you.
Live monitoring
Checks chosen around how your business really runs, with warnings sent to the right people.
Real-world user testing
Your system used the way your staff and customers use it, on the same devices, with a note of what trips them up.
Cover when the key person is away
Someone who understands your system, ready to step in when the person who built it is off.
A support address
One place to send questions and problems, and a quick response when you use it.
Each one stands on its own. Pick any, in any order. Or hand the whole thing to us.
“The risk isn’t in using AI. The risk is not applying the right safeguards when the stakes are high.”
National Cyber Security Centre, June 2026. What that means for your app.
Who it’s for
Small businesses that built something real.
Owners, operations people and in-house tinkerers, in any trade, whose home-grown system has quietly become the way the business runs. You don’t need to be technical. If you can tell us what the system does, that’s enough.
Practical help
Start with what you can check yourself.
10 checks you can do today
Ten checks a business owner can do this afternoon, with no technical knowledge.
Is a vibe-coded app safe?
What the NCSC says, what the numbers really show, and how to judge your own app.
What a breach costs
The Government's survey says the typical direct cost is £0. That isn't the whole story.
Questions
What people ask first.
Is my Lovable, Replit or Bolt app secure?
It may well be, but nobody can tell just by using it. These tools build quickly, and who can read your data often comes down to settings that were never checked. An audit gives you a straight answer.
Will the audit break anything?
We test with care, and we ask for your go-ahead before any test that would create a record on your live system.
Do you need my passwords?
We need access to look properly, and we agree with you how that works. You keep control of every login, and passwords are never written in our report.
Do we have to rebuild our system?
No. We aren't selling a rebuild. The report sets out what to fix and in what order, so that you can keep the system you have wherever that makes sense.
Is this a penetration test?
Not a formal one. It's a review of your whole system with safe, careful testing, written for the people who run the business. If a customer or insurer needs a certified penetration test, tell us and we'll say so up front.
What does it cost?
It depends on how many systems are involved, so we quote each job. You'll have the price before we start.
Find out where you stand.
Tell us what you’ve built. We’ll agree the scope and the price with you before anything starts.