We scope the audit
A conversation with a developer to understand what the application does, what data it handles, and what worries you. You come out with a firm audit perimeter and a firm price, or with the conclusion that an audit is not warranted.
Code and security audit · Luxembourg
Your application works. But will it hold up, and hold the line?
An AI-generated prototype, an internal tool that grew too fast, a project inherited from a supplier who left: the code runs, and nobody knows what is inside it. We open the bonnet and tell you honestly what holds.
- A written, reasoned verdict: what holds, what has to be rebuilt
- Code, security, personal data and technical debt
- No obligation to continue: the report is yours
Google reviews4.9
Have your application audited
45 minutes with a developer. We look at what the application does, scope the audit and give you a firm price.
Clients who come back. Trust built over the long term.
What we do
Custom software, built to last.
Business applications designed, developed and maintained in Luxembourg, delivered with their source code.
Audit and hardening of existing applications
Your production software brought back under control, even if another vendor started it.
- Code and infrastructure audit, vulnerabilities fixed
- Maintenance and evolutions handled over the long run
- Delivered: bot protection for government websites
Custom business applications
The tool that fits your operations when no other software on the market fits.
- Integrated with your information system, hosted on your terms
- Source code and documentation belong to you
- Delivered: hybrid work management, ticketing for public works
Data, reporting and compliance
Your data centralised and made reliable, for reporting or for transfer from point A to point B.
- Filings and KPIs produced without manual processing
- Regulatory deadlines met, full audit trail
- Delivered: online tax filing, financial media data aggregation
Scoping before you invest
Workshops to decide on a known scope, cost and timeline.
- Custom build, off-the-shelf or automation: the right call for your case
- Costed, prioritised specification you can use with or without us
- Automation Pack and Vision Pack: 30 days, fixed price
The three situations we meet
It works in a demo. That is not the same as holding up.
An application that works for ten users can collapse at a hundred, expose data without anyone noticing, or become impossible to evolve the moment its author is gone.
The AI-generated prototype works, but nobody has reviewed what it does with the data or how it handles access.
The supplier has left and there is no documentation, no tests, and nobody to explain the choices made.
The internal tool grew layer by layer: every addition breaks something else, and nobody dares touch it any more.
You process personal data and you could not prove, today, that it is properly protected.
How we proceed
We look at the code, not at the demo.
The audit itself
A read of the code and its architecture, a review of dependencies and their known vulnerabilities, a check on access control and secret handling, an examination of how personal data is processed, and an estimate of technical debt. We test, we do not merely read.
The verdict, and the costing
A written report that ranks findings by severity, separates what can be salvaged from what must be rewritten, and prices the fixes. If a rebuild is required, it goes through the Vision Pack at EUR 4,999.
At the end of the audit
You know what your application is worth
A document stating what holds, what exposes you, what bringing it up to standard would cost, and in which order to do it. It is yours, whether or not you hand us the follow-up.
Eligible for the SME Package
The SME Packages programme is a State entrepreneurial performance programme funded by the Ministry of the Economy, covering up to 70 % of eligible costs, which must fall between €3,000 and €25,000 excluding VAT.
We are not an automated scanner.
A scanning tool produces a list of alerts. An audit produces a judgement: what actually matters in your context, and what can wait.
Findings ranked by severity and by cost to fix
A raw list of hundreds of alerts
A developer reads the code and tests it
An automated scanner runs and outputs a PDF
The report is yours, with no obligation to continue
The audit mainly exists to sell the rebuild
A 15-person team in Pontpierre
Audit subcontracted abroad
We tell you when nothing needs doing
Everything is always critical
Who you will be working with
A team. Not a service desk.
Fifteen people in Pontpierre, the same company since 2018. On an Automation Pack you work with the people you see here — not with a rotating consultant.
- Our Managing Partner sits in every workshop
- One point of contact, who calls you back the same day
- 4.9 on Google, and clients who come back
Everything about auditing your application
What does an audit cost?
It depends entirely on the size of the application and on what it handles: auditing a three-screen internal tool and auditing a platform processing health data are not remotely comparable. The perimeter and the price are fixed during the 45-minute call, before any commitment. We do not charge for that call.
Our application was generated with an AI tool. Is that a problem?
Not in itself: those tools produce code that works. The issue lies elsewhere. They do not reason about your context: permissions, data exposure, unmaintained dependencies, absence of tests. Those are precisely the points the audit covers.
What happens if the verdict is bad?
You get a written report, costed and prioritised, and you decide. A partial upgrade is often enough. When a rebuild is required, it goes through the Vision Pack at EUR 4,999: 30 days, 4 workshops, a complete specification and a firm price. Nothing obliges you to hand us the follow-up.
Can the SME Package fund the follow-up?
The programme covers up to 70 % of eligible costs, which must fall between EUR 3,000 and EUR 25,000 excluding VAT. The Vision Pack at EUR 4,999 sits inside that range. We prepare the application with you.
Do we have to give you access to our code?
Yes, that is the condition for a serious audit: you cannot judge an application from the outside. Access is read-only, under a confidentiality agreement, and it is revoked when the report is delivered.
How long does it take?
Scoping takes 45 minutes. The audit itself is counted in days, not weeks: the exact duration is set together with the perimeter, during the initial call.
Let someone open the bonnet who knows how to read.
45 minutes with a developer, not a salesperson. We look at what your application does, and tell you whether an audit is warranted or not.
- An honest technical opinion, even when it does not suit us
- A firm perimeter and a firm price before any commitment
- A clear answer on your SME Package eligibility for the follow-up
Have my application audited
45 minutes with a developer. We look at what the application does, scope the audit and give you a firm price.