Fair questions,
honest answers.

No. Our review uses public information only — published databases and what your site already shows every visitor. We do not scan, probe, or test your systems. Any active testing happens only after you sign an agreement authorising it.

Yes. Reading publicly available information is legal. What is not legal — and what we never do without written authorisation — is actively probing or testing systems we do not own. That line is exactly why our standard review stays entirely on public data.

Those messages use fear and vagueness to pressure you. We do the opposite: we tell you exactly what data we used and where it came from, we give you a free summary with no obligation, and we never withhold something urgent to force a sale. If we find something serious, we tell you either way.

A high-level summary of the public security signals we found — enough to understand whether you have exposure worth addressing. The full findings, evidence, and step-by-step remediation come in the paid report.

Because the signals we found are public, and we think a business owner should know about them. There's no cost and no obligation. If you'd rather not hear from us, tell us once and we'll stop.

We keep it minimal, use it only to prepare your review, never sell it, and delete it on request. If you engage us, it stays confidential under our agreement. We publish our own security.txt and follow the same standards we recommend to you.

Both. The report includes a prioritised fix list you can hand to any team. If you want us to do the work — including authorised penetration testing and hands-on remediation — that is our ongoing-protection engagement.