The questions owners ask first.

No. The test is designed to leave no trace. We don't change anything on your store, we work around your busy hours, and you approve the scope in writing before anything runs.

No. We test from the outside, the way a real attacker would. Nothing is added to your theme, apps or server.

A fixed price, quoted against an agreed scope — no hourly billing and no surprises. Online prices are publishing soon; in the meantime, tell us about your store and we'll come back with a number, usually the same working day.

Quick Scan is a one-off automated check for known app flaws, exposed pages and unsafe settings, delivered as a prioritised report your team acts on. Deep Test adds hands-on testing of the logic behind your checkout and logins. Fix & Verify goes further again: we agree the repairs, make them, and re-test to confirm each one held. Watch runs after any of these, checking month to month for new flaws and suspicious changes. Not sure which you need? Start with Scan + Watch and we'll tell you if there's more worth doing.

Both, depending on the tier. Quick Scan and Deep Test give you the fix for each finding in plain English, and your developer makes the changes. Fix & Verify includes the repair work itself, then a re-test to confirm the problem is closed.

2 to 3 days for a Quick Scan, up to 7 to 10 days for Fix & Verify with the repairs included. Your store stays online and trading the whole time.

Shopify secures the platform itself. Your theme, the apps you've installed, your access keys and your settings are yours to look after, and that's where we find almost everything. The same goes for WooCommerce, Magento and a custom build.

Yes, because you authorise it. Testing only happens on stores you own, with a written scope you approve first. That authorisation is what separates a security test from an attack.

Yes. We record only what's needed to prove a finding, redact it in the report, and securely destroy any sample once the work is done. We don't sell data, we won't name you as a client, and we're happy to sign your NDA before we scope anything.

A test is a snapshot — true the day we run it. But your store keeps changing: apps update, code ships, new flaws get published. Watch keeps checking between assessments and alerts your team when something needs a closer look, so a problem that opens on a quiet weekend doesn't sit there until your next review.

Then you get something rare: written proof that your store held up under a real test. That's something you can show your bank, your insurer or a partner. Every report lists everything we checked, not just what we found.

Yes. The report is written for the store owner first: what each problem means for your money and your customers, in everyday words. The technical detail sits in a separate section for your developer, and the walkthrough call covers anything still unclear. We can deliver your report in your language.