Who owns it
Which account owns the app, the database, the web address and the bills? Is it the business, or one person’s personal email? What would happen if that login were lost? Who owns your system?
Open data
Can someone who isn’t signed in read your customers, prices or orders? Can one signed-in customer read another’s? This is the most serious thing we regularly look for. Access rules explained
Secret keys
Are the codes that unlock your database and outside services hidden, or are they sitting in code that every visitor’s browser downloads? Secret keys explained
Signing in
Who can create an account? Is the email address confirmed? Can someone guess or reset their way in? Is two-step sign-in on for the accounts that matter?
Who can do what
How many people are administrators, and do they need to be? Does the app itself enforce the roles, or does it just hide the buttons? Can a former employee still sign in? A leavers’ checklist
Connectors and spreadsheets
What moves data between your systems, what login does it use, and what could it change? Who can edit the spreadsheet your app trusts? Spreadsheets and connectors
Silent failure
If a nightly copy stopped, an order email went astray or a payment failed, who would be told, and when? Often the honest answer is “a customer, eventually”.
Getting it back
Are there backups? Has anyone ever tried restoring one? Are they held somewhere that survives losing the account?
Personal data
What personal data do you hold, where does it go, and who can reach it? Does your privacy notice cover the system? We aren’t lawyers, but we can show you the facts your adviser would need. UK GDPR and your app
People
How much depends on one person? Could somebody else keep it running for a fortnight using what’s written down? Key-person risk
Everyday use
Does it work properly for each kind of user, on the devices they really use? We note what’s broken or confusing, and what would make the system better.
What we don’t do
We won’t attack your system in ways that could bring it down, we won’t test other companies’ services beyond your own use of them, and we won’t download your data to prove a point. We stop at the point of proof and tell you what we found.
We also don’t grade your code for style. A system can be untidy and safe, or tidy and wide open, and what matters is what could happen to your business.
Last updated 6 November 2026.
