How the audit works

1. Step 1
   We talk

   Tell us what you’ve built

   What it does, who uses it, what it connects to and what worries you. We agree the scope, the price and how we’ll get access, in writing, before anything starts. You also confirm we have your permission to test.

2. Step 2
   We map it

   We work out how it really fits together

   We draw every part: the app, its database, spreadsheets, connectors, email and outside services. We also list every login your system depends on and who controls it. This is often the first time anyone has seen it all on one page.

3. Step 3
   We check it

   Security and ownership

   We look for open data, exposed secret codes, weak sign-ins, too much access, and places where one person holds everything. See everything we check.

4. Step 4
   We test it

   Safe testing

   We try things as a stranger would, and as each kind of user would, within agreed limits. We use test accounts, and we stop at the point of proof rather than downloading your data. If a test would create a record on your live system, we ask first.

5. Optional
   Real use

   Real-world user testing

   If you’d like, we also do the real jobs your staff and customers do, on the devices they use, and note what trips them up. More about user testing.

6. Step 5
   We think

   What would make it better

   Having lived in your system for a while, we suggest improvements. These stay separate from the risks, so you can see what’s urgent and what’s just worth doing.

7. Step 6
   You read it

   The report, and a conversation

   You get the report, and we go through it with you. There’s nothing to sign up to afterwards. If you want us to stay involved, we can, but the report stands on its own.

What a home-grown system usually looks like

Few of these systems are just an app. By the time a business relies on one, it has grown a good deal around it, and the risks tend to sit in the joins.

What we need from you

• An hour at the start, to tell us about the system.
• Access, set up in the way we agree. You keep control of every login, and passwords never appear in our report.
• Someone who can answer the odd question, and give the go-ahead for a test.
• Your permission in writing. Without consent, testing can be a crime, and writing it down protects both of us. Why a tester needs permission.

How findings are rated

Each finding is also marked tested, meaning we tried it within safe limits, or seen, meaning we looked at it. That way you always know how firm our evidence is.

Afterwards

Remove the access you gave us, and we’ll remind you. We list every change we made during the work, such as a test account, and remove what we added. Then the report is yours to use however helps you most.

Last updated 6 November 2026.