Assurance levels
Every level follows the same published standard. Higher levels add depth, testing, and evidence for applications with more at stake.
For prototypes, internal tools, and smaller applications.
A structured baseline review that identifies the risks most likely to cause harm in early-stage and internal software.
For applications offered to business customers.
A full production-readiness assessment for software that businesses will rely on, with independent retesting after remediation.
Everything in Foundation Reviewed, plus:
For sensitive or business-critical applications.
The deepest level of review for applications that handle sensitive data or support critical business operations.
Everything in Business Ready, plus:
High Assurance is a rigorous independent technical review. It does not automatically constitute legal or regulatory certification.
Side by side
What each assurance level covers, category by category.
| Assessment category | Foundation Reviewed | Business Ready | High Assurance |
|---|---|---|---|
| Intended application type | Prototypes, internal tools, smaller applications | Applications sold to or relied on by business customers | Sensitive or business-critical applications |
| Source-code review | Targeted | Full | Full, with depth targets per domain |
| Dependency scanning | Included | Included | Included, with SBOM |
| Secrets scanning | Included | Included | Included |
| Authentication testing | Review | Review and testing | Review and testing |
| Authorization testing | — | Role and permission testing | Role and permission testing |
| API review | — | Included | Included, with abuse-case testing |
| Database review | — | Included | Included |
| Backup testing | Configuration check | Tested | Tested |
| Restore testing | — | Tested | Tested, with documented evidence |
| Architecture review | Basic | Detailed | Detailed, with threat model |
| Maintainability review | — | Included | Included |
| Automated testing review | — | Included | Included |
| Manual application testing | — | Included | Included |
| Penetration testing | — | — | Coordinated |
| Threat modeling | — | — | Included |
| Performance testing | — | — | Load and performance testing |
| Disaster recovery | — | Recovery testing | Full disaster-recovery exercise |
| Public verification record | Included | Included | Included |
| Verification duration | 6 months | 6 months | 6 months, with quarterly check-ins |
Assessment pricing depends on application size, complexity, and scope. Request a scope review and we will recommend a level and provide a written proposal — there is no charge for the scoping conversation.
Tell us how your application will be used and who depends on it. We will recommend the right scope.