How It Works Pricing FAQ

Human Expert Audit Suite by Onix

Built fast. Running in production.
When did a senior engineer last review it?

Three expert audits. Fixed price. Two weeks.
Architecture, UX, and functionality — reviewed by humans with 20 years of experience, not automated scanners.

No sales pitch. We look at your system, tell you what we see, and quote the package that fits.

Reviewed by Onix engineers with 20+ years of experience — the same team that has rescued 200+ failing software projects.

46%

of all new code on GitHub is now AI-generated

91.5%

of AI-built apps contain traceable vulnerabilities

2.74×

higher vulnerability rate in AI-generated vs human-written code

$4.88M

average cost of a data breach (2024)

The apps that look fine on the outside.

1.5 Million API Keys Exposed

A widely-hyped platform shipped a vibe-coded backend. The AI placed the database API key in client-side JavaScript with Row Level Security disabled. 1.5 million API keys were exposed before anyone noticed. It took 11 days to discover the breach. The platform did not survive the press coverage.

12% of Orders Silently Failing

A logistics SaaS passed 500 concurrent users and the database started dropping writes. The architecture had never been reviewed. Every order placed during peak hours had a 12% chance of silently failing. They found out from an enterprise customer's ops team, not from monitoring.

Series B Round Fell Apart in Week Three

The technical reviewer found 40% of the codebase was AI-generated with no test coverage, three open OWASP Top 10 vulnerabilities, and a dependency on an abandoned package with a known CVE. The founder had been planning to fix it "after the raise."

These are not edge cases. In 2026, 91.5% of AI-assisted codebases contain traceable vulnerabilities. The question is not whether your system has issues. It is which ones, how serious, and who finds them first.

Three expert reviews. Three tiers each.

Pick your level — or let us recommend on the scope call.

Technical Architecture Audit

"Find out if your system is safe, scalable, and built to last."

A senior Onix engineer reviews your codebase and infrastructure — not with a scanner you could run yourself, but with the pattern recognition that comes from 20 years of seeing what breaks and why. Every tier delivers a written findings report with severity ratings (Critical / High / Medium / Low) and a prioritized remediation roadmap.

Tier 1

Snapshot

$1,450

5 business days

Best for

MVPs and small apps (under 50K lines of code), single service or monolith, one deployment environment. Founders who need a "is it safe enough to show an enterprise customer?" answer before a demo or investor pitch.

What's included

  • OWASP Top 10 vulnerability check with human interpretation
  • Exposed secrets scan (API keys, credentials, tokens)
  • Authentication and authorization logic review
  • Dependency audit — outdated packages, known CVEs
  • Top 10 findings report ranked by severity
  • Executive summary (one page, non-technical)

Not included

Scalability analysis, infrastructure review, multi-service architecture, compliance readiness.

Most Popular

Tier 2

Deep Dive

$3,450

10 business days

Best for

Established products (50K–200K lines of code), multiple services or integrations, team of 2–15 engineers. CTOs who need a complete technical picture before a board presentation, new engineering hire, or Series A data room.

What's included

  • Everything in Snapshot, plus:
  • Full architecture review: service dependencies, single points of failure, data flow mapping
  • Scalability analysis: database design, query performance, caching gaps, API bottlenecks
  • Infrastructure and deployment review: CI/CD, environment parity, container configuration
  • Secrets management and third-party integration security
  • Full findings report (15–30 pages) with severity matrix
  • 60-minute readout call with lead auditor

Not included

Compliance readiness (SOC 2, HIPAA, GDPR), penetration testing surface mapping, investor-ready attestation letter.

Tier 3

Pre-Due Diligence

$7,450

15–20 business days

Best for

Complex or multi-service architectures, compliance-sensitive industries (healthcare, fintech), companies preparing for acquisition, PE tech due diligence, or Series B/C compliance requirements.

What's included

  • Everything in Deep Dive, plus:
  • SOC 2 / HIPAA / GDPR readiness gap analysis
  • Penetration testing surface map — attack vectors, exploitability, risk rating
  • Multi-environment review: staging vs. production delta, configuration drift
  • Technical debt quantification: estimated remediation cost by severity tier
  • Architectural risk scoring with category breakdown
  • Investor-ready executive report (M&A / fundraise data room)
  • Written attestation letter confirming independent technical review
  • 90-minute readout call, shareable recording

UX & UI Clarity Audit

"Find out if your users actually understand what your product is asking them to do."

A senior Onix UX specialist reviews your interface as a thoughtful human user — not through automated heuristics alone. Every tier delivers annotated screenshots with severity-rated findings and specific, actionable recommendations. Not "improve this button" — "change the label from 'Submit' to 'Save and continue' and add a loading state, because users are clicking twice thinking nothing happened."

Tier 1

Flow Focus

$950

3–4 business days

Best for

One specific flow that's underperforming — high drop-off, conversion problem, or user confusion feedback on a specific screen sequence.

What's included

  • End-to-end walkthrough of the selected flow (desktop + mobile)
  • Annotated screen-by-screen review with severity ratings
  • 5–10 specific, actionable redesign recommendations
  • Friction map: where users stop, hesitate, or make mistakes
  • One-page summary: top 3 highest-impact changes to make immediately

Not included

Other flows or screens, accessibility compliance check, competitor benchmarking, user research sessions.

Most Popular

Tier 2

Full Product Audit

$2,250

7–8 business days

Best for

Founders preparing to show the product to enterprise customers or investors; teams before a major redesign; any product where user experience is a growth lever.

What's included

  • Everything in Flow Focus across the full product, plus:
  • All primary user flows reviewed end-to-end
  • Heuristic evaluation against Nielsen's 10 usability principles
  • Visual consistency check across all screens
  • WCAG 2.1 AA accessibility basics: keyboard nav, contrast ratios, screen reader fundamentals
  • Mobile responsiveness review (iOS + Android)
  • Full annotated report ranked by severity and business impact
  • 45-minute readout call

Not included

Moderated user sessions, competitor benchmarking, full WCAG compliance report, executive presentation deck.

Tier 3

Competitive & Compliance

$4,750

14–16 business days

Best for

Products in regulated industries (healthcare, fintech, legal) where accessibility is a legal requirement; companies considering major repositioning; products evaluated by enterprise procurement teams.

What's included

  • Everything in Full Product Audit, plus:
  • 3 moderated remote user sessions (60 min each) — recorded, synthesized into actionable findings
  • Competitor UX benchmarking vs. 2–3 named competitors
  • Full WCAG 2.1 AA compliance report with legal risk assessment
  • Emotional tone and brand alignment review
  • Executive presentation deck (board-ready)
  • 60-minute readout + Q&A call, shareable recording

Manual Functionality & QA Audit

"Find out if your product actually works the way you think it does."

A senior Onix QA engineer builds a complete functionality matrix from scratch — every feature, every flow, every claimed behavior — then tests all of it by hand. Every tier delivers a functionality matrix you keep and a bug report with reproduction steps, severity ratings, and business impact assessments.

Tier 1

Core Check

$1,200

5 business days

Best for

Founders who have never had QA and want a sanity check before a demo, launch, or investor meeting. Up to 20 features or flows.

What's included

  • Functionality matrix built from scratch (up to 20 features/flows)
  • Happy-path testing for every item
  • Critical edge-case testing: empty states, error messages, invalid inputs, boundary values
  • Bug report with reproduction steps and severity ratings
  • Basic cross-browser check: Chrome, Safari, Firefox

Not included

Third-party integration testing, mobile device testing, performance testing, regression test plan.

Most Popular

Tier 2

Complete Coverage

$2,950

10 business days

Best for

Products going into a major partnership, enterprise customer onboarding, or a new market launch.

What's included

  • Everything in Core Check across the full product, plus:
  • Full functionality matrix with no feature limit
  • All primary and secondary flows, including multi-step and state-dependent paths
  • Third-party integration testing: payments, auth, APIs, webhooks
  • Cross-browser: Chrome, Safari, Firefox, Edge
  • Mobile: iOS (Safari) + Android (Chrome), portrait + landscape
  • Bug report with business impact ratings
  • Regression test plan — reusable by your team on each release

Tier 3

Pre-Launch Sign-Off

$5,750

15 business days

Best for

Formal public launches, enterprise security reviews, or any engagement where a third party needs documented evidence the product has been independently tested.

What's included

  • Everything in Complete Coverage, plus:
  • Performance baseline testing at projected peak concurrent user counts
  • Data integrity testing: concurrent writes, partial failures, session interruptions
  • Security-adjacency testing: auth bypass attempts, input validation, session fixation
  • Formal go/no-go assessment document (data room / board deck ready)
  • Remediation verification: re-test of Critical + High bugs at no additional charge
  • 60-minute readout call with the lead QA engineer

Bundle all three audits at one tier — save up to 20%.

One coordinated team. Three reports cross-referenced. One unified Audit Readout with a master remediation roadmap.

Bundle Includes Individual Bundle Price You Save Timeline
Starter Bundle

Less than one day of downtime recovery costs for a mid-market SaaS.

 Snapshot + Flow Focus + Core Check $3,600 $2,950 $650 (18%) 1 week
Standard Bundle

Less than two weeks of a US senior engineer's fully-loaded salary.

 Deep Dive + Full Product Audit + Complete Coverage $8,650 $6,950 $1,700 (20%) 2 weeks
Enterprise Bundle

The Enterprise Bundle delivers the same depth — including a data-room-ready attestation letter — at less than half the price.

 Pre-Due Diligence + Competitive & Compliance + Pre-Launch Sign-Off $17,950 $14,450 $3,500 (20%) 3–4 weeks
Starter Bundle

Snapshot + Flow Focus + Core Check

$2,950$3,600

Save $650 (18%)

1 week

Standard Bundle

Deep Dive + Full Product Audit + Complete Coverage

$6,950$8,650

Save $1,700 (20%)

2 weeks

Enterprise Bundle

Pre-Due Diligence + Competitive & Compliance + Pre-Launch Sign-Off

$14,450$17,950

Save $3,500 (20%)

3–4 weeks

Not sure which tier is right?

Choose Starter if:

  • Your product is an MVP or early-stage app
  • You've never had any audit done
  • Your timeline is urgent — demo or pitch in under two weeks
  • You want to understand your risk level before committing to a deeper review

Choose Standard if:

  • Your product has real users and real revenue
  • You have a board presentation, Series A, or enterprise customer conversation coming up
  • You want a complete picture, not just the headline risks
  • You're about to hire your first senior engineer and want to give them a head start

Choose Enterprise if:

  • You're in a regulated industry (healthcare, fintech, legal)
  • You're preparing for M&A, acquisition, or Series B/C
  • You need a document for a data room or a formal sign-off for a customer contract
  • You want competitor benchmarking or user research in the UX work

Still not sure? The 30-minute scope call is how we figure it out together. We'll tell you honestly which tier makes sense — and if you don't need an audit right now, we'll tell you that too.

Scanners find patterns. Senior engineers find problems.

"95% of clients say Onix uncovered issues their previous team missed."

Automated scanners
Onix human review
Flag code that matches known vulnerability signatures
Understand the actual intent of the code and whether the logic is sound
Produce lists of issues with no business context
Rank findings by actual business impact — what breaks the product vs. what is theoretical
Miss architectural problems entirely
Evaluate whether the system design is appropriate for the scale you're targeting
Cannot test multi-step user flows
Walk through the product as a real user, including paths no script would explore
Cannot evaluate whether the UI makes sense to a human
Assess information hierarchy, trust signals, and usability from a real user's perspective
Can be run by anyone with a free license
Require senior engineers with 20+ years of pattern recognition

We use automated tools as a first pass. Then a senior engineer reads the output and tells you what it actually means.

We've been inside more codebases than we can count.

20+ years

of custom software development

82%

of clients return with new projects

200+

software projects rescued

95%

of clients say we uncovered issues their previous team missed

Our project rescue practice has put Onix engineers inside more broken codebases than almost any team in the industry. We have seen what happens when architecture meets scale for the first time. We have seen what happens when a security gap meets a motivated attacker. We have seen what happens when users encounter a UI that the developer understood perfectly but no one else does. This experience is the audit product.

5 industries: travel, healthcare, fintech, logistics, CRM

The people who do the work.

26 senior engineers, architects, designers, and QA leads, representing a combined total of over 400 years of experience.

Oleksandr Bilous
Oleksandr Bilous
Developer, Architect
Andrii Kramar
Andrii Kramar
Developer
Denys Sheremetov
Denys Sheremetov
Admin, Manager, Support
Mykola Makarevych
Mykola Makarevych
Manager
Serhii Shevchenko
Serhii Shevchenko
Manager
Oleh Chumachenko
Oleh Chumachenko
Developer
Dmytro Kozlovskyi
Dmytro Kozlovskyi
DevOps, Architect
Volodymyr Bandurka
Volodymyr Bandurka
Developer, Architect
Volodymyr Hordiienko
Volodymyr Hordiienko
Developer, Architect
Serhii Zhabotin
Serhii Zhabotin
Developer
Kostiantyn Kovalenko
Kostiantyn Kovalenko
Developer, Tech Lead
Serhii Kovalchuk
Serhii Kovalchuk
Developer, Tech Lead
Oleh Adihnalov
Oleh Adihnalov
Admin, Developer, Tech Lead
Yevhenii Dziubenko
Yevhenii Dziubenko
Developer, Tech Lead
Volodymyr Perepelytsia
Volodymyr Perepelytsia
Developer, Tech Lead, Architect
Mariia Perepelytsia
Mariia Perepelytsia
Developer, Tech Lead
Valerii Zlenko
Valerii Zlenko
QA, Lead
Oleh Koval
Oleh Koval
Developer
Kateryna Lytvyn
Kateryna Lytvyn
Designer, Tech Lead
Valerii Checha
Valerii Checha
Developer, Architect
Yuliia Herhardt
Yuliia Herhardt
Developer, Tech Lead
Andrii Ivanov
Andrii Ivanov
Developer
Maksym Honcharov
Maksym Honcharov
Designer, Lead
Maksym Petliuk
Maksym Petliuk
Developer
Mykola Puzyr
Mykola Puzyr
Developer, Tech Lead
Mykola Dikhtiar
Mykola Dikhtiar
DevOps, Architect

Not a conversation. A document.

The Report

A written assessment delivered as a structured PDF: executive summary for non-technical stakeholders, full findings section for your engineering team, and a prioritized remediation roadmap ranked by severity and business impact.

The Readout Call

A 60-minute session with the lead auditor after delivery. Ask every question you want. We explain findings in plain language, answer "how bad is this really," and give our honest opinion on remediation priorities. Recording provided.

Yours Forever

Every deliverable is yours unconditionally — the functionality matrix, the bug report, the architecture notes. No subscriptions, no lock-in. You are not required to use Onix for remediation.

The best time to do this audit was before you shipped.
The second best time is now.

01

Investor due diligence is not optional at Series A/B.

Every serious Series A investor will ask about technical risks. Every Series B investor conducts formal tech due diligence. The companies that close faster are the ones that walk into the data room with a clean audit report already in hand — not the ones scrambling to respond to diligence questions on a 48-hour deadline.

02

Enterprise customers have security requirements.

If you're selling to any company with an information security policy, you will eventually get a vendor security questionnaire. The questions are specific: Do you conduct third-party security audits? When was your last penetration test? The audit answers those questions before the customer asks them.

03

The breach doesn't announce itself.

The 1.5 million API keys leaked from a vibe-coded platform were exposed for weeks before anyone noticed. Problems in untested systems accumulate quietly — until they don't.

04

The longer the codebase runs unreviewed, the more it costs to fix.

Technical debt compounds. An architectural flaw found at 10,000 users costs a fraction of what it costs to fix at 100,000 users — by then it's tangled into every feature built on top of it.

How it works — from first call to final report.

Step 1

30 minutes · Free

Scope Call

We look at what you've built, understand your stack, and tell you which packages make sense for your situation. No obligation. If the full bundle is overkill for your stage, we'll say so.

Step 2

Day 1–2

Kick-Off & Access

We send one access request: read-only access to your repository and staging environment. You don't need to prepare anything. We start from what exists, not from what you'd like it to look like.

Step 3

Week 1–2

Review

Our team works through the codebase, product, and interface. We don't need your time during this phase — one check-in call midway to ask clarifying questions.

Step 4

Day 10–20 (depending on tier)

Readout

You receive the written report. We schedule the readout call. You leave with a complete picture and a prioritized list of what to fix.

1

30 minutes · Free

Scope Call

We look at what you've built, understand your stack, and tell you which packages make sense. No obligation.

2

Day 1–2

Kick-Off & Access

One access request: read-only access to your repository and staging environment. No preparation needed.

3

Week 1–2

Review

Our team works through the codebase, product, and interface. One check-in call midway.

4

Day 10–20

Readout

Written report delivered. Readout call scheduled. You leave with a complete picture and a prioritized list of what to fix.

Common questions

Never. All findings are covered by NDA, signed before we see a single line of code. We've audited fintech infrastructure and healthcare systems — confidentiality is not optional in those industries, and it applies to everything we review.

These are good tools for catching known patterns. They don't evaluate architecture, don't understand business context, don't test multi-step user flows, and can't assess whether your UI makes sense to a real user. We use automated tools as a starting point — then a senior engineer interprets what the tools missed.

That is what the audit is for. Finding a critical vulnerability in a closed engagement with Onix is a very different situation from finding it after a breach, a failed raise, or an enterprise customer's security team discovering it. We'll tell you exactly what it is, how serious it is in your specific context, and what fixing it looks like.

It is common, not disqualifying. We build the functionality matrix from scratch by exploring the product. We've reviewed codebases where the documentation was either missing or wrong.

Read-only access to a private repository and staging environment. We will never request production database access. We can work with a sanitized repository export if you have specific concerns about access.

Yes. Each package is independent. Most clients start with the Technical Audit and add the QA audit after seeing the value of the first report.

No. The report and remediation roadmap are yours unconditionally. Some clients use Onix to fix what we found. Some use their internal team. Some use other vendors. The audit is not a sales tactic — it is the product.

Find out what's in your codebase.

I want to start with…

Technical Audit — Architecture, security, and scalability
Full Bundle — All three reviews, unified report
I'm not sure which package

30 minutes. No obligation. We'll tell you exactly which package makes sense for your system — and if we don't think you need an audit right now, we'll tell you that too.

20+ years · 200+ projects rescued · 82% of clients return · NDA signed before access