You've never had a security test
You get a clear picture of your exposure and a prioritized list of what to fix, at a contained price.
Services · SafeCheck · Automated discovery. Human validation. Actionable remediation.
Find out where you're exposed before an attacker does.
SafeCheck is a vulnerability assessment done by people: the first phases of a pentest, without exploitation. In a few days you'll know what an attacker sees of your company, how much risk it represents and what to fix first.
USD 990fixed price
2–3 daysof testing
1 web appor up to 3 IPs/domains
Retestof critical and high findings
The outcome
When your SafeCheck is done, you'll know:
01
What's exposed
Domains, IPs, services, technologies and possible leaks: everything an attacker can see of your company.
02
What's a real risk
Not a list of 200 scanner results. Only findings confirmed by an analyst, with evidence.
03
What to fix first
A concrete 7, 30 and 60-day plan, with the exact fix for every finding.
04
What comes next
If you need to prove real impact, a pentest. If your application changes often, PTaaS.
Who it's for
The first step that makes sense.
For companies that need to know where they stand without starting with a full pentest.
You're preparing for an audit or a regulation
SOC 2, ISO 27001 or LATAM data protection laws ask for appropriate security measures. SafeCheck produces technical evidence of assessment and remediation.
You want to arrive prepared
Fix the obvious first, so the pentest focuses on the hard part. If you buy it within 60 days, we credit the USD 990.
The phases
Six phases, end to end.
The same method as a professional pentest, up to the exact point where exploitation would begin.
01
Passive reconnaissance
What is known about you without touching your systems: subdomains, certificates, DNS, technologies and public leaks.
02
Active reconnaissance
Exposed ports, services and versions, TLS configuration, headers and sensitive paths. Low-intensity traffic, within an agreed time window.
03
Vulnerability analysis
We combine tooling and AI with manual review. A person confirms every potential finding and removes false positives.
04
Risk analysis
CVSS v3.1 severity plus your business context: what data is exposed, how easy it is to abuse and what to fix first.
05
Report
Executive summary and technical detail in English or Spanish, with evidence and a remediation recommendation for every finding.
06
Guided remediation
Your team applies the fixes and we support them: a review call, answers to questions and a retest of critical and high findings.
Machine and human
Not a Nessus report with a different logo.
Tools give us speed. An analyst brings the judgment. This is exactly what each one does:
Automated · to cover ground fast
- Discovery of subdomains, DNS records and certificates.
- Port, service and version scanning.
- TLS, security header and HTTP method checks.
- Template-based detection of known vulnerabilities (CVEs) and weak configurations.
- AI to group and sort results, run without sending your data to cloud services.
Human analyst · where the value is
- Sets the scope and intensity, so your systems aren't affected.
- Reviews every result by hand and removes false positives.
- Looks for what tools don't report: exposed admin panels, forgotten files, information in JavaScript code and findings that are worse when combined.
- Rates risk based on your business, not just the generic score.
- Writes a concrete fix for your stack and walks you through it on a call.
A real example. In our own assessment, one tool reported that the site had no HSTS and another stopped with TLS connection errors. Neither was a real problem: the analyst confirmed both were caused by a server protection that drops connections without a valid domain name. An automated report would have had you chasing problems that don't exist. The result: your report only contains confirmed findings, with evidence.
What's included
- All six phases on 1 web application or up to 3 IPs or domains.
- Manual validation of every finding, no raw scanner lists.
- Report in English or Spanish: executive summary, findings with CVSS and fixes.
- Remediation plan by priority: 7, 30 and 60 days.
- Report review call with your team.
- Immediate notice if we find something critical, without waiting for the report.
- Retest of critical and high findings within 60 days.
- Recommended next step: what's worth testing in depth, and why.
What's not included
- Exploitation or post-exploitation.
- Business logic and user-to-user authorization (IDOR) testing.
- Social engineering, phishing or denial-of-service testing.
- Changes to your systems: your team applies the fixes.
All of that is part of a full pentest.
SafeCheck or pentest
Choose with the right information.
SafeCheck is not a pentest, and we don't sell it as one. If a customer or auditor asks you for a pentest, you need the second option.
| SafeCheck | SafePentest Essentials | |
|---|---|---|
| Passive and active reconnaissance | ✓ | ✓ |
| Manually validated vulnerability analysis | ✓ | ✓ |
| Risk analysis and remediation plan | ✓ | ✓ |
| Controlled exploitation and demonstrated impact | — | ✓ |
| Business logic, authorization and IDOR | — | ✓ |
| Accepted as a pentest for SOC 2, ISO 27001 or enterprise customers | — | ✓ |
| Retest | Critical and high | All findings |
| Testing | 2–3 days | 5 days |
| Price | USD 990 | USD 2,900 |
After SafeCheck
Your report tells you what's next.
SafeCheck shows your exposed surface. What happens inside your application (permissions between users, business logic, other customers' data) only a pentest reveals. On the review call we show you what was out of scope and which path makes sense for you.
NEXT STEP · ONE-OFF
Full pentest
For a customer who requires it, an audit or a launch. Controlled exploitation, business logic and IDOR.
2,900 USD · from 5 days
Your USD 990 is credited if you buy it within 60 days.
See pentestsPTAAS
Security with every release
If your application changes often, one test a year isn't enough. Periodic pentests and monitoring with human triage.
690 USD/mo
Your USD 990 is credited to your plan if you subscribe within 60 days.
See PTaaS plansFOUNDERS PROGRAM · 3 SPOTS
Pilot pentest
A full Essentials pentest at launch pricing, in exchange for a case study. Growth locked at USD 1,290/mo for the first year.
1,490 USD · until Jan 31, 2027
Ideal if your SafeCheck found issues in your app.
Apply for a spotReal example
What a SafeCheck finding looks like.
Before offering SafeCheck, we ran it on our own infrastructure. This is one of the findings, already fixed.
The same assessment confirmed the rest was in good shape: only 3 exposed ports, TLS 1.2 and 1.3 with A-grade ciphers, complete security headers and up-to-date versions. A good report also tells you what you don't need to touch.
- Location
- Web server,
22/tcp(OpenSSH) - Description
- The SSH service negotiated algorithms that are no longer recommended, such as
hmac-sha1,umac-64and MACs without encrypt-then-MAC. - Risk
- Not directly exploitable, but it weakens protection of the server's administration channel and commonly comes up in audits.
FixIn
/etc/ssh/sshd_config.d/, restrict KexAlgorithms, Ciphers and MACs to curve25519, AES-GCM/ChaCha20 and SHA-2 ETM MACs, and disable compression. Test a new login before closing the current session.VerificationThe retest confirmed the service no longer negotiates those algorithms. Status: fixed.
FAQ
Before you start.
Is SafeCheck a pentest?
No. It covers the phases before exploitation: reconnaissance, vulnerability analysis and risk analysis. That's why it's faster and more affordable, and why we don't present it as a pentest. If you need a pentest for a customer or an auditor, we recommend SafePentest Essentials.
Can it affect my site or systems?
The risk is low: we don't exploit vulnerabilities, and we use low-intensity traffic within an agreed time window, with a technical contact on your side. Any active test still carries a minimal risk, which is why we always work with written authorization.
What do you need from me?
A signed authorization letter, the list of in-scope domains or IPs, the time window and a technical contact. We don't need passwords or access to your servers.
What happens if you find something critical?
We notify you immediately, without waiting for the final report, with what you need to contain it.
Does it help with compliance?
It produces technical evidence that you assessed and fixed your security, which helps demonstrate the measures required by frameworks like SOC 2 or ISO 27001 and by data protection laws. It is not a compliance certification or legal advice.
How is it different from the free exposure diagnostic?
The diagnostic is passive only and delivers 5 findings on one page. SafeCheck adds active reconnaissance, vulnerability and risk analysis, a full report, the review call and the retest.
How do I pay?
Fixed price in USD.
What does an attacker see of your company today?
Tell us which domains or application you want reviewed and we'll confirm scope and a start date.