Security for vibe-coded apps and software.
Engineered for the audits AI never ran.

• For any app pre-launch

  App Security Audit Sprint

  Audit, remediate, and gate the next commit in six weeks.

  • Threat model and manual code review (including vibe-coded paths AI cannot reliably reason about)
  • SAST, SCA, secret, and dependency scanning wired into CI gating deploy
  • Critical and high findings remediated as PRs you can review
  Book a discovery call
• For founders

  SOC 2 Readiness Sprint

  From current state to audit-ready in twelve weeks.

  • Gap analysis against the trust services criteria
  • Audit log, access review, and change management gates in the deploy pipeline
  • Policy templates and evidence-collection automation set up with Drata, Vanta, or direct
  Book a discovery call
• For regulated industries

  Compliance Engineering Sprint

  HIPAA, GDPR, or PCI DSS engineering in eight to twelve weeks, before the regulator asks.

  • Data inventory, lawful basis review, and data subject rights workflows
  • Encryption, key management, and access logging mapped to the regulation
  • Vendor assessment templates, DPA or BAA review, and partner-firm coordination
  Book a discovery call

Where engineered security earns its place.

1. 01 · SOC 2

   B2B SaaS preparing for SOC 2

   Pre-audit gap analysis, control implementation, evidence-collection automation. Audit time becomes documentation review rather than a quarter-long project. Renewal audits become a maintenance task.

   See our SaaS Platforms practice

2. 02 · Healthcare

   HIPAA-aware healthcare SaaS

   PHI handling, BAA management with every processor, access logging, audit trail, and the OCR-defensible posture a healthcare customer's procurement team expects to see in week one of the trial.

3. 03 · Fintech

   Regulated payments and PCI scope

   PCI DSS scope minimization (card data handled by Stripe or Adyen so card numbers never touch you), KYC/AML integration where required, fraud monitoring, and the regulator-letter response plan.

4. 04 · GDPR

   EU and global GDPR posture

   Data subject rights workflows (access, deletion, portability, rectification), lawful basis review, processor and sub-processor agreements, cross-border transfer plumbing where the case demands it.

5. 05 · Vibe-coded MVP

   Pre-launch audit for an AI-built app

   Founder shipped the MVP fast with Cursor, v0, Lovable, or Bolt. Before real users arrive, we audit the AI-generated code for the patterns AI gets wrong: broken auth, hardcoded keys, SQL injection in the 20% case, open S3 buckets.

6. 06 · Incident response

   Pre-incident incident response

   Runbooks for the top expected failure modes, on-call rotation in PagerDuty or Opsgenie, regulator-letter templates, and a tabletop exercise practiced before the real incident, not after.

• “We hit SOC 2 Type II in twelve weeks. The auditor said the evidence-collection automation was the most complete they had seen in the segment. Renewal audits since have been documentation reviews, not projects.”

  Hugo Carrington

  COO, Marblehead Health

• “Built the MVP in three weeks with Cursor. Hired IrenicTech for a pre-launch audit. They found 47 issues, 11 of them critical. We fixed everything before launch and have not had a single security incident in the six months since.”

  Felix Nyström

  Founder, Larkwood Studio

• “The tabletop exercise saved us. When the real incident hit, the runbook was already written, the regulator template was already drafted, and the on-call rotation actually picked up the phone. Total downtime: forty minutes.”

  Erik Thorvaldsen

  VP Engineering, Pinemoor Markets

• SOC 2 Type II (AICPA TSC)

  The trust services criteria. We design audit logs, access controls, and change management so the SOC 2 evidence is mostly already collected when audit time arrives.

  Official source

• HIPAA Security Rule

  Administrative, physical, and technical safeguards for PHI. We engineer the technical safeguards, BAAs with every processor, and the OCR-defensible posture a healthcare buyer expects.

  Official source

• PCI DSS v4

  Payment Card Industry Data Security Standard. We architect so card numbers never touch your infrastructure, keeping PCI scope to SAQ A wherever the integration shape allows.

  Official source

• GDPR

  EU General Data Protection Regulation. Lawful basis review, data subject rights workflows, processor agreements, and the cross-border transfer plumbing where the use case demands it.

  Official source

• ISO 27001

  Information security management system. Risk register, statement of applicability, control implementation, and the documentation an ISO auditor expects on day one of the engagement.

  Official source

• OWASP ASVS

  Application Security Verification Standard. The application security baseline mapped to the controls we engineer; SAST and DAST gated in CI per the verification level.

  Official source

• NIST SP 800-53

  Federal control framework for systems with sensitive data. Relevant for healthcare, fintech, and any vertical SaaS with regulated customers. Mapped to the controls we ship.

  Official source

• PECA 2016 (Pakistan)

  Pakistan's Prevention of Electronic Crimes Act. Relevant when systems serve Pakistan-resident users: unauthorized access prevention, electronic forgery safeguards, critical-infrastructure protection, and user-data handling obligations enforced by the FIA Cybercrime Wing.

  Official source

Common questions, answered.

• How long does a SOC 2 readiness engagement take?+

  SOC 2 Readiness Sprint: twelve weeks from current state to audit-ready (gap analysis through evidence automation). The audit cycle adds four to eight weeks for the auditor's work. Annual renewal becomes a documentation review, not a fresh project.

• What does a security and compliance engagement cost?+

  Price varies with the scope of the work. The productized sprints are fixed-price for the scope they cover. For scale reference: an App Security Audit Sprint typically runs four to six weeks, a SOC 2 Readiness Sprint runs ten to fourteen weeks (then a four-to-eight-week auditor cycle), and a Compliance Engineering Sprint for a single framework runs eight to twelve weeks. A full multi-framework engagement is quoted after the discovery call. The discovery call itself is free; you accept the estimate or you do not.

• Do you audit vibe-coded apps built with Cursor, v0, Lovable, or Bolt?+

  Yes. The App Security Audit Sprint is built for both human-written code and AI-generated code. The patterns AI gets wrong repeat across tools: SQL injection in the 20% case, broken auth in multi-step flows, hardcoded keys in 'helpful' examples, dependencies pulled in without vetting, open buckets suggested for 'easy uploads'. We audit, remediate, and gate the next AI-generated commit so it cannot reopen the issues.

• Why is now the right time to audit an AI-built app?+

  Because the breach pattern is now obvious. Through 2024 and 2025, AI-built apps shipped with the same set of repeating vulnerabilities: hardcoded API keys leaked in committed .env files, broken JWT validation that decoded but never verified, open S3 buckets suggested for 'easy uploads' with customer PII inside, SQL injection in AI-generated query builders, malicious or typosquatted dependencies the AI pulled in. Every week brings another news cycle. The fix is not a better AI tool; the fix is having a human security engineer review the AI's output before users (or attackers) find what AI missed.

• Do you do the audit, or just prepare for it?+

  Prepare for it. The audit is by a third-party firm (Drata or Vanta + their auditor partners, or direct relationships with the major audit firms). We engage the audit firm with you, run the remediation cycle, and ship the audit-corrected build. We deliberately do not market ourselves as an audit firm because we cannot be independent for our own work.

• Which frameworks do you have experience with?+

  SOC 2 Type II is the default for B2B SaaS. HIPAA when PHI is in scope. PCI DSS when card data touches the infrastructure (we usually architect so it does not). GDPR for EU-touching customers. ISO 27001 when enterprise procurement asks. OWASP ASVS as the application security baseline. NIST 800-53 for federal-adjacent buyers.

• Do you offer penetration testing?+

  We do code review and threat modeling, and we manage the engagement with a top external pen-test firm (Trail of Bits, NCC Group, Cure53, Doyensec). We do not market ourselves as a pen-test firm because we are not independent for code we have audited or built ourselves.

• What is your stance on tools like Drata, Vanta, Secureframe?+

  Useful for evidence collection and continuous monitoring; not a substitute for the engineering work. We integrate them into the deploy pipeline so they collect the right evidence automatically. The compliance posture comes from the controls; the tool just records them.

• Can we get a security review before signing a new enterprise customer?+

  Yes. Pre-deal security review covers the prospective customer's vendor questionnaire, gap analysis against their stated requirements, and a prioritised remediation backlog for the open items. The faster you respond to questionnaires the faster enterprise deals close.

• How do you handle incident response after the engagement?+

  Runbooks documented, on-call rotation set up, regulator-letter templates drafted. We run a tabletop exercise with your team before handover. Optional incident response retainer for the first regulated breach if your team prefers external coverage on the early ones.

• Who owns the documentation, the runbooks, and the audit relationships?+

  You. From day one. Policies in your wiki, runbooks in your incident response tool, audit relationships in your name. We push to your repos and wiki, document everything in your account. No proprietary platform you cannot leave; no ongoing dependency on us unless you want one.