Scan
A first look at one app
€0free
Scan for free- Grade from A to F for any domain
- Number of findings per area
- The two most urgent findings in full
- No account needed, result in seconds
What Hullwise costs
Your first scan is free and needs no account. You buy the full report for one app once. Business rescans your apps every week and alerts you as soon as a grade drops.
Hullwise sells to businesses only. All prices are final.
Business
For companies with several apps and domains
€119per month, billed yearly (€1,428)
Ask about Business - Full reports with every finding and fix
- Up to 10 domains, scanned automatically every week
- Email alert as soon as a grade drops
- History per domain as evidence for auditors
- API and MCP with full reports
Enterprise
For large groups, NIS2 entities and regulated industries
from €490per month
Book a call- Everything in Business
- Number of domains and scan frequency by agreement
- Data processing agreement under GDPR
- Invoicing, procurement process and framework agreement
- A named contact person
One-time
Single report · €79 Recheck −50%
One app, one domain, and you know today what is exposed. You get every finding with steps to fix it, kept under a private link and as PDF.
Checking again later? Every further report for the same domain costs just €39.50.
- Every finding with steps to fix it
- Your report kept under a private link and as PDF
- Every later recheck of the same domain 50% off
- Invoice for your accounting team, no subscription
Add-on
Security Audit · from €1,500 per application
The scan sees what is exposed from the outside. In the audit we check by hand what sits behind it, for example whether your database access rules hold and what happens behind the login.
- Starts only after you prove you own the domain
- Tested by hand, including behind the login
- Database access rules, storage and permissions
- Report with every confirmed finding and how to fix it
- One retest after your fixes included
Compare plans
| Scan | Single report | Business | Enterprise | |
|---|---|---|---|---|
| Price | €0 | €79 one-time | €149 per month | from €490 per month |
| Grade from A to F | ||||
| Findings per area | count | full, 1 domain | full | full |
| Steps to fix | 2 findings | |||
| Full rescans | – | €39.50 each | ||
| Domains scanned weekly | – | – | up to 10 | by agreement |
| Email alert when a grade drops | – | – | ||
| History per domain as evidence | – | – | ||
| API and MCP | shortened reports | shortened reports | full reports | full reports |
| Invoice | – | |||
| Data processing agreement | – | – | – | |
| Framework agreement and procurement | – | – | – | |
| Named contact person | – | – | – |
All prices are final. More than 10 domains or several applications in one audit? Write to us.
Questions about pricing and billing
Do we need an account to scan?
No. Enter the address, tick the box, scan. You can buy the single report without an account too. You only need an account for your scan history, an API key or Business.
What do we get with the single report?
The full report for exactly one domain, with every finding and the steps to fix it. The report stays available under a private link and as PDF. To check again after a fix, every further report for the same domain costs just €39.50.
You pay €79 once. No subscription, nothing to cancel. The report covers the domain the scan ends up on. If company.com redirects to another domain, buy the report for the redirect target.
Single report or Business?
For one app you want to check once, the single report is enough. From the second domain on, or if you want to know whether the next update opens something up, Business costs less. It scans up to 10 domains every week and alerts you as soon as a grade drops.
How does the Security Audit work?
You book it from €1,500 per application and then prove that you own the domain, for example with a record at your domain provider. Only then do we test by hand, including behind the surface: database access rules, storage, permissions and everything behind the login.
You get a report with every confirmed finding and how to fix it. Once you have fixed the findings, we retest once at no extra charge.
Do we get a data processing agreement?
Yes, in the Enterprise plan. On request it also covers invoicing, your procurement process and a framework agreement.
What counts toward the API limits?
Every scan through the API or the MCP server counts, including failed ones. Limits are per hour. Above the limit you get the error rate_limited, and shortly after it works again.
Can we cancel Business?
Yes, at any time, effective at the end of the paid period, directly in your account under Billing. Your history is kept in case you come back.
Do we get an invoice?
Yes, for every plan and every one-time purchase. Payment runs through Stripe, and the invoice arrives by email at the address from checkout. At checkout you enter your company name, address and, if you like, your VAT ID.
Can we get a refund?
With Business you pay monthly or yearly in advance and can cancel at the end of the period. The single report counts as delivered the moment it is activated, so we don't refund it. For the audit we refund the full amount as long as we haven't started testing.
Is your app
watertight?
Hullwise finds the leaks before someone else does: exposed keys, database credentials and outdated software. Every finding comes with steps to fix it.
Click a finding to mark it as fixed.
Ship fast. Stay hullwise.