Terms
Last updated: October 29, 2026
1. What you're buying
A point-in-time review of the web app at the URL you give us, at the tier you paid for. We test the app as it is on the day we test it. Changes you deploy afterwards are not covered.
2. Best-effort, not a guarantee
- The audit is a best-effort review of a sample of user flows and common security problems. It is not a full penetration test, a code review of every file, or a compliance certification (SOC 2, HIPAA, PCI DSS, GDPR).
- A clean report does not mean your app is bug-free or secure. It means we did not find problems in what we tested.
- You decide whether and when to launch, and you are responsible for fixing what we report.
3. Scope by tier
| Quick Audit ($199) | Full Audit ($499) | |
|---|---|---|
| Flows tested | Up to 3 core flows | All key flows you list, up to 10 |
| Security checks | Top checks: exposed keys, open database rules, auth on API routes, HTTPS headers | Full security checklist |
| Deliverable | Written report with severity ratings + paste-in fix prompts | Report + paste-in fix prompts + Playwright test suite you keep |
| Turnaround | 48 hours after a complete intake | 3 business days after a complete intake |
Not included in any tier: load or stress testing, social engineering, testing third-party services beyond how your app uses them, native mobile apps, and fixing your code: you get fix prompts, we don't make the fixes. If we find no problems, you get a signed report of everything that passed.
4. Permission to test and your responsibilities
- You confirm you own the app or are authorized to have it tested, and you give us written permission to test the URL in the intake form.
- You give us a test account. A staging or preview URL is preferred over production.
- We never use real payment cards. Checkout is tested only in your payment provider's test mode. If your app only has live mode, we test by hand up to the payment step and mark checkout "not tested" in the report.
- We stop and contact you if a test looks likely to damage data or affect real users.
5. Payment and refunds
- Paid in full upfront by card through Stripe.
- Full refund if you cancel before testing starts. Once testing has started, audits are non-refundable.
- Upgrade credit: the $199 Quick Audit counts towards the Full Audit if you upgrade within 14 days of buying it.
6. Your data
- We access only the test accounts you give us. Credentials are kept in a password manager and deleted within 7 days of delivery.
- We do not copy your users' personal data. If we see real user data while testing, the report notes where it is exposed, not what it contains.
- The report is shared only with you. We use anonymized findings in our own material only with your written permission.
- Repository access is optional and Full Audit only: read-only, and revoked after delivery.
7. Liability
Our total liability for any claim is limited to the amount you paid for the audit. We are not liable for indirect losses, lost revenue, or problems in parts of the app we did not test.
8. Contact and changes
Questions: hello@aiappcheck.com. We may update these terms; the version on the date you paid applies to your audit. AI App Check is operated by COLORDRIP LABS LLC, a Florida limited liability company ("we", "us"). These terms are governed by the laws of the State of Florida.