# Pentests for web agencies

# Your client asks for a pentest. HackIndex does it for you.

HackIndex tests the websites and apps you build. The report is in your client's name or white label in your agency's name, with a fix for each finding that your developers can apply straight away.

**From €1,950 excl. VAT**. Web and API pentest, fixed price after scoping

- **Report**: White label or in your client's name
- **Permission**: In writing, from the owner of the app
- **Up front**: NDA before anything is shared
- **Start**: By arrangement, usually within two weeks
- **Retest**: Included from Standard

[Request a pentest](https://hackindex.nl/en/contact)

## When agencies bring in HackIndex

- **A client demands a pentest report** For example for their own audit or for their customers. You deliver the report without testing yourself.
- **A tender asks for it** A recent pentest is then often a requirement to take part.
- **Something big goes live** Test a new module, payment flow or API before real users can reach it.
- **You take over a codebase** Know what you take on before you are responsible for it.

## Who does what

A test through an agency has three parties. The agreements are set before anything is tested.

### You: The agency

- Requests the test and gets a fixed price
- Chooses: report in the client's name or white label
- Fixes the findings, or has HackIndex do it

### Your client: The owner

- Gives written permission for the test
- Even when you place the order
- Gets a statement for their auditor on request

### HackIndex: The tester

- Signs the NDA before anything is shared
- Only tests within the scope and test window
- Delivers report, debrief and retest

## What your developers get

Written for the people who fix it, with extra depth in Laravel, WordPress and React Native.

1. **For each finding**: The evidence, the impact and a fix that suits your client's stack.
2. **Debrief**: The findings walked through with your team, so everyone knows what comes first.
3. **Retest**: Once fixed, every finding is tested again, with the status of each finding in the report.
4. **Statement for the auditor**: On request a one-page statement, without findings, for your client.

[View the sample report](https://hackindex.nl/downloads/hackindex-sample-report.pdf)

## What you can have tested

- [Web and API pentest](https://hackindex.nl/en/web-and-api-pentest): Web apps, portals and APIs, with extra depth in Laravel and WordPress
- [Mobile pentest](https://hackindex.nl/en/mobile-pentest): iOS and Android apps, including the API behind them
- [Security code review](https://hackindex.nl/en/security-code-review): Your client's source code read for vulnerabilities
- [GDPR code check](https://hackindex.nl/en/gdpr-code-check): How the code handles personal data

## Several clients or a fixed arrangement

Building for several clients? Ask about an arrangement for several sites, or a yearly test with a price agreed together. That way you do not have to arrange it again for every project.

[Request a pentest](https://hackindex.nl/en/contact)

## Frequently asked questions

### Can the report be in my agency's name?

Yes, white label. Or in your client's name. You choose when you request it.

### Can I include the pentest in my own quote?

Yes. Once the scope is agreed you get a fixed price, which you can pass on.

### Who gives permission for the test?

The owner of the application, in writing. Even when you place the order.

### Do you fix the findings too?

The report is written for your developers. If you lack the capacity, HackIndex can fix them as a separate assignment at extra cost, for apps in Laravel, WordPress, WooCommerce, Magento, another PHP framework, Node.js or Python.

## Get your client's app tested.

Tell which client and what needs testing. You get a proposal with a fixed price.

- [Request a pentest](https://hackindex.nl/en/contact)

## Glossary

- **Debrief**: A call about the report: what was found, how serious it is and in which order to fix it.
- **Retest**: Once the issues are fixed, every finding is tested again to confirm the fix works.

Source: https://hackindex.nl/en/for-agencies