Services
Security: security and penetration test reviews, SSO, IAM and WAF

You know there are holes. You don't know which to close first.

A customer asked for your security posture, or a pen test report landed and nobody has worked through it. Old keys, shared logins and open ports sit there because fixing them never makes the sprint. We test what you have, review what you have, write down what to fix first, and set up the access and edge controls that close the biggest gaps.

from €700 · 3 weeks

Starting price, excluding VAT. Fixed before work starts.

Start your project What you get

What you get

  • A penetration test of your web app, API and public endpoints, run by us.
  • A review of your cloud IAM: users, roles, keys and who can do what.
  • A read of any earlier pen test report, folded into one fix list.
  • SSO and role-based access for your cloud and tools, with one identity provider.
  • WAF rules in front of your public endpoints.
  • A written report ordered by risk, each item with its fix.
  • A call to walk through the report with your team.

Not included

  • Compliance certification. We prepare, we do not certify.
  • Fixes inside your application code.
  • Ongoing monitoring. That is DevOps as a Service.

How we work

Fixed price

Agreed in writing before we start. No hourly meter.

Fixed date

Set in the proposal. Late is on us.

Quote in 48 hours

A one-page proposal after a fifteen-minute call.

Half and half

Half when you sign, half on delivery.

Handover

Code, docs and every login are yours.

From brief to handover

  1. Brief

    Fifteen minutes with the engineer who will do the review, then read access to your cloud account. Within 48 hours you have a fixed price, a fixed date and the scope.

  2. Build

    Weeks one and two: the penetration test, the IAM review and the report. Week three: SSO, IAM changes and WAF rules in place, with your team watching.

  3. Handover

    The report, the configuration as code, and a call to walk through it. Your team closes the rest in order.

Track record

Questions

What does the from-price cover?
One product or one cloud account: the penetration test, the IAM review, the report, SSO for one identity provider and WAF rules for your public endpoints. More is quoted within 48 hours.
Do you run penetration tests?
Yes. We test your web app, API and public endpoints, then give you the findings in order of risk with the fix for each.
Will this get us SOC 2 or ISO 27001?
It closes gaps an auditor would find. Certification is done by an auditor, not by us, and we say so.
Which identity providers do you set up?
The one you already pay for: Google Workspace, Microsoft Entra, Okta or similar. SSO into AWS, Azure or GCP and into your main tools.
How do we pay?
Half when you sign, half when the agreed changes are live. Invoiced by Zer0Paper OÜ in your region's currency.
What access do you need?
Read access for the review. Named, revocable access for the changes, in your accounts, logged. Nothing leaves your accounts.

Prices and terms by region

United States and Canada · United Kingdom and Ireland · Nordics and Estonia · Germany, Austria, Switzerland and Luxembourg · France, Belgium, the Netherlands and Luxembourg · Gulf · Africa · Asia-Pacific · Latin America

Other services

Full-stack product development: web, mobile and API · Platform engineering: internal developer platforms, IaC and GitOps CI/CD · Kubernetes: setup, autoscaling, right-sizing and migration · AI adoption for engineering teams: secure setup, training and agent workflows · Enterprise DevOps as a Service

Ready when you are.

Two minutes to describe it, then a free 30-minute call with the engineer who would do the work. You leave with a price and a date.

Start your project