We audit apps, their code and the way they are delivered, then show you what to fix first. Leaders bring us in when a platform is losing users or slowing down, when a vendor's work needs an independent check, or when a rebuild is on the table. Every finding is graded and backed by evidence you can verify.
Take one on its own or combine them. We scope each audit around the decision you need to make.
Product and UX01
App experience audit
For apps with healthy downloads and weak engagement. We find where people drop off and why, then set a clear direction for the product.
What it covers
Product positioning and the app’s role in your business
Funnel diagnostics, from registration to retention
End-to-end journey mapping
Usability and heuristic evaluation
Feature architecture and information hierarchy
Competitive benchmarking
Performance as users feel it, from load times to unresponsive taps
You get: an audit report, a prioritized roadmap and sample redesigns of key flows.Recently: a mall companion app, over eight weeks.
Code and security02
Source code and security review
A read-only review of your repositories. We trace what the code does and grade each finding against published security and engineering standards.
What it covers
Architecture and integration boundaries
Committed secrets and credential handling
Authorization on every API operation
Cryptography and token handling
Dependency and platform currency
Configuration defaults and error telemetry
Test coverage
You get: a findings report graded by severity, a separate recommendations document and a fix-first list.Recently: the backend, mobile app and admin console behind a retail app.
Delivery and vendors03
Delivery and vendor audit
For platforms that vendors build or run. We check how the software is built, tested, released and supported, and whether vendors deliver what they signed up for.
What it covers
Development process, gating and code reviews
QA practice and escaped defects
Performance, stability and monitoring
Infrastructure, disaster recovery and L1 to L3 support
Vendor accountability, SLAs and escalations
Security and operational risk
You get: an audit report, a remediation roadmap, and a governance framework and playbook.Recently: a bank’s new mobile banking app, over two rounds.
Not sure which you need? Book a consultation and tell us what's worrying you.
The standards we measure against
The method is ours. The benchmarks are published standards that your own teams, auditors and regulators can check for themselves.
Application security
OWASP Top 10
OWASP MASVS
OWASP Mobile Top 10
Secure development
NIST SSDF (SP 800-218)
NIST SP 800-131A
CIS Controls v8
Quality and architecture
ISO/IEC 25010
Twelve-Factor App
DORA metrics
Security and privacy compliance
ISO/IEC 27001:2022
PCI DSS v4.0.1
Data Privacy Act of 2012
How an audit runs
Step 1
Align on the question
We agree the objectives, scope and success measures, and the journeys or systems that matter most.
Step 2
Gather evidence
Documents, analytics, repositories, test and monitoring reports, contracts and SLAs, plus structured interviews with your teams and vendors.
Step 3
Review and test
Each area is assessed against published standards. Where existing reports fall short, we can run our own performance, usability or risk tests.
Step 4
Grade the risks
Every finding is graded by severity and likelihood, then grouped by root cause so one fix can close several symptoms.
Step 5
Report and roadmap
An executive presentation, the full report and a prioritized roadmap with owners and timing.
Step 6
Support adoption
Frameworks and playbooks your teams can adapt, and support while the first changes go in.
Each audit has a project manager and specialists matched to the scope, including UX strategists, business analysts, technical consultants and quality engineers. If you want help with the fixes, our development teams can take them on.
Our method
Evidence you can check
Every conclusion is tied to the evidence behind it, and every finding records which of four tiers that evidence reached. No finding is marked Confirmed on Tier 1 evidence alone.
Tier1
Self-declaration
Manifests, package names, comments and documentation.
Tier2
Structural corroboration
Directory layout, naming and module organization.
Tier3
Differential proof
A direct comparison against a known reference release.
Tier4
Behavioral proof
An executed path traced end to end.
Seven safeguards, because we also build software
An audit can lead to work we would be paid to do, so every audit follows the same rules.
01We argue for your current system in good faith before reaching any conclusion.
02Findings and recommendations live in separate documents, so you can accept one and reject the other.
03Cost claims carry confidence levels, just as code claims do.
04Decision criteria are fixed before the evidence is weighed.
05Coverage is stated plainly, including what we did not examine.
06We show the arithmetic behind every estimate.
07We name our commercial interest outright.
Typical audit timelines
Every audit is scoped to the question you need answered. These are the ranges we plan around.
App experience audit
Product, funnel, journeys, usability and performance
6 to 12 weeks
Full-scope delivery audit
Development, performance, usability, operations, vendors and risk
About 2 months
Start2 wk4 wk6 wk8 wk10 wk12 wk
Source code reviews are planned around the number and size of the repositories in scope. Post-audit support begins once the report is delivered.
Questions about software audits
What leaders ask us before they commission an audit.
Start with the questionTell us the decision you need to make. We'll scope the audit around it, and say so if what you need is something else, such as a penetration test.Book a consultation
Whatever you need answered. We can review the app experience, the source code and its security, and the way the software is built, tested, run and supported, including the vendors involved. Take one area or all of them.
Common moments are when an app is losing users or slowing down, when a vendor’s delivery needs an independent check, before a major launch, and when a rebuild or a new platform is being considered.
Very little. Our source code reviews are read-only: we clone the repositories, change nothing and run no write operation against your systems. Interviews and workshops are scheduled around your teams’ calendars.
Not always. We can work from documentation, repositories and test environments. Where a finding depends on a production setting we cannot see, we say so and grade it as conditional until you confirm the value.
No. An audit establishes what your software and its delivery actually do, measured against published standards. It is not a penetration test, an attestation or a compliance certification, and every report states what was and was not examined.
It could be, which is why we name it in every report. Findings and recommendations are delivered as separate documents, decision criteria are fixed before we weigh the evidence, and we argue for your current system in good faith before recommending any change.
Under our information security management system, which is certified to ISO/IEC 27001:2022. Reports with security findings are classified confidential, and summaries meant for wider circulation leave out exploit-level detail.
Tell us about the platform and the decision you are facing. We will propose a scope, a team and a timeline, and agree with you on the access and documents we need before work begins.
We use analytics cookies from Google Analytics and HubSpot to see how people use this site, so we can improve it. By continuing to use this site, you agree to our use of cookies.
