For CTOs and CIOs
Code audit and software audit for AI-generated code: a 360 review What your people have built with AI, reviewed system by system
Seven software reviews and five data platform reviews, each with its own page. We know more than 1,200 review points: an automated AI tool goes through them and senior developers verify every finding.
Updated on
Code audit and audit of software built with AI
Seven reviews: mobile apps, websites, backend (the part the user never sees) and its API, databases, deployment server (where the system goes live), monitoring and API monitoring.
Mobile app review
Flutter apps built with AI, tested on real iOS and Android phones by command and with touch gestures, together with their backend.
- Real iOS and Android devices
- Every flow tested by command and with touch gestures
- Secrets, permissions and the API behind the app
More than 275 control pointsSee the service: Mobile app reviewPublic website review
Your website's performance, visibility in search engines and in AI assistants (SEO and GEO), accessibility and security, measured on the real page.
- Core Web Vitals with PageSpeed before and after
- SEO, structured data and how AI assistants read you
- WCAG 2.2 AA accessibility, contrast and security headers
More than 275 control pointsSee the service: Public website reviewBackend and API review
The server side behind your app or your website: what the API exposes, what it protects, what headers it serves and what ends up in its logs.
- Exposed fields and unprotected routes (OWASP API3 and API5)
- Route inventory and endpoint contract
- Security headers and personal data in logs
More than 150 control pointsSee the service: Backend and API reviewDatabase review
PostgreSQL, Redis, Elasticsearch and RabbitMQ, in read-only mode: structure, indexes, slow queries, locks and connections.
- Tables, indexes and migrations
- Slow queries, locks and connections
- Redis memory, Elasticsearch disk and RabbitMQ queues
More than 200 control pointsSee the service: Database reviewDeployment server review
The server your system will run on, reviewed before you go live: who has access, what runs on it and which limits break as you grow.
- Access, open ports and running services
- Expiring certificates and backups
- Disk space and system limits that break as you grow
More than 150 control pointsSee the service: Deployment server reviewInfrastructure monitoring
The Linux machines your system runs on, measured every few seconds, so you see a full disk or a stopped container before your users do.
- CPU, memory, disk and containers
- Alerts with thresholds agreed with you
- Read-only: nothing is modified on the server
More than 125 control pointsSee the service: Infrastructure monitoringAPI monitoring
Every call to your API measured, with its latency, its error and the screen that requested it, so you know which endpoint to optimize before traffic grows.
- p50, p95 and p99 latency per endpoint
- Seven monitoring screens in your dashboard
- Personal data masked before it is stored
If your product runs AI agents
In any of the seven software services, if your product includes AI agents or assistants, we also review two things worth settling before going to production.
EU AI Act readiness
If your product reaches users in the European Union, we check where your agents stand under the EU AI Act: which risk level your use case falls into, whether people know they are talking to an AI and, where the Act requires it, whether there is human oversight and a log of the agent's decisions. You get a list of the gaps and how to close them.
Prompt injection resistance
We test whether a text, a web page or a document the agent reads can give it orders: override its instructions, leak data or its system prompt, or use its tools for things it should never do. We review the permissions of every tool and what happens if someone manages to trick it.
This is a technical review and does not replace legal advice.
Data platforms
Five health checks: Salesforce, Microsoft Fabric, Databricks, Power BI, and Microsoft 365 with Azure. Licenses, access and data that breaks silently.
Salesforce health check
Automations that fail silently, users who have left and unused licenses you keep paying for in your Salesforce org.
- Flows and automations that fail silently
- Inactive users and paid licenses
- Security and access configuration
On requestSee the service: Salesforce health checkMicrosoft Fabric health check
Pipelines that feed reports with stale or broken data, and capacity that is paid for but not used.
- Pipelines that fail or load stale data
- Capacity usage and cost
- Workspace access and inactive users
Databricks health check
Jobs that fail without warning, clusters that cost more than they deliver and users who no longer need access.
- Jobs and pipelines that fail without warning
- Cost of clusters and jobs
- Unity Catalog access and inactive users
On requestSee the service: Databricks health checkPower BI health check
Reports built on stale or broken data, refreshes that fail and licenses assigned to people who no longer use them.
- Refreshes that fail or fall behind
- Reports that read broken sources
- Licenses with no activity
On requestSee the service: Power BI health check
Microsoft 365 and Azure health check
Accounts without MFA, guests and apps with more permissions than they need, and Microsoft 365 licenses paid for and not used.
- Entra ID: MFA, conditional access and administrators
- Guests, external sharing and apps with permissions
- Unused licenses and Azure subscriptions
Trademarks and logos belong to their respective owners. Their use here is descriptive only and implies no commercial relationship or sponsorship.
Start with a single system
The first review covers one system: the one about to go to production or the one that worries you most. Scope and timeline are fixed in writing before we start.
One system
Reviewed end to end: code, architecture, data, server and monitoring. You get its state on one page and the list of what to fix first.
Everything built with AI
If you want to go on, the 360 review: the same method and the same report for each system, and a single page for leadership.
Every quarter
Your systems change every week. The review is repeated every three months and compared with the previous one: you see what was closed and what is new.
You move to the next step only if you want to.
Two free resources for before the meeting
The sample report shows what you receive. The checklist lets you see for yourself whether what your team has built with AI is ready for production.
Frequently asked questions
What is a software audit?
A software audit is the review of a system that is already built, to find out what state it is in: its code, its data and the server it runs on. Ours is a health check designed to be repeated, and every finding arrives with its evidence and its priority.
How do you review AI-generated code?
In two passes. An automated AI tool goes through the code, its database and its server. Then senior developers verify every finding against what the AI does not know about your company: your access rules, your data volume and where the code will run.
Which AI can review code, and is that enough?
Assistants like Claude Code, Cursor or Copilot review code, and there are tools that do it on every change. They are useful day to day. To know what state the whole system is in and what to fix first, you need a review that also looks at data and server.
Who needs a code audit?
A company whose team has built something with AI that it is going to depend on: it is going to production, a customer is going to use it, or a new manager is inheriting it. That is what this health check is for. It is not designed for people learning to code.
How much does a code audit cost, and how long does it take?
The 30-minute meeting is free. The rest depends on how many systems our health check covers and how large they are: a single app does not cost or take the same as an app with its backend, its database and its server. You get the scope and the timeline in writing before we start.
Will we have to rewrite what the AI built, and who is going to maintain it?
The diagnosis tells you, piece by piece: what works and stays, what gets fixed and what is better rebuilt, each with its evidence. To maintain it afterward, your team gets the list ranked by impact, with where each issue is, how to check it and why it matters.
Do you also review AI agents?
Yes. We review AI agents and assistants, including Microsoft agents, the ones built on its platform: we test whether a text or a document they read can give them orders, and what permissions each tool they use has. We also review Power BI, Microsoft Fabric, Databricks and Microsoft 365.
Request your free meeting
Fill in the form and we email you to set a day and a time. It is 30 minutes to see what you have and what to review first.