Menu

Building applications with AI is fast.

We keep the quality in check: security, tests, documentation, architecture and more.

Continuous, automated checks for development teams, on evidence. We read your code and the evidence from your own CI, with read access only, and show for each part what is proven and what isn't. We check; you build.

AI helps us read the code, fixed scans do the rest, and every finding points to its proof: a file and a line, a CI report or a scan result. We are accountable for the check. We fix nothing: you build and decide for yourselves what to fix.

Join the pilot

By invitation. We only ask for read access to your code.

Soon we'll show what a check looks like in a short demonstration.

Why now

With AI assistants a team builds faster than ever. But code isn't a product yet. A product is also an architecture that holds, tests that prove it works, security and documentation.

AI speeds up the writing. The rest has to keep up, and the faster the pace, the faster it falls behind. A manual check once a year can't keep up with that. An automated check on every new version can. That is where development is heading, and we're starting now.

  • The team builds faster with AI. Reviews and tests don't keep that pace by themselves.
  • The pipeline is green, but nobody can say which tests ran for last week's release.
  • A customer sends a questionnaire about NIS2. The answer is spread over tickets, pipelines and people's heads.
  • The documentation was already behind. With every quick change it falls further behind.

What we check

The four where it usually starts, each with its evidence. Below them, everything we look at.

Everything we look at

Twelve parts. In the pilot we go deep on some; for the rest we show what's there and what's missing.

Code
Quality, complexity, hotspots and dead code
Security
Secrets, vulnerable dependencies and the known risks on the OWASP list
More about this: Security scan
Legal and compliance
GDPR, cookies, licences, NIS2 and accessibility
More about this: GDPR and cookies
Documentation
Present, thin or missing, against a fixed catalogue
Quality
Tests and test coverage, proven through your own CI
Optimisation
Performance, cost and outdated dependencies
Architecture
The structure, how parts work together, technical debt
More about this: Technical debt
Maintainability
Runtimes and frameworks without updates, lockfiles, the update policy
More about this: Dependencies
Data
The data model, retention, backups and recovery
Continuity
Whether the knowledge sits with one person, from the git history
More about this: Continuity
Process and delivery
How often you release, the lead time and the CI itself
AI risks
Hidden instructions in your code, and instruction files for AI assistants

How to read the evidence

Tested by you, checked by us
The CI report belongs to this commit, the tests passed, and we checked it.
Reported by you, not checked
There is a claim or a report, but it doesn't belong to this commit or can't be checked.
Not proven or failed
No evidence, or the evidence shows it fails. Always with the reason.
Not applicable
The part doesn't apply to this application.

How the pilot works

Four steps. You're not committed to anything: we first want to learn what this is worth to you.

  1. You get an invitation

    Sign up with the form. If your application fits, we invite you to a workspace of your own. There you read in plain words what we do and what we don't, and you agree.

  2. You connect your code, read-only

    You give read access to your repository and your CI, on GitHub, GitLab, Bitbucket or Azure DevOps. We can't change anything, and we never touch your code.

  3. The first check starts by itself

    As soon as your code is connected, the scans and the inspection run automatically. In your workspace you see every check with all its parts and findings, only with evidence, a traffic light per subject and how it develops over time.

  4. We ask what it is worth to you

    In your workspace's chat we ask what you thought, what was most useful, what should improve, and what it would be worth to you. That is where the price comes from, later.

Join the pilot

Which applications, and what we don't do

Web applications with code in Python, TypeScript or JavaScript. That's where we go deep, and where we start.

Your code lives on GitHub, GitLab, Bitbucket or Azure DevOps.

We also look at your public site, read-only: the cookie banner and trackers before consent, the privacy statement, security headers, TLS, security.txt, third-party scripts and outdated libraries. We stop at the first sign of a vulnerability and never go deeper: it is not an attack and not a penetration test.

Is your application written in PHP, Java, C# or another language? Then it doesn't fit the pilot yet.

Backend
  • Python: Django, FastAPI, Flask
  • Node.js: Express, NestJS
  • TypeScript and JavaScript
Frontend
  • React and Next.js
  • Vue and Nuxt
  • Angular
  • Svelte

What we don't do

  • Change your code: we only read
  • Execute your tests ourselves: we read the evidence from your own CI
  • Attack or penetration-test your site, or pull personal data from it
  • Build, test or release: that's yours
  • Promise that you are compliant or certified

What you can expect from us

Read only
We ask for read access to your repository and your CI, nothing more. You withdraw it yourself whenever you like.
Evidence with every finding
A file and a line, a CI report on a commit, or a scan result. What can't be checked doesn't go in your view.
A live view for every role
A traffic light per subject for the board, what it means for product and operations, and for developers exactly where it is and what you can do about it.
Secrets stay secret
A password or key we find is never shown and never goes to an AI model. We advise you to replace it.

What you always keep

  • Your code, in your own repository
  • Control: you build, test and release
  • Your view of what we checked, for as long as we work together
  • A list of what leaves the EU
  • A team that answers your questions
  • No price we impose: first we ask what it is worth to you

What you probably want to know

What does it cost?

We don't name a price yet, because we first want to hear what this is worth to you. We ask you that in the chat after the first check has run. You're not committed to anything.

Do you use AI?

Yes, and we're glad to say so. Fixed scans do most of the work, without AI. AI also reads through the code, and every claim must point to a file, a line or a report, or it doesn't go in your view. We are accountable for the check.

Does an AI model get to see our secrets?

No. Passwords and keys the scan finds never go to an AI model, and files such as .env are skipped. If we find a secret, we advise you to replace it.

Do you run our tests?

Not yet. We read the evidence from your own CI, such as GitHub Actions, GitLab CI or Azure Pipelines: which tests ran, on which commit, and whether they passed. A claim without a report counts as not proven.

A team already works on our software. What does this mean for them?

That they get evidence for their work. We check; they build, test and release. Every finding shows the file and line, so a developer sees straight away what it's about.

Why a pilot?

Because we first want to learn what you need and what it's worth. You see everything we check, we get your honest opinion.

Sign up for the pilot

The pilot is by invitation. Sign up, we check whether your application fits and email you. You connect your repository with read access only, the first check starts by itself, you see what is checked and what is proven, and then we ask what it is worth to you. Have a question first? Ask it in the message below.

Our team

Reads every sign-up and every question

Our team reads what you send and answers by email. A conversation only happens if you ask for one: with the people who do the work, not a salesperson.

We only use your details to respond to your sign-up. The website doesn't keep your request.