Built it with Ai? Make sure your business can rely on it.
Ai made software cheap to create. It did not make software cheap to own.
You built an app with Claude Code, Cursor, Lovable, Replit or a no-code tool, and it works. Now the business depends on it, or customers are about to. We review it independently, find what would worry a customer, insurer or investor, and give you a plan to fix it before they ask.
When people come to us
- A customer has sent a security questionnaire and you're not sure how to answer it.
- You're about to put customer or personal data through the app for the first time.
- A tender or a bigger customer wants evidence of how the software is run.
- Your insurer is asking questions about the systems you depend on.
- An investor or buyer is about to look at the product.
- The person who built it is leaving, or is the only one who understands it.
Two routes
Built it for your own business
Your team has built an internal tool, a customer portal or an automation, and the business now runs on it. Three steps, and you can stop after any of them.
- Review. A fixed-price production readiness review. You get a score, the findings in priority order and a clear verdict.
- Fix. We fix the critical and high findings and build the evidence a customer or insurer will ask for.
- Look after it. A monthly check that keeps it safe and running as it changes, without hiring a CTO.
Building it to sell
You're building software to take to market. We give you a structured route from idea to launch: architecture and decision records, security and where the data is held, the evidence an investor or buyer will ask for, a launch and marketing plan, and finance and accounts through the wider TNT group. Priced to the product once we've seen it.
What the review covers
Six areas, checked against recognised references (OWASP ASVS and Top 10, NCSC secure software guidance, ISO 27001 controls and UK GDPR, with ISO 42001 where the app itself uses Ai to make decisions).
- Ownership and architecture. Who owns the code, the accounts and the data, and how the pieces fit together.
- Identity, security and data isolation. Logins, permissions, secrets, and whether one customer could see another customer's data.
- Data and privacy. What personal data the app holds, where it's held, and who it's shared with.
- Reliability and recovery. Backups that have actually been restored, monitoring, and what happens when something breaks.
- Change and maintainability. How changes are tested and released, how they're rolled back, and whether someone other than the builder could take it on.
- Commercial assurance. The evidence a customer, insurer or investor will ask for, and whether you can produce it.
What you get
- A production readiness scorecard
- Findings graded critical, high and medium, in the order to fix them
- A verdict: safe to rely on, safe with conditions, or not ready
- A keep, fix or rebuild recommendation
- A 90-day action plan
- A one-page picture of the architecture and how data moves through it
- A walkthrough of the findings with you and whoever built it
The report is yours to keep, and any developer can work from it, whether or not we do the fixes.
Prices
All plus VAT. The review has fixed prices because its scope is fixed; everything else starts from the figure shown and is fixed once we've agreed the scope.
Production readiness review
| The app | Price |
|---|---|
| Internal tool, low-risk data | £1,950 |
| Internal tool holding personal or commercially sensitive data | £2,450 |
| Customer-facing or multi-tenant | from £2,950 |
- Production and customer assurance sprint: from £5,500 for an agreed scope, starting from the review.
- Technical stewardship: from £1,500 a month, after a review, with a three or six month minimum.
- Diligence readiness, for a software business heading for investment or sale: from £5,500.
- Building it to sell: priced to the product once we've seen it.
Prices last updated 25 October 2026.
What it isn't
- It isn't a penetration test. Where the risk calls for one, we'll recommend an independent CREST-accredited tester once the fixes are in.
- It isn't a certification audit. We map the findings to ISO controls, but the review doesn't certify you to anything.
- It doesn't make the software "secure" for ever. It tells you where the version we reviewed stood on the day we reviewed it, and what to do next.
Who does the review
Tommy Findlay, Chartered Engineer, ISO/IEC 27001 Lead Auditor and ISO/IEC 42001 Lead Implementer, who builds production software with the same Ai tools our clients use. We run the same review on our own software.
Questions
Do you need access to the code?
Yes, read-only where we can: the code repository, the hosting and database accounts, and a short walkthrough from whoever built it.
Is it only for software built with Ai?
No. No-code builds and apps written by a small in-house team or a freelancer get the same review.
Do we have to use you for the fixes?
No. The report is yours, and any developer can work from it.
Is this an audit?
We call it a review because it isn't a certification audit. It uses the same discipline and the same references an auditor would.
Not sure where your app stands?
Book a 20-minute call. Tell us what you've built and who relies on it, and we'll tell you which review fits and what it costs.
Want a wider view of the business first? Take the 3-minute scorecard.