Methodology

1. How the application comes in

• HOW IT RUNS

  In our own ephemeral environment

  The audit does not run on your infrastructure. A certification body cannot execute the audit inside the audited party’s own system — the result would not be independent. The environment is created for your audit and destroyed afterwards.

• FASTEST

  GitHub / GitLab connection

  A read-only app, on whichever repositories you choose. Access tokens that expire within 1 hour.

• NO GIT

  Upload an archive

  A compressed folder of the code. For anyone not using GitHub or GitLab.

Alongside it we ask for: a questionnaire about the product and its data (G0–G2), your legal documents (G7) and, if you want the live site audited, a staging environment with proof that it is yours (a DNS record, as in Google Search Console). We never audit production.

2. What runs automatically

Your code runs on a single-use machine that is built for your audit and destroyed when it finishes. It never passes through our own servers, is not stored, and is not kept as a build artifact. The machine downloads the audit tools and sends the signed result back; it sees nothing else of yours, and none of your keys or passwords ever go in there.

Where it runs: on an ephemeral GitHub Actions machine. Today we do not guarantee an EU region for that machine — our platform and your data stay in the EU, the audit execution does not necessarily. If you need that contractually, tell us before the audit.

• Security flaws in the code
• Secrets and passwords across the whole history
• Package vulnerabilities and licences
• Code quality
• Tests, and whether they catch real defects
• A gentle audit of staging
• Speed and accessibility

3. The three AI reviewers

Three AI models from different companies (Anthropic, OpenAI, Google) review the application independently of each other and then cross-check their findings. Every finding is recorded with the file, the line, why it matters and how it is fixed. The models and their versions are named in every report.

4. When a human steps in

• Bronze: no human; the stricter assessment stands.
• Silver: a senior engineer on every serious finding, every disagreement, and at the critical points.
• Gold: a team of senior engineers across the whole application, plus a penetration test.
• In addition, a sample human review on Bronze audits, so that we can measure the quality of the method.

5. Defence against manipulation

The audit is designed so that no text inside the code can influence the result. Any attempt at manipulation that is detected fails the audit automatically.

6. Grade and decision

• Pass

  Every mandatory criterion for the class. 0 Critical, 0 High open.

• Conditional pass

  Only Medium findings open, with a written remediation plan within 60 days.

• Fail

  Even one Critical or High, or a missing mandatory criterion.

The letter (A+ to F) summarises how far above the minimum the application sits at each gate. A grade is given only if the application passes. The full table of criteria and thresholds is in the published standard.

7. Your data

• Our infrastructure is in the EU. Your code is read by AI models from three providers (Anthropic, OpenAI, Google), which also operate outside the EU under standard contractual safeguards. Each provider may temporarily keep what we send for abuse monitoring, as its own policy sets out — Anthropic and OpenAI for up to 30 days. We state this openly rather than hiding it.
• None of the three trains models on your data: their API terms rule it out.
• We do not keep your code: it is deleted as soon as the findings are written, and within 30 days of the decision in any case. We keep only hashes and the evidence cited in the report.
• Every access to your data is written to a tamper-evident log.

8. Re-checking and revocation

• The certificate is valid for 6 months and is bound to a specific version of the code.
• With continuous certification, the fast criteria are checked on every change. If something serious breaks, the badge is suspended automatically.
• A change to sign-in, payments or permissions, a new serious CVE in a package, or a security incident means a mandatory re-audit.
• Every suspension and revocation is published in the registry.

9. What is public and what is not

The full methodology is given to clients after signing up, under a confidentiality agreement, and to external reviewers of the method. We keep it out of public view so that an application cannot be “trained” to pass the audit without actually being secure.