INDEPENDENT COMPLIANCE AUDITING
Does your site or app pass?
Reviews for online shops, websites and AI-built applications. We identify potential problems, record evidence and distinguish what was confirmed, what needs fixing and what has not been tested.
See what the free code sample covers →
- Free
- No account
- Under a minute
Two cases, one standard
Deadlines that have already passed
One-click withdrawal, accessibility, trader identity, a link to a platform that shut down. These are not our opinion — they are dates in EU law, and most of them are behind us.
What we check on a shop →Built fast, often with AI
An application now takes weeks to build. Whether it survives an attack, a payment edge case or a GDPR audit is a different question — and one almost nobody has asked.
What we check on an application →Why it matters
Two different risks, one cause: nobody checks. For shops the law already has deadlines that have passed; for applications, code ships without a second pair of eyes.
For shops: dates, not estimates
- 28/06/2025 Accessibility became mandatory for most online shops (European Accessibility Act, Directive (EU) 2019/882). Fines reach €100,000 in Greece.
- 19/06/2026 Withdrawal must be a function, not just a paragraph (Directive 2011/83/EU, Article 11a).
- 20/07/2025 The EU ODR platform shut down. Anyone still linking to it is sending customers to a page that no longer exists.
For applications: what the research shows
of AI-written code contains a security flaw.
Source: Veracode, GenAI Code Security Report 2025
of developers review AI-written code, while 96% do not fully trust it.
Source: Sonar, State of Code 2025/26
security flaws and 175 personal-data leaks across 5,600 public AI-built applications.
Source: Escape.tech, 2025 research
Who it is for
Online shop owners
You sell online and you do not know whether your site meets what the law asks today. The audit answers with dates, not opinions.
People who build and sell
Startups, software houses and founders who built an application and want to prove to customers that it is serious, before it reaches the market.
People who buy or invest
Investors, acquirers, procurement teams. An independent view of what they are buying, before they sign.
What we check: the whole path, not just security
Most audits look at security alone. We look at the whole path — from what the site promises to what it does in production — against international standards (OWASP ASVS 5.0, ISO/IEC 25010, WCAG 2.2, NIST SSDF) and EU law.
GATE G0
Product
Who it serves, which problem it solves, which risk class it falls into.
Audit path
G0 · Product G9 · Consumer rights
GATE G1
Requirements
Written features with acceptance criteria, a personal-data inventory, a threat analysis.
Audit path
G0 · Product G9 · Consumer rights
GATE G2
Architecture
Tenant separation, roles and permissions, which laws apply, DPIA.
Audit path
G0 · Product G9 · Consumer rights
GATE G3
Code quality
Static analysis, duplication, hallucinated libraries, silently swallowed errors — the typical failures of AI-written code.
Audit path
G0 · Product G9 · Consumer rights
GATE G4
Security
OWASP ASVS, secrets in code, vulnerable packages, whether one customer can see another’s data.
Audit path
G0 · Product G9 · Consumer rights
GATE G5
Testing
Whether the tests catch real defects, plus mobile, speed and load.
Audit path
G0 · Product G9 · Consumer rights
GATE G6
Operations
Backups with a tested restore, monitoring, rollback, incident process.
Audit path
G0 · Product G9 · Consumer rights
GATE G7
Legal
Terms, GDPR and DPAs, cookies, the AI Act, software licences.
Audit path
G0 · Product G9 · Consumer rights
GATE G8
Accessibility
WCAG 2.2, touch targets, contrast, keyboard navigation — measured on the live page.
Audit path
G0 · Product G9 · Consumer rights
GATE G9
Consumer rights
Withdrawal, deadlines, trader identity, prices and charges — as Directive 2011/83/EU requires.
Audit path
G0 · Product G9 · Consumer rights
How the audit works
Full methodology →-
Connect
For a shop, the address is enough. For an application, read-only access to the repositories you choose. The audit runs in our own ephemeral environment — not on your infrastructure, so that it stays independent.
-
Tooling
The audit runs in an isolated environment inside the EU. Security flaws, secrets, packages, tests, speed, accessibility, consumer rights.
-
Three AI models, blind
Claude, GPT and Gemini read separately, with no sight of each other. Then each one reviews the others’ findings.
-
A human
Where the models disagree, on every serious finding, and on anything high-risk, a senior engineer decides.
-
Result
A report with findings and fixes. You fix, you resubmit. On a pass: grade, certificate, badge.
Why three models and not one? On our first real audit, the second independent reviewer found 3 serious flaws the first had missed — among them one that allowed signing into somebody else’s account. One reviewer, however good, is not enough.
What you get
-
A report of findings
Every finding with file and line, why it matters and how it is fixed.
-
A priority list
What to fix now, what before your first customer, what later.
-
A signed certificate
Digitally signed to the W3C standard, recorded in a public registry.
-
A live badge for your site
Always shows the current state. If it expires or is revoked, it changes immediately.
-
A Wallet card
The certificate on your phone, with a QR code for verification at meetings and trade shows.
-
Continuous re-checking
The fast criteria are re-checked on every change, not once a year.
- GRADE
- A
- ISSUED
- 09/2026
- EXPIRES
- 03/2027
live verification
The badge
This is what goes on your site when you pass. It is not an image we send you — it is drawn by us every time somebody looks at it.
SIMULATION
If it expires or is revoked, the seal changes at once, inside your own site.
Silver · ACTIVE
- GRADE
- A
- ISSUED
- 09/2026
- EXPIRES
- 03/2027
live verification
VERIFICATION
- W3C signature
- valid
- Public record
- logged
- Status
- ACTIVE
- Level
- Silver
The seal shows an active certificate.
-
It cannot lie
If the certificate expires or is revoked, the badge shows it at that moment, inside your own site, with nobody going in to change it.
-
It clicks through
Straight to the public report: what was audited, when, at which commit, with what result. Anyone who doubts it checks in ten seconds.
-
It states which audit
Bronze, Silver or Gold is written on it. Nobody can display a badge for a deeper audit than the one they passed.
Why trust us
A mark is worth exactly as much as the discipline behind it. These are our commitments, and they are publicly checkable.
-
We do not sell fixes
Whoever certifies must not profit from finding problems. The fixes are yours to make, or whoever you choose.
-
Published criteria
The standard and every threshold are public. Nobody passes on a discount.
-
Revocations are public
If a site degrades after certification, the badge comes down and the registry shows it.
-
Separation of roles
Whoever wrote the code does not certify it, and the reviewer has no commercial relationship with the client under audit. The conflict-of-interest rules are enforced by the system itself.
-
Measured accuracy
We measure our method against a test corpus with known answers, and we publish the result when the measurement is complete. Until then we quote no percentage.
-
Appeals
Disagree with a finding? There is a written appeals process with a response deadline.
-
Money-back guarantee
If we miss a serious flaw, we refund the cost of the audit and repeat it.
See the guarantee →
What we found
We ran the audit against public repositories holding AI-built applications, and against our own. These are the numbers, as they came out.
The repositories are not named. Their code is public and the audit lawful, but we notified no author and nothing was fixed. Publishing a vulnerability by name, without warning, is not an auditor’s job.
Measured on 23 October 2026. The totals are produced from the audits themselves by command, not written by hand.
And our own
- Dradera 1 critical · 5 high fixed
- Command Center 2 CVE σε εξαρτήσεις open
- Thelimata 178 αρχεία · 0 ευρήματα clean
Auditing our own applications also found a fault in the auditor itself: it stopped on every Laravel application with a storage symlink. Fixed the same day. We write it here because a scheme that hides its own faults has nothing to say about anyone else’s.
Pricing
Full details →Four packages. A certificate and a badge are issued ONLY with three independent models — with one or two you get a report, not a certification.
Audit with 1 model
€290
Every automated tool and one AI model across the whole codebase. Findings report. No certificate.
Audit with 2 models
€590
Two independent models from different companies, cross-checking each other. No certificate.
Bronze — 3 independent models
€1,200
Three models from three companies. The full method, so a certificate and a badge.
Silver — 3 models + engineer
€3,500
Everything in Bronze, with a senior engineer on every serious finding and a named auditor signature.
Frequently asked questions
- What exactly does the free check see?
- Only what is visible on your public page, like any visitor. It does not probe for vulnerabilities, fill in forms or place orders, and it respects your robots.txt.
- Do you see our code? Do you keep it?
- On an application audit, read-only. The code is deleted as soon as the findings are written, and within 30 days in any case. We keep the findings and the audit trail — not the code.
- Are the AI models trained on our code?
- No. We use the professional APIs under terms that forbid training, with processing inside the EU.
- Are you a government or accredited body?
- No. We are a private, independent mark with published criteria. We do not replace obligations set by law.
- What if someone tries to fool the AI?
- The audit is designed so that no text inside the code can influence the result, and any attempt fails the audit automatically.
- How long does it take?
- The free check finishes in under a minute. The automated full audit completes the same day. Human review on Silver and Gold depends on reviewer availability, which we state in the quote.
- Do you guarantee it cannot be breached?
- No, and nobody can. We certify that at the moment of the audit it met the published criteria, and we keep re-checking.
- What if you miss something?
- We refund the cost of the audit and repeat it free of charge. On Gold we also pay a bounty to whoever found it.
Find out where you stand.
The free check shows the serious ones before somebody else finds them — a customer, a competitor or a regulator.