Nothing is broken yet.

Between €890 and €14,000, depending on how much code there is and what it handles. A Readiness Check on a repository under roughly 250 files starts at €890. A full audit runs from €2,400 for a single product to €8,000 and up for multi-repository or regulated systems. Technical due diligence for a funding round or acquisition is €9,000–14,000.

Repository size first, then what the system touches. Payment flows, health or biometric data, multi-tenant architecture and a history of several different vendors all add verification work, because each finding has to be reproduced before it reaches your report. We look at the repository and tell you the band before you commit – that conversation is free.

Usually not, and we’d rather say so now. The Check is a sample: it will find the obvious exposures and tell you whether a full audit is justified. If you’re processing payments or special-category data under GDPR, a shallow pass that comes back clean is worth less than nothing, because it gives you a document that says “fine” without the evidence behind it. For those systems we’ll quote a full audit or decline the work

No, and anyone telling you otherwise is selling something. We are engineers, not lawyers. What we produce is a description of what your code actually does with personal data, with file and line numbers attached, which is the input a DPIA needs and almost never gets. Your DPO or counsel decides what it means in law. We have found that the hard part was never the legal interpretation; it was establishing the facts.

That is one of the first things we check, because it is where the gap usually is. Consent tends to be captured correctly and enforced inconsistently: the banner writes a record, and two or three services downstream never read it. Nobody notices, because nothing breaks. It is a code question, it has a file and a line, and it is answerable in an afternoon.

Automated scanning plus manual review by a senior engineer, every finding reproduced by a second person, and one written report: findings with file, line, severity and reproduction steps; an effort estimate against each; a prioritised order of work; and your maintenance load in person-days per month. One call to walk your team through it is included. No upsell meeting disguised as a readout.

It’s quoted from the report itself, as a fixed scope, so you’re comparing a real number against the cost of doing nothing. You have two options and they’re priced differently: we carry out the repairs, or one of our senior engineers supervises your own developers doing it – reviewing architecture decisions and pull requests while your team writes the code. The second is cheaper and keeps the knowledge in your building.

Because we already know the codebase. The expensive part of an audit is the first read; re-running it against a known system and documenting what moved is a fraction of that. Most clients take the re-test because a fixed finding with no evidence of the fix is just a different kind of assumption.

You get a delivery date when we scope, before you sign, and we hold it. Audits are scheduled work, not a queue — we tell you honestly when we can start rather than starting late and finishing in a hurry.

Read access to the repository, a rough file count, and ten minutes on a call to hear what worries you. Not documentation — if the documentation were good enough to brief us, you probably wouldn’t need the audit.

Then the report says so, in writing, with the evidence – which is exactly what you need in front of a board, an investor or an insurer. It happens. The cleanest codebase we assessed this year had one low-severity finding. It also had the heaviest maintenance bill on our books, which is the kind of thing an audit is for.