How we audit
Careful, defined and read-only by default.
Every Axieo audit follows the same five steps, checks a defined list, and ends with a written report you can act on. This page explains the process, how we handle your data, and what we do and don't promise.
How we audit
Scope, audit, report, you fix, we verify
The same five steps for every audit, whatever we're checking.
- 01
Scope
A short call and a written scope: what we check, what we don't, the dates, and your written authorization.
- 02
Audit
Automated checks plus hands-on review by the Axieo team. Read-only where possible, and only on what you authorized.
- 03
Report
A plain-English written report with risk ratings, evidence, and prioritized recommendations, followed by a review call.
- 04
You fix, we verify
Your team makes the changes from the plan. We answer questions about the fixes, then re-test to confirm. We never change your systems.
- 05
Ongoing protection
Optional follow-up checks as your system changes, so fixed problems stay fixed.
Standards
What we check against
How we handle your data
- Written authorization first: we test only the systems, dates and test types you list and sign.
- Read-only by default. Our live checks only read, and anything else is agreed in writing in advance.
- Least access: read access to code, a staging environment where possible. No passwords needed, and we never ask for write access.
- We never copy your users' personal data. If we see some by accident, we close it, don't keep it, and note it in the report.
- Secrets found in your code are referenced by file and line, never copied into notes or reports.
- NDA available before you share anything.
- Working copies of your code and evidence are deleted after the engagement. You can ask for deletion sooner; signed documents and invoices are kept as the law requires.
The report
- A short summary written for non-technical readers, with a risk score
- Every check and its result: pass, fail, needs manual review or not applicable
- Each finding with its severity, evidence, and our recommended fix, step by step, for your team to carry out
- For Axieo Guard, a suggested prompt for each finding, written for your app, that your team can use in your AI builder
- What's already working well
- Next steps, a review call to go through it together, and a re-test once your fixes are in
Sample report · fictional app
BookNest (fictional sample)
Risk score
86
- criticalRow Level Security off on the bookings table
- criticalLive Stripe secret key in the website code
- highWaiver files in a public storage bucket
- mediumEmail confirmation off; 6-character passwords
- mediumTwo security headers missing
Honest limits
What we do, and don't, promise
We do
- Check a defined, versioned list, not whatever comes to mind
- Show the evidence for every finding
- Explain each finding and its fix in plain English
- Tell you honestly when something isn't a problem
- Give every finding step-by-step recommendations your team can follow
- Re-test after your fixes: one re-test is included with every audit
We don't
- Promise that any app or AI system is 100% secure. No honest auditor can
- Test anything outside the signed scope
- Run load, denial-of-service or brute-force tests
- Change your code, files, data, settings or environments. Your team makes every change
- Name you or your app publicly without written permission
Want a second pair of eyes on your app or AI system?
Tell the Axieo team what you're running. A first written opinion within two business days.