Every question, answered in writing.

Agents pentest your web app and API on their own: a lead plans and stays off the target, engineers take one slice and come back with a working exploit, and the hunt only talks to hosts you authorized in writing. Starter is one deep hunt a month; on Growth and above, a harder pass follows each release you approve.

A scanner lists what might be there; you verify every flag yourself. We prove what an attacker can actually do on the live system: PoC, severity, retest after you fix. Scanners still have a job — this is the standing hunt that follows releases.

Fixed scope, fixed price, report on a timeline. A bounty has no coverage guarantee and no cadence. You need a dated report for SOC 2 and customer questionnaires; that is what the standing hunt produces.

Yes. Growth and above can trigger an intensive pass from your pipeline after a release you approved. Quiet overwatch keeps running between those kicks. The portal shows mandate status and findings.

The free check is a short read-only pass (~20 minutes) with a written note. On a paid plan, the first intensive hunt typically lands within the first cycle after authorization is signed and the plan is live — exact timing depends on surface size.

We pause the affected path. You hear about it within 4 hours on the agreed channel. Nothing destructive runs without written sign-off.

Published flat tiers: Starter €99/month (one deep hunt a month), Growth €499/month (continuous on one app), Pro €999/month, Business €2,499/month. Annual prices are on /pricing and are less than twelve monthly payments. No per-scan fees. More hunts do not raise the bill on Growth and above.

Neither SOC 2 nor ISO 27001 certifies a single pentest. For your audit, our GRC partner cSquare GRC maps the signed report to your controls and tracks the fixes, and your independent auditor decides. If a contract requires BSI or CREST accreditation, tell us at scoping.

Onboarding and scoping in the portal, validated findings with PoC, retests on the plan surface, and a downloadable report. Retests of fixed findings are not an add-on meter.

Monthly plans renew until you cancel in the billing portal. Upgrade or switch interval there as well. Annual is billed up front for the year.

Surface count and cadence. Starter is one deep hunt per billing period on one app; Growth+ is continuous with release-triggered CI. Before the first hunt you verify domain ownership (DNS TXT on `_rheono-challenge` or a well-known file) and sign the written authorisation. Bigger estates move to Pro, Business, or Enterprise (custom, in writing).

External web apps and APIs you authorize in writing. Internal networks, mobile binaries, and red-team social engineering are out of scope for the standing hunt — ask sales if you need a separate engagement.

Read-only: at most ~300 page requests at ~1/sec from one US IP. No logins, no exploit payloads, no port scanning. Permanent opt-out is one word. Method is written on /security.

Yes as a flat add-on, in writing. With repo access the agent reads each release diff for data-flow and auth issues; findings include file:line plus a working PoC.

Rheono signs every report: Advanced electronic signature (eIDAS, PAdES-B-T) + qualified timestamp (RFC 3161), with NIS2 / ISO 27001-ready evidence mapping and CVSS. Samir Abis is the person named in your contract and accountable for it. It is not an audit opinion: only your auditor signs the SOC 2 report or the ISO 27001 certificate.

In the EU only. Sub-processors: Google Cloud (EU region) and PostHog Cloud EU (Frankfurt), used only after your consent. Encrypted in transit and at rest, least-privilege access, append-only logging.

You are the controller, we are the processor, under a DPA (Art. 28 GDPR). A data-protection incident is reported to you within 24 hours.

The report is signed with an advanced electronic signature (eIDAS, PAdES-B-T) plus a qualified timestamp, and kept for 10 years. It is yours.

Insurance: €50M per claim, without deductible (AGB §14). Before anything runs, your written authorization with rules of engagement is in force for 90 days.