Our agency will do web and mobile application API penetration testing and security audit

Yes, and we require it in writing before we start. You must own the application or hold documented authorisation from the owner. We supply a short scope and authorisation form with every order.

No. We test non-destructively by default and avoid denial-of-service and load-generating techniques entirely. If you would rather we work in staging than production, just say so.

Yes. The report is formatted for exactly that: scope statement, methodology, executive summary and technical findings. Tell us the framework and we map findings to controls.

Yes, as a managed option. Where independence is formally required, we scope and manage the engagement with an established independent firm, then run remediation with your team. Message us to discuss.

Basic is an authenticated scan with every false positive removed by a human. Standard is hands-on manual testing, including business logic and access-control flaws that no scanner detects.

Message us first. Mobile is scoped separately because it covers the app binary, the API behind it, and platform-specific storage checks.

Yes, on Premium. One retest of the findings we reported, within 30 days of delivery, at no extra charge.

Under NDA. We sign yours or provide ours. Findings, credentials and the report go only to the people you name, and we delete our working copies 30 days after delivery on request.