Partner with us

For software agencies

An independent security review for the apps you build for clients

Add a security review before handover, under your brand or ours. A senior engineer reviews the application or AI agent you built; you keep the client relationship.

Two models
White-label or referral you choose per project
Report
Your brand, ours, or both same content either way
Terms
Agreed per engagement in writing, before work starts
Discuss a partnership Opens a pre-filled email to hello@proofmerge.com

Two ways to work together

First, decide who the customer is

The difference is who signs the statement of work with us. In both models your client, as the owner of the systems, authorizes the review in writing.

White-label

Your agency is our customer

You offer the review to your client as part of your delivery, and the report carries your branding.

Contract
Between your agency and Proofmerge
Report
Your brand, or both brands
Authorization
Your client, in writing, for their systems
Client contact
Through you; we join client calls only if you ask

Referral

Your client is our customer

You make the introduction; your client contracts with Proofmerge directly and the report carries the Proofmerge brand.

Contract
Between your client and Proofmerge
Report
Proofmerge brand
Authorization
Your client, in writing, for their systems
Your role
You can join the walkthrough if your client agrees

In both models we do not contact your client independently and do not offer them other services unless you ask us to.

Before any access

Written authorization comes first

Nothing starts until the system owner, normally your client, has authorized the review in writing and an NDA is signed. If your client owns the systems, their authorization is required even when your agency holds the access.

Access is time-boxed and revoked when the report is delivered. Scanning runs on our own review machine with scanner telemetry switched off; client code is not uploaded to third-party scanning services.

What we need for access

  • Read access to the repositories in scope, for a named Proofmerge account with multi-factor authentication.
  • A read-only or viewer role on the backend and hosting projects in scope, for example Supabase, Firebase, Vercel or a cloud account.
  • For AI features: the agent and tool definitions, system prompts and MCP configuration.
  • A technical contact who answers questions within one working day.

No write, admin or billing roles, and no production data.

What the report contains

The same report, under the brand you choose

The report is followed by a walkthrough call with your team, and with your client if you want. The sample report was generated from a demo application with planted issues and contains no client data.

See the sample report →
  • Summary and scope. What was agreed, in one page.
  • Findings ranked by real exploitability. Each with location, evidence, impact and the recommended fix.
  • Mapped. OWASP Top 10:2025, plus the OWASP Top 10 for LLM Applications 2025 for AI features.
  • Redacted. Secret values found in code are not reproduced in the report.
  • Honest about scope. A list of what was reviewed and what was not.

Delivery

Timing in writing, before work starts

For a Launch Security Check scope, the report is delivered within two business days of confirmed scope, agreed payment arrangements and complete access. Larger scopes, such as an AI agent review, get a timeline in the statement of work before work starts.

Launch Security Check

One application: secrets, authentication, database rules, API exposure and dependencies. Sold directly to app owners from US$790 for a small app.

AI Agent & LLM Security Sprint

Tool permissions, data access, untrusted input, output handling, MCP configuration and cost limits. What the sprint reviews

Partner terms are agreed per engagement, in writing, before any work starts. We do not publish partner pricing.

What is not covered

Clear limits you can pass on to your client

A static review

Code and configuration, reviewed with read-only access the client grants. We do not attack running systems.

Not a penetration test

It should not be described to your client as one. The report states the scope and the method.

Not a certification

No SOC 2 report, ISO 27001 certificate or audit opinion, and no statement that an application is secure.

FAQ

Questions agencies ask first

Can the report carry only our brand?

Yes, in the white-label model. The content is the same either way: scope, method, findings and the list of what was not reviewed.

Will you contact our client?

Not unless you ask. In the white-label model all contact goes through you. In the referral model your client contracts with us directly, so we talk to them about the review and nothing else.

How is client code handled?

An NDA is signed before any code is shared, and access is read-only and revoked on delivery. Scanning runs on our own review machine; client code is not uploaded to third-party scanning services.

How long working copies are kept, and when they are deleted, is set out in the statement of work.

What does a partnership cost?

Terms are agreed per engagement, in writing, before any work starts. Tell us about the project and the model you prefer, and we will propose terms for that engagement.

Start with one email

Bring one upcoming project as an example

Tell us what you build for clients and which model fits. We reply with times for a 20-minute call. No client names, code or access at this stage.

Discuss a partnership

No mail app? Write to hello@proofmerge.com