Website and software security audits in Leeds.
Independent security reviews of websites and software, with a written report, prioritised findings and a plan to fix them.
In short
Graeyna carries out security audits of websites and web applications for businesses in Leeds and West Yorkshire. We review your application against common risks such as the OWASP Top 10, check logins and access control, patch levels, hosting, TLS and security headers, backups and UK GDPR basics, then deliver a written report with prioritised findings and a fix plan.
When a security audit makes sense.
Before launching a new system
A go-live readiness review so a new portal, shop or application starts life without obvious holes.
After inheriting a website or app
You have taken over software from another developer or agency and need to know what you are now responsible for.
Businesses handling personal data
Firms storing customer, patient or employee details who want to show they take UK GDPR seriously.
When a client or insurer asks
A customer questionnaire, tender or cyber insurance renewal wants evidence that your systems have been reviewed.
What the audit covers.
Application security review
Your site or application checked against common risks, using the OWASP Top 10 as a framework: injection, broken access control, insecure design, misconfiguration and more.
Authentication and access control
Login, password reset, sessions, multi-factor options and whether each user can only see and change what they should.
Dependencies and patch levels
Frameworks, plugins, libraries and server software checked for known vulnerabilities and unsupported versions.
Hosting, TLS and headers
Server configuration, certificates and TLS settings, security headers, exposed files and admin areas, and how secrets are stored.
Backups and recovery
Whether backups exist, where they live, who can reach them and whether a restore has ever actually been tested.
UK GDPR basics
What personal data the system holds, where it goes, how long it is kept and whether the basics of security and access are in place.
How a security audit runs.
Scoping call
We agree what is in scope, what access we need and when testing is safe to run.
Review and testing
Code, configuration and the running system reviewed without disrupting your customers. Before any testing starts, we agree the scope with you in writing and get your written permission.
Written report
Each finding explained in plain English, rated by risk, with a recommended fix.
Fix plan and re-check
Your team fixes the issues or we do, then we re-check that each one is closed.
Typical timescales
- Website security review
- 1 to 2 weeks
- Web application audit
- 2 to 4 weeks
- Go-live readiness review
- Planned around your launch date
What it costs
Every project is quoted individually after a short call.
Cost depends on the size of the system, whether we can review the source code as well as the live site, and how many user roles and integrations need checking.
Book a short callA practical security review, in plain English.
Most security problems in small and medium-sized businesses are not exotic. They are an out-of-date plugin, an admin page anyone can find, a user who can see another customer's data by changing a number in the address bar, or backups that have never been restored. A security audit finds those problems before someone else does, and explains them in language the people paying for the fix can follow.
We review the application itself as developers, because that is where many of the serious issues sit, as well as the hosting and configuration around it. For businesses in Leeds and across West Yorkshire that also means we can meet to walk through the findings, and if you want, carry out the fixes ourselves rather than handing you a list and leaving.
An audit is a review, not a guarantee. It reflects the system at a point in time and within the scope we agree, and it is not a certification. What it gives you is a clear, prioritised picture of your risks and a realistic plan to reduce them, which is what clients, insurers and regulators increasingly expect to see.
What you receive
-
A written report - findings explained in plain English, with evidence.
-
Prioritised findings - rated by risk, so the important fixes come first.
-
A fix plan - what to change, who should change it and roughly how long it takes.
-
The option to have us fix it - followed by a re-check that each issue is closed.
Systems we build and run ourselves.
Our own products are live and used at real events, so we apply the same security checks to our own systems that we apply to yours.
“Prompt communication, real attention to detail, and a website we're extremely pleased with. Highly recommended.”
Security audit questions.
Not quite. A penetration test focuses on attacking a system to see what can be exploited. Our audits combine a review of the code and configuration with careful hands-on testing of the running system, which suits most small and medium-sized businesses well. Before any testing starts, we agree the scope with you in writing and get your written permission. If you need a formal penetration test for compliance, we can tell you when that is the right choice.
Before any testing starts, we agree the scope with you in writing and get your written permission. We also agree methods and timings in advance and avoid anything that could disrupt customers. Where a test carries any risk, we run it against a staging copy instead of the live system.
Yes. Reviewing inherited software is one of the most common reasons clients ask for an audit. Access to the source code gives a more thorough result, but we can also review the live system on its own.
If you want us to. The report is written so any competent developer can act on it, but many clients ask us to carry out the fixes and then re-check them. We can also put the system on a maintenance plan so it stays patched afterwards.
Yes. Most audit work is done remotely, so we can review systems for businesses anywhere in the UK. For clients in Leeds and across West Yorkshire we are also happy to present the findings in person.
No single review can do that. We check the security basics UK GDPR expects for the system in scope, such as access control, encryption in transit, backups and data retention, and flag gaps. Wider compliance, such as policies and contracts, is a matter for your data protection lead or adviser.
Working from Leeds across West Yorkshire and the UK. See the areas we serve.
Tell us what you're trying to build.
We'll give you a straight answer on scope, cost and timescale - and honest advice if we're not the right fit.