What are we exposing without knowing it ?
Before deciding anything you need a survey that nobody inside the organisation can produce alone: what your sites, your data, your vendors and your access rights show from the outside. That is what a diagnostic is for, carried out by the engineer himself, delivered in fifteen working days at a fixed price, with no follow-on engagement imposed.
- Lead time15 working days, firm
- Pricefrom 1 950 € to 8 900 € excluding VAT, published
- Follow-onno engagement imposed
15working days
From order to delivery sessionThe lead time is firm from the moment access is received. It applies to each of the three diagnostics, and twenty working days to the full audit.
Nobody in the organisation holds the whole map: a site delivered three years ago, an abandoned extension, a form collecting nobody knows what, a former provider who still holds the hosting keys. Everybody knows their own part. The cabinet therefore surveys the whole thing itself, first from the outside as a visitor or an attacker would see you, then on read-only access, and ties every finding to dated evidence. Your teams fill in no questionnaire and prepare no workshop. Fifteen working days later you receive a signed report that ranks the gaps by severity, states each risk in plain language and prices the measure that closes it on the published grid. The report is yours, in open formats, and the sovereignty diagnostic is deducted in full from the first quarter of a governance contract if you continue.
15 days
Diagnostic deliveredworking days from the moment access is received
1 950 €
The most accessible diagnosticexcluding VAT, deducted in full from the AEO and GEO programme
5 surveys
Inside the full auditsovereignty, compliance, visibility, on site, reconnaissance
0 writes
On your servers, everreconnaissance observes and maps under written mandate
Nobody knows the whole estate.
A site delivered three years ago, an abandoned extension, a form collecting nobody knows what, a provider who still holds the hosting keys. Everybody knows their own part, nobody holds the map. The organisation therefore discovers the gap only when it costs something: a lost search position, data that left the building, an inspection it cannot answer. A diagnostic is not an opinion, it is the inventory that was missing.
Surveys, not a questionnaire.
The engineer surveys the estate himself, first from the outside, then on your read-only access. Every finding is tied to dated evidence, including the capture and the method, so that it holds up against contestation. Your teams fill in no form and prepare no workshop. Where an external survey is not enough, one day on site shows the workstations, the tools actually open and the procedures nobody applies.
A signed report, your property.
The gaps are ranked by severity, each with its risk stated in plain language and the measure that closes it priced on the published grid. The delivery happens in session and is discussed, and the report is handed over in open formats with no dependency on any tool of the cabinet. No follow-on is imposed: you can act alone, with your own provider, or hand the remediation to the cabinet. The sovereignty diagnostic is deducted in full from the first quarter of a governance contract.
Three diagnostics, two supplements, one full audit
Each engagement answers one precise question, for a published price and a written lead time. Follow the link for the detail: what it includes, how it runs, and what it does not do.
| Engagement | What it answers | Published price |
|---|---|---|
| Digital sovereignty | What your sites, forms, extensions, hosting, vendors and access expose today. Deducted in full from the first quarter of a governance contract. See this engagement | 2 900 € |
| Sector compliance | The GDPR, the AI Act and your sector's own obligations, with the register and the evidence you can produce in an inspection. See this engagement | 2 500 € |
| Visibility | What is said about you when a decision maker searches, on Google and in the answer engines, and the positions lost since 2023. See this engagement | 1 950 € |
| On-site survey | One day on site: the AI tools actually in use, the estate, the management software, the infrastructure and the backups. See this engagement | 2 400 € |
| Offensive reconnaissance | Active analysis under written mandate of what your infrastructure exposes to an attacker. The last step before a penetration test. See this engagement | 2 400 € |
| Full audit | The three diagnostics conducted together, survey and reconnaissance included, with data-flow mapping. Up to three entities and ten sites. See this engagement | 8 900 € |
| Remediation plan | The correction programme that follows the audit: gaps prioritised, critical items closed, target architecture, proof of closure. See this engagement | 9 500 € |
All prices exclude VAT and are identical for every client. The five surveys gathered in the full audit cost 12 150 € excluding VAT bought separately, against 8 900 € together. The 2 900 € sovereignty diagnostic is deducted in full from the first quarter of a governance contract, and the 1 950 € visibility diagnostic from the first quarter of the AEO and GEO programme. The two credits do not stack.
What we usually find, told in thirty minutes
A call or an email is enough to know whether a diagnostic makes sense in your organisation. You describe the situation, the cabinet says what it would do, in which order and for what amount, then sends you a written summary within forty-eight hours. No obligation, and no automated follow-up afterwards.
Where do you sit
The size of the organisation does not change the method: it changes the depth of the step and the amount. Find your line, it leads straight to the right page.
| Your organisation | Your situation | Where it leads |
|---|---|---|
| Sole trader, micro-business, association | One site, an unreachable provider, no idea what the engines say about you. | Visibility diagnostic 1 950 € excluding VAT, fixed price |
| Small business, firm of 3 to 20 people | Several sites, online tools opened by the teams, a succession of providers. | Digital sovereignty diagnostic 2 900 € excluding VAT, fixed price |
| Regulated sector: health, banking, insurance, law, accountancy | An inspection is possible, and three sets of rules contradict one another in places. | Sector compliance diagnostic 2 500 € excluding VAT, fixed price |
| Mid-cap, group, listed company | Several entities, and a board asking for a presentable survey of the estate. | Full audit 8 900 € excluding VAT, fixed price |
The objections, answered.
Three reserves come back at every conversation. Here they are, with the cabinet's answer.
We already have an IT provider.
Almost always, and that is precisely why an outside view has value. A provider finds it hard to audit its own work: what it delivered, the access it keeps, the hosting choices it made. The cabinet is not trying to replace it and gains nothing from criticising it. The report goes to the provider as it goes to you, gap by gap, with the measure that closes each one.
An audit is the beginning of an endless invoice.
The price is fixed, published on this site, and known before anything starts. If the survey takes longer than expected, that is the cabinet's problem. No follow-on is imposed, no automated follow-up is triggered afterwards, and the report remains your property in open formats. Many clients leave with the report and have the work carried out elsewhere: that is a foreseen use, not a failure.
We do not have time to mobilise the teams.
The survey starts from the outside, asking nothing of anyone. Then on read-only access, which you can revoke on the day of delivery. The time actually asked of the organisation comes down to handing over the access and attending the delivery session. No questionnaire, no workshop, no spreadsheet for your teams to fill in.
Step 2 · Be cited, and stay cited
A diagnostic ages the day it is signed. The next step measures what the engines say about you every month, and publishes the pages that are missing.
A first conversation of 30 minutes
No obligation, no access to your systems. We look at whether the step you are considering is the right tool for your situation, and the cabinet says no when it is not.
A signed scoping letter
The perimeter, the read-only access, the people, the delivery date and the firm price. Nothing starts before your signature.
The report, then the decision
A dated report that holds up in front of a third party, a session with your executive team, and the list of gaps ranked. You then decide what follows, or you stop there.
8 questions, 8 answers.
The cabinet's answers, in plain terms. If your question is not here, ask it: the answer comes back to you in writing.
In which order should the diagnostics be carried out when everything looks urgent?
Sovereignty first, because you cannot rank what you have not inventoried: the survey of sites, forms, extensions, hosting, vendors and access rights conditions everything else. Compliance second, since most regulatory gaps are explained by a technical fact already surveyed. Visibility in parallel, because it depends on neither of the other two and its diagnostic is deducted in full from the first quarter of the AEO and GEO programme. All three conducted together form the full audit, 8 900 € excluding VAT over twenty working days, on-site survey and offensive reconnaissance included.
Does an audit go out of date, and how often should it be repeated?
A map of an estate goes out of date within a quarter: an extension is added, a provider changes, a tool is opened on a personal account. A diagnostic is therefore a dated survey, not a photograph that lasts, and its value lies in what it triggers in the following weeks. Repeating it every year means paying twice for the same finding: what holds an estate over time is the AEO and GEO programme, from 290 € to 1 290 € excluding VAT a month, or a governance contract whose register is updated at every change.
Can the cabinet audit work delivered by another provider?
Yes, and it is the most frequent case. The diagnostic observes the real state of what is in service, not the promise in the specification: extension versions, code actually served, form flows, access still open, backups never restored. The remediation plan, 9 500 € excluding VAT depending on perimeter, follows on from an audit, ours or a third party's. The report names no person: it names facts, dated and tied to a survey.
Does an audit mean mobilising our teams for fifteen days?
No. The technical surveys are carried out by the engineer, never by a questionnaire sent to the teams. Day 1 asks for a written perimeter and read-only access handed over through an agreed channel; day 15 asks for one hour of your executive team's time. In between, the internal load is measured in minutes, except for the on-site survey, which takes one day and includes fifteen-minute interviews per function.
What does an audit give us that an automated vulnerability scan does not?
A scan produces a list of signatures, an audit produces a decision. Every finding is tied to dated evidence, ranked by real severity, and accompanied by the measure that closes it. Surveys blocked by an anti-robot control are declared as such, never converted into a zero. The report is presented in session to your executive team, signed, in open formats, and remains the client's property.
Can an audit be used to prepare a due diligence or a financial transaction?
Yes, and it is one of the most direct uses of the report. The full audit produces the mapping of flows entity by entity, the state of the processing agreements against article 28 of the GDPR, the map of vendors and their access, and a ranking of the gaps that an executive team can put in front of its board. The published price covers up to three legal entities and ten sites; beyond that the perimeter is costed separately. The cabinet is an engineering practice, not a law firm: it produces the technical evidence, your counsel states the law.
Does a diagnostic commit us to buying what comes next?
No. No follow-on engagement is imposed, and the report stays usable without the cabinet, in open formats. If you do continue, the sovereignty diagnostic is deducted in full from the first quarter of a governance contract, and the visibility diagnostic from the first quarter of the AEO and GEO programme. A diagnostic is not a quote in disguise: its price is fixed and published before you order.
Can several companies in one group be audited inside a single report?
Yes: the full audit covers up to three legal entities and ten sites in a single report, at 8 900 € excluding VAT and twenty working days. The perimeter is listed entity by entity before any gap is judged: forgotten sites and subdomains, mailboxes, storage spaces, accounts opened with vendors, access never revoked. Beyond that perimeter, the scoping happens in the thirty-minute call, which sets the order of work and the amount.