The whole engagement, from first email to paid invoice.

Proposals that sign themselves off.

Build the proposal from your scoping, send it, and let the platform do the chasing. When the client signs, the engagement exists: no retyping, no copy of the scope drifting out of date in someone's inbox.

Scoping the client fills in, phases the team can see.

Scope requests go to the client through their portal, so the answers arrive structured instead of scattered across an email thread. From there the engagement is phased, scheduled and assigned in one view.

• Structured scopingAsk for targets, credentials, environments and constraints once, in a form the client completes in their own portal. It lands attached to the engagement, not in a mailbox.
• Phased engagementsExternal, internal, retest, or whatever shape the work takes. Each phase carries its own dates, testers and checklist, under one engagement and one report.
• Scheduling and assignmentA calendar of who is on what, with meetings alongside the work. Zoom, Teams and Slack hook in, so the kick-off call sits on the same timeline as the testing.
• Access scoped to the workPeople see the engagements they are on. Roles by seniority decide the rest, enforced in the database rather than by hiding buttons.

Findings written once, evidenced properly.

A finding carries its severity, CVSS vector, CWE, affected assets, evidence and remediation as structure, not as formatting conventions in a Word file. Which is what makes everything downstream, QA, the report, the retest, automatic.

A knowledge base that stops you writing SQL injection for the hundredth time.

The best description of a vulnerability your firm will ever write should be written once. Save any finding to the knowledge base, insert it into the next engagement with its scoring and remediation intact, and adjust the specifics. Your house wording stays your house wording, and it gets better every time someone improves it.

QA as a workflow, not a favour.

Work moves through review states with comments attached to the thing being reviewed. Nothing reaches a client because someone forgot it had not been checked.

• Review statesDraft, in review, approved. Who reviewed what is on the record, and release waits for approval.
• Checklists and runbooksMethodology as living checklists per assessment type, so coverage is demonstrable rather than remembered. Runbooks keep the how next to the what.
• Comments in placeFeedback lands on the finding or the section it concerns, not in a side channel that evaporates.

Your Word template, filled by the platform.

Reports, proposals, invoices and attestation letters all render from your own DOCX templates. Upload the document you already send, the platform maps its placeholders, tables and sections to live data once, and from then on generation is a click.

How templates are mapped, and how the AI drafts within them, is covered on the AI page

A portal your clients sign into, wearing your brand.

Clients get their own accounts, locked to their own organisation, on your domain. They complete scoping, follow progress, receive findings when you release them, request retests and leave feedback, all in one place that looks and sounds like your firm.

• Their view, your controlA client sees its own record, its own assessments and only the findings you have released. That boundary is enforced in the database, not by hiding buttons.
• Comments in contextQuestions about a finding are raised against that finding, so the context comes attached rather than arriving as a separate email thread.
• Feedback that compoundsStructured feedback at the end of an engagement, with a nudge towards a Google review when it is glowing.
• Retest requestsThe client can ask for the retest from the report they are reading, which becomes a scoped phase on your side.

Invoices out of engagements, straight into your accounts.

Invoicing is generated from the work rather than reconstructed from memory at month end, and it syncs two ways with Xero so your accountant never learns this platform exists.

• InvoicingRaised against the engagement, rendered on your own template, tracked to payment, chased automatically.
• Xero syncInvoices and their state flow both ways with Xero, so the books agree with the platform without rekeying.
• Revenue per engagementInvoices sit against the engagements they belong to, so what each piece of work earned is a fact rather than a feeling.

The parts you feel every day.

• One timelineEvery engagement keeps a full activity trail: proposal signed, scope answered, finding written, report released, invoice paid. When a client asks what happened and when, the answer is on screen.
• Dashboards and notificationsWhat is in flight, what is blocked, what is due. Notifications go where your team lives, including Slack and Teams.
• Modules you can switch offNot using proposals, invoicing, meetings, feedback or the blog? Turn the module off and it leaves the interface entirely, for your team and your clients.
• Sign-in your policy will likeEmail and password by default with a mandatory second factor, passkeys and authenticator apps, Google and Microsoft SSO, or emailed one-time codes if you prefer passwordless. The detail lives on the security page.
• Storage without a meterEvidence, files and reports live inside your own database, with no storage tier to outgrow. Unlimited on every plan, because it is your database.