A five-day written audit · fixed price · delivered in working days
Know what is
real in your product.
One careful visitor goes through your live product the way a paying customer would — sign-up, the core flow, the edges — and writes down what is real, what is only painted on, and what a customer cannot tell apart.
Delivered in 5 working days. If we find nothing real, you pay nothing.
- 10checks, same set, same order, every time
- 5working days, with a written report at the end
- $450fixed, paid up front, no retainer
- 0lines of your code we need to see
01 — Why this exists
A screen can be beautiful and still be an empty shell.
A dashboard can show numbers that nothing calculates. A privacy page can promise something the code never does. The person who notices is usually a customer, at the worst possible moment — or an auditor, before they pay.
The demo is the product
Flows that were built for the pitch deck and never wired to anything behind them.
Claims with no page
"SOC 2 ready", "bank-level encryption", "GDPR compliant" — with nothing behind the sentence.
Template residue
Lorem ipsum, stock testimonials, default meta titles, and privacy text copied from a generator.
02 — The ten checks
Nothing is reported on a hunch.
Every audit runs the same set, in the same order, with evidence recorded for each one.
- 01Does the core flow finish? Sign up, do the one thing the product is for, and see whether it completes without a developer watching.
- 02Is the data real? Whether numbers on screen come from something that computes them, or were typed into a fixture.
- 03Where does the money go? Test-mode keys in production, a checkout that never charges, a plan that grants nothing.
- 04Can a stranger recover? Password reset, email verification, and what happens on a second device.
- 05What do the claims rest on? Security and compliance language checked against a page, a document, or nothing.
- 06Where does your data go? Third-party calls fired on load, tracking before consent, forms that post somewhere unexpected.
- 07Broken links and dead ends Every link a customer might click, confirmed by fetching it rather than trusting the markup.
- 08Template residue Placeholder text, stock testimonials, default titles, generated legal pages.
- 09What a link preview says The card shown when someone pastes your URL into Slack or a message — often the first impression.
- 10What breaks at the edge Empty states, an interrupted flow, a slow connection, a very long input.
03 — What a finding looks like
Written for whoever has to decide what to fix first.
One real finding from a recent audit, anonymised. Severity, evidence, and the smallest fix that removes the risk.
The email sign-up accepts addresses but nothing is ever sent
The form on the landing page posts to a handler that writes to the database and returns 200. There is no mail provider configured, and no job that reads the table — so a visitor who signs up is told "check your inbox" and receives nothing.
"Thanks — check your inbox for the confirmation link." — shown after every successful submission, /signup, 14:22 UTC.
Fix: wire the table to a real sender — about an hour with a transactional provider — or change the page to "we'll email you when it's ready" and stop promising a confirmation that does not exist.
04 — Pricing
Fixed price, paid up front, delivered in writing.
No subscription, no retainer, no seat count.
The Self-Check Pack
The same ten checks, written out, so you can run them yourself tonight.
- Pass condition and common failure for each check
- Instant download
- Written by the same person who runs the audit
The Mechanism Audit
One product, audited as a careful visitor. A written report in five working days.
- All ten checks, evidence recorded for each
- Every finding with a severity and a fix
- 30-minute walkthrough call
- If we find nothing real, you pay nothing
The Fix Sprint
Everything in the audit, with the findings closed over two weeks.
- The full audit, then the fixes made with you
- Every finding re-tested at the end
- A pass/fail record you can show customers
05 — Five days, in the open
You are told where the audit is at each stage.
Nothing is written about a product we have not used.
- DAY 1
Kickoff
What the product is meant to do, and the one flow that matters.
- DAY 2
Walk it as a stranger
Sign-up, the core flow, the edges.
- DAY 3
The ten checks
With evidence recorded for each one.
- DAY 4
Written up
Severity, evidence, the smallest fix.
- DAY 5
Delivered
Report, walkthrough call, questions answered.
06 — Questions
The awkward ones, answered.
If the answer you need is not here, mechanismaudit@atomicmail.io reaches a person.
Do you need access to my code or database?
No. The audit is done from the outside, as a customer: a fresh account, a browser, and the public pages. If something can only be judged from inside, we say so instead of guessing.
Will you write about it publicly?
Never without permission. Findings are yours. We may ask later whether we can describe a finding without naming you, and "no" is a complete answer.
What if the product is genuinely fine?
Then the report says that, with the evidence, and we tell you before you pay for more. An audit that finds nothing is a result, not a failure.
What counts as a product?
One live web application and its public marketing site. A second product, an API, or a mobile app can be added, quoted separately.
Refunds?
If we cannot deliver the report in five working days, you are refunded in full. Once delivered the work is done — but if a finding is wrong, it is removed and the price of the audit is credited.
Find out before a customer does.
Five days, one product, a written answer to the only question that matters: does it actually do what the page says it does?