Account · Agreements

Agreements

Master agreements govern the whole relationship. Engagement-specific documents live inside each engagement.

Account · Security

Account & keys

Your identity and the hardware that protects it. Reports decrypt only on the devices you've enrolled, never on our servers.

Add another passkey, a backup key, or a colleague's device, anytime; you'll be asked to insert it and touch it. You can revoke a key you've lost or no longer use, but not your only one. Your key signs you in, then you can remove it, you'll be asked for it again next sign-in and when you sign a document. Report access is protected by your passphrase, so losing a key never loses your reports.

Engagement

Overview

-

Engagement roadmap

The plan, and where we are

The disciplined arc of your engagement. Scope only, findings stay privileged until a report is released.

Authorization

What you authorized, and what has run

Nothing is tested without your signature. This is the authorization as it stands: the instrument you signed, the systems it covers, the tools it permits and when, and every action taken under it.

Deliverables

Reports

Reports are encrypted to your key and decrypt only on this device, no one else, including us, can read them.

Open your reports →

Billing transparency

What you've been charged, and what's coming

A live view of actuals against estimate. Display only, the portal never collects payment; invoices are issued separately.

Tamper-evident ledger

Everything that has happened, in order

This is the actual hash-chained record. Each entry seals the one before it, so the history cannot be quietly rewritten, and it is anchored to hardware we physically touch.