AI Hardening

Your AI-built app works. Is it safe?

Apps built with Lovable, v0, Bolt, Cursor, or Claude Code work brilliantly as demos, and ship without the security a real product needs. We score exactly how exposed you are, in plain English, then fix it at fixed prices. AI does the scanning at machine speed; a named assessor signs every score. Find out yours.

See the assessment menu

Aligned to OWASP ASVS L1 · Cyber Essentials · CIS Controls IG1

Free qualifier · 7 questions, about 2 minutes

1 / 8

Primarily built with?

No calls unless you ask. Preferences remembered everywhere.

What we score

Eleven areas. One number out of 100.

This isn't a number we invented. The eleven areas are the same canon every report is delivered on: the three carrying the greatest business risk score double. The security-critical areas are anchored to the recognised entry standards: OWASP ASVS Level 1 (Broken Access Control is #1 in OWASP's 2025 Top 10, found in some form in every application its data covered), the UK's Cyber Essentials, and CIS Controls IG1, with accessibility and speed held to WCAG 2.2 AA and Core Web Vitals. Whoever built your app, the same eleven areas apply; green across all eleven means you are aligned with those standards, and certification itself is a separate, independent step. We'll publish the average score once enough signed client reports stand behind it.

Hosting, infrastructure & estate

Where your app lives and whether it comes back: backups with tested restores, domains and DNS that never lapse, scheduled jobs that never silently stop.

Cyber Essentials · CIS IG1

Fix: Deploy & Monitor

Security & secrets

×2

Your keys and your customers' records. Out of the code, out of the browser, and rotatable the day one leaks.

Counts double in the /100 score

OWASP A02+A05 · ASVS L1 · Cyber Essentials

Fix: Secrets & API Security

Authentication, access & tenancy

Who can get in, what they reach once inside, and hard proof one client can never see another's records.

OWASP A01+A07 · ASVS L1 · CIS IG1 · Cyber Essentials

Fix: Auth & Access

APIs, integrations & vendors

Every connection inventoried. What retries, what alerts, whose account it runs under, and which plan stands behind it.

OWASP A05 · CIS IG1

Fix: Deploy & Monitor

Data, privacy & GDPR

×2

The GDPR and privacy basics your clients and insurers will ask you to prove: jurisdiction, deletion on request, database rules.

Counts double in the /100 score

GDPR · Cyber Essentials mapping

Fix: Database Lockdown + Data & Privacy

Code control & handover

×2

Version history beyond one laptop, docs a new developer could pick up, dependencies checked, never hostage to whoever built it.

Counts double in the /100 score

OWASP A06 · CIS IG1

Fix: Deploy & Monitor

Deployment & change management

How changes ship: a pipeline rather than a hand-copy, staging before live, and a rollback that has actually been tested.

OWASP A05 · ASVS L1 · CIS IG1

Fix: Deploy & Monitor

AI / prompt layer

Prompt injection, leaked secrets, unchecked output, runaway model bills. The new attack surface AI-built apps ship with.

OWASP LLM Top 10

Fix: Input & Injection

Operational readiness & incident response

You find out before your customers do: monitoring, clean logs, runbooks, and who to wake at 2am.

OWASP A09 · ASVS L1 · CIS IG1

Fix: Deploy & Monitor

Accessibility & inclusive experience

Usable by screen reader, keyboard, and low vision. A legal duty in the UK and, since June 2025, across the EU.

WCAG 2.2 AA · UK Equality Act · EU Accessibility Act

Fix: scoped from £1,000 a day

Performance & user experience

Fast as users actually feel it, on a real phone on mobile data, measured, not assumed.

Google Core Web Vitals

Fix: scoped from £1,000 a day

How it works

Qualify → Assess → Fix → Keep it green

Everything is bought online, off a menu, at a fixed price. A call is only ever needed for enterprise scope.

Qualify

Free

Seven questions, about two minutes. We capture your stack, score your readiness, and recommend the right assessment, no code review, no obligation.

Assess

from £1,500

A paid deep-dive of your app. You get a plain-English report: your score out of 100, eleven Red/Amber/Green areas, and what each problem costs you if you ignore it.

Fix

fixed prices

Every red section maps to a fixed-price fix. Build your own remediation plan from the menu, no quotes, no discovery calls, no surprises.

Keep it green

from £29/mo

A low monthly Portal Licence keeps your dashboard live, re-scans as your app grows, and flags new risks before they become incidents.

Assessments

Buy the assessment. Get your score.

Every tier produces the scored report: your number out of 100, the eleven-area RAG register, the cost of doing nothing, and an itemised fix quote. Prices shown ex VAT, localised with tax added at checkout.

Prices ex VAT, billed in GBP. USD/EUR shown for reference. UK customers pay 20% VAT, added at checkout; customers outside the UK are not charged UK VAT.

Essential Review

£1,500from · $1,950 / €1,800

A real professional review at an easy online yes

✓Automated scan plus focused human validation
✓Plain-English RAG report with prioritised findings
✓ROI figure and an instant fix quote
✓Upgrade credit toward a Deep-Dive within 60 days

By buying you accept the Terms of Sale.

Deep-Dive Assessment

Tender Enabler

Premium

£7,500from · $9,750 / €9,000

The premium tier, assessment plus a build-ready remediation spec

✓Everything in the Deep-Dive Assessment
✓Build-ready tender / remediation specification any firm can quote against
✓Light penetration test of the exposed surface
✓Scalability and compliance-gap review
✓Investor / due-diligence-ready summary

By buying you accept the Terms of Sale.

Enterprise, regulated, and multi-app estatesbespoke audits from £12,000+

Above the menu, fixed prices stop being honest. Estates get a scoped audit and a named consultant instead. Pick a time that suits and a consultant will scope it with you; tecno is in the corner of every page if you'd rather ask a question first.

✓Estate-wide coverage: every app, service, and environment in scope
✓Backup, restore, and disaster-recovery validation
✓Compliance mapping across your frameworks, SOC 2, GDPR, HIPAA, with an audit-evidence checklist
✓Target-state architecture blueprint
✓Full tender pack: remediation spec, vendor evaluation criteria, and Q&A support through your tender
✓Executive readout for board or procurement

Not sure which tier? The free qualifier at the top recommends one in two minutes. Every report is yours to keep, and the Tender Enabler's remediation spec can be put in front of any engineering firm, including us.

The gap

What breaks first when a prototype meets production

These six failure modes appear in almost every AI-built application we assess. None of them show up in a demo. Every one of them maps to a fixed-price fix on the menu below.

Authentication & tenancy

Prototype auth is usually a single role and a shared database. Real products need proper session handling, role-based access, and hard tenant isolation.

Secrets & configuration

API keys pasted into client code or committed to the repo are the most common finding in our assessments, and the fastest way to a breach.

Data layer

No migrations, no backups, no integrity constraints. The first schema change or bad deploy becomes a data-loss incident.

Security & compliance

Input validation, audit logging, encryption at rest, data residency: invisible in a demo, mandatory the moment real customer data arrives.

Cost & performance

LLM calls in hot loops, unindexed queries, chatty APIs. Prototypes are engineered for 'it works', not for a cloud bill or a p95 latency budget.

Observability & operations

No logs, no alerts, no runbooks. When it breaks at 2am, and it will, nobody knows until customers do.

Fixes

Fixed-price fixes. No quotes, no discovery calls.

Every red or amber section in your report maps to one of these. Prices are metered by what the qualifier already counted: roles, APIs, databases, connectors, so your quote is instant and exact.

Hardening Sprints: the bundles

The main way to buy: everything your report flagged, fixed in one scoped sprint. Scope bands are measured in the same units the qualifier counts.

Starter Harden

from £3,000

~1 week

≤2

Roles

≤3

APIs

Databases

≤2

Connectors

Configure this sprint

Standard Harden

Popular

from £7,500

2–3 weeks

≤5

Roles

≤8

APIs

≤2

Databases

≤5

Connectors

Configure this sprint

Full Production Harden

£12,000–£15,000

3–6 weeks · Includes deploy to production

≤10

Roles

≤15

APIs

multi

Databases

≤10

Connectors

Configure this sprint

Sprint configurator: size it, trim it, buy it

Set the meters the qualifier counts and take out any work streams you don't need. The band and price update as you go. The same senior engineers deliver whatever shape you choose.

Beyond the top band, or rebuilding beats patching?

Above these limits the fixed-price promise stops being honest, so we scope it with you directly instead.

Or fix one thing at a time: the rate card

Every Fix Pack is à la carte: pick the section your report flagged and buy just that fix. Three or more usually costs more than the matching sprint. The bundle is deliberately the better deal.

Rate card: choose a fix pack

Closes the Login & Access Control section. The #1 way applications get breached, AI-built or not.

What you get

✓Managed authentication implemented or repaired, with secure sessions
✓Access control enforced server-side for every role you have
✓The broken-access paths from your report closed and re-tested

Rate

£950

+£180 / extra role

extra roles

up to 8, beyond that, a sprint or scoped call

Fixed prices, ex VAT, through Stripe secure checkout. Every pack is scoped by the caps shown. Your report tells you which sections to pick, and tecno can walk you through it.

Blueprints

Haven't built it yet? Build it right the first time.

Everything above fixes apps after they exist. The AI Blueprint is the other path: stable foundations before your first prompt, so the tangled build that needs rescuing never happens. AI drafts your blueprint at machine speed from a proven master; a named engineer stands behind every sign-off. Prices shown ex VAT, localised with tax added at checkout.

Blueprint Pack

£299from · $399 / €359

The master blueprint, stable foundations at a self-serve yes

✓The master blueprint: proven architecture patterns for SaaS, portal, and AI-app builds
✓Guardrail files for Lovable, v0, Bolt, Cursor, and Claude Code, your AI tools build to the blueprint, not around it
✓The stack decision tree: choose auth, database, hosting, and payments once, correctly
✓The eleven-area foundation checklist. The same canon every assessment scores
✓Fee credits toward a Signed Blueprint within 60 days

By buying you accept the Terms of Sale.

Signed Blueprint

Foundation Build

Premium

£2,950from · $3,850 / €3,550

We pour the foundations. You build the product.

✓Everything in the Signed Blueprint
✓Foundations laid live: repo, managed auth, database with row-level security, CI/CD with staging, monitoring wired
✓Guardrail files installed so your AI tools inherit the architecture from the first prompt
✓A handover session. You vibe-code the features on ground that holds
✓Launches assessment-ready on the same eleven areas the score measures

By buying you accept the Terms of Sale.

Rather we built the whole thing? Build For You is a fixed price and a fixed timeline, end to end. And when your blueprint-built app goes live, the free qualifier scores it on the same eleven areas it was designed against.

Keep it green

The Portal Licence

Your score changes as your app grows. A low monthly licence keeps the dashboard live, re-scans as you ship, and flags new risks before they become incidents: 12-month portal access included.

Portal Licence, Lite

£29 / $39 per month

✓Live RAG dashboard: signed score plus live posture signals
✓Automated posture re-scan, weekly
✓Change alerts when a signal shifts
✓12-month portal access

Portal Licence, Standard

Popular

£79 / $99 per month

✓Everything in Lite
✓Monthly re-assessment report, assessor-signed
✓Drift alerts routed into the help desk
✓Priority fix-quote routing

Portal Licence, Pro

£199 / $259 per month

✓Everything in Standard
✓Quarterly human review, dependency audit included
✓SLA on new-Red signals: desk ticket, clock running

The portal is watched by the same engineers who do the hardening. We harden like we'll be the ones paged, because on a Pro licence, we are. Need round-the-clock operations and incident response? Managed Services is the same team, 24/7.

Start free. Know your score this week.

The free qualifier at the top of this page takes two minutes and recommends the right assessment for your stack. Whoever built your app, the same eleven areas decide whether it is safe to run.

Start the free qualifier Need to speak to someone?