How it works - Scope, test, fix and retest.
Three phases, a price agreed up front, everything in writing. You always know what we test, when we test it and what we must never touch.
Scope
You answer six questions in writing and we send a written quote within one business day. No discovery call is required, though we are happy to have one.
We agree the rules of engagement before anything else: which systems, which accounts, which dates, and what we must never touch. Testing starts only after a signed authorization from the system owner.
If a customer sent you a security questionnaire, send it to us. We map the scope to the lines it asks about, so the report answers them directly.
Included in this phase
- Written quote
- Rules of engagement
- Signed authorization
- Test accounts
- Questionnaire mapping
- Start date
Test
A certified tester, named in your proposal, works through your AI features, agents, phone agents and tenant boundaries by hand. Scanners cover the standard list so human time goes to chains and business logic.
We test against staging or dedicated test tenants first. Production is touched only with your written risk acceptance.
Critical findings are reported the same day, not at the end. Nondeterministic AI behaviour is replayed many times and reported as a rate, for example 4 of 20 attempts.
A finding is only real when it can be reproduced. Every one in the report comes with the exact steps and evidence.
Fix and retest
The report arrives within three business days of the last testing day, together with fix pull requests for confirmed findings.
Your team reviews and merges every pull request. A tester who did not write the fix then retests, and the report is updated with before and after evidence.
When the critical and high findings are closed, the lead tester signs the attestation letter.
Included in this phase
- Report. Severity, proof, reproduction steps and the exact fix for every finding.
- Retest. One free retest within 90 days, by a tester who did not write the fix.
- Letter. Signed, dated and carrying an ID your customer can check with us.
Our principles - Independent by design
We write fixes, so we hold ourselves to the rules that keep a test independent. They are written into every scope.
- Independent. You review and merge every fix. The person who wrote a fix never retests it, and the letter states who wrote it.
- Evidence first. Every finding is reproduced before it reaches the report. We write what the evidence proves and what it does not.
- Scope before invoice. The price is agreed in writing before we start. If the scope changes, we agree the change in writing first.
- No guarantees we cannot keep. A test is a point in time review of an agreed scope. We never promise that nothing can go wrong.
Work we decline - Where we say no
Saying no early saves both of us time.
- US-person only scope. FedRAMP, CMMC, ITAR, CJIS and IRS tax data environments require testers in the United States. We say no.
- Systems we fixed in PCI scope. PCI DSS requires organizational independence. We test it or we fix it, never both.
- Targets you do not own. We test only systems whose owner has signed a written authorization.
Send us the questionnaire your customer sent.
We will tell you which lines a test answers, in writing, within one business day.
Who we are
- CompanyMeridal Group LLCWyoming, United States
- TestingPerformed from the EUFor clients in the US and Europe