01
Your team wants to use the app tomorrow.
With Lovable, Bolt or Cursor you have a working app in a few days. Whether it’s ready for real data, you can’t tell by looking at it.
for apps built with Lovable, Bolt or Cursor
Your app works. Is it ready to go live?
Someone on your team built an app with AI. In a few days we check it for security, privacy, usability and maintenance. You then get a prioritised list of fixes: what needs to happen before it goes live. It’s a thorough review, not a pentest.
No obligation · 30 minutes · online, with someone who builds apps
At a glance
- Duration
- A few days, with one fixed point of contact
- We assess
- Security, privacy, usability and maintenance
- You get
- A verdict, a prioritised fix list and a short report for IT
Sound familiar?
Building was quick. Going live is something else.
02
IT asks: is this safe?
Who can get in? Where is the database? Is there a key in the code? The tool you built it with doesn’t answer that.
03
Is your data properly locked down?
In apps built with AI, the database is often open to anyone who knows where to look. You only notice when someone finds it.
04
Who will maintain it later?
The maker has a regular job too. If something breaks, or that colleague leaves, who fixes it?
What we look at
Four tests for your app
We put every app through the same four questions. If your app uses AI itself, we also look at fairness and energy, as in the AI Scan.
Security
Can someone get in who shouldn’t?
We check
Login and permissions, whether the database is shielded per user, keys and passwords in the code, and whether a bit of poking around gets you into someone else’s data.
Privacy
What data does the app store, and where?
We check
Which personal data goes in, where hosting and database are located, which services can see the data (an AI service, analytics) and whether you need a data processing agreement.
Usability
Can a colleague use it without an explanation?
We check
Whether the main tasks go smoothly, what happens with an error or an empty list, whether it works on a phone, and whether it’s usable with the keyboard or a screen reader.
Maintenance
Could someone else keep building it tomorrow?
We check
How the code is put together, where the app runs, whether there are backups, what it costs per month and what happens if the maker leaves.
How it works
From code to verdict in a few days
We start after an introductory call and a proposal we agree on together. Your app simply keeps running. We ask for read access to the code, a test account and a little of the maker’s time.
- 1
Kick-off
Day 1. An hour with the maker: what the app does, who uses it and with which data.
- 2
Access
Day 1. Read access to the code, for example via GitHub, and a test account. Preferably with test data.
- 3
Review
Days 2 to 4. We go through the four tests, in the code and in the app. As a regular user, and as someone with bad intentions.
- 4
Verdict
Day 4. A priority for each finding: fix now, soon or OK. And an answer: live, live after fixes, or not yet.
- 5
Feedback
Day 5. We go through everything with the maker and IT. You get the report and the fix list.
What it asks of your team: read access to the code, a test account and 1 to 2 hours of the maker’s time.
After a first conversation you get a proposal with a clear scope and a fixed price.
What you get
A verdict, and a list to work from
Not a thick report that ends up in a drawer. You get four things the maker can use straight away.
- A verdictLive, live after fixes, or not yet. With the reasons, in language both management and IT can follow.
- A prioritised fix listWhat comes first, what can wait, and how to solve it. The maker can do many fixes themselves, with the same tool.
- A short report for IT and DPOWhere the app runs, which data it processes and which services can see the data.
- A maintenance planWho maintains the app, how much work that is, and what happens if the maker leaves.
Example
Fix list
5 of 23 findings
-
Database is readable without login
Security
Turn on per-user rules in the database
Fix now
-
No database backups
Maintenance
Set up and test a daily backup
Fix now
-
Form doesn’t work with the keyboard
Usability
Add labels and a visible focus
Soon
-
Client names go to an AI service in the US
Privacy
Leave out names or choose an EU service
Fix now
-
Login via Microsoft 365
Security
Works with your existing accounts and permissions
OK
Made-up example. In your real fix list, each finding also says how to check whether the fix worked.
After the check
Then you decide what comes next
The fix list is yours. The maker can work through it themselves, with us or with another partner.
Finish it yourself
Many fixes can be done with the same tool the app was built with. If you want certainty, we check them afterwards.
Make it production-ready
We complete the fixes and put the app on solid hosting in the EU, in your organisation’s name.
Hosting and maintenance
We keep your app safe and up to date, with updates and backups. We’ve been doing that since 2011.
Or nothing
If your app is ready, we’ll say so. Then you won’t need us after that.
Who builds it
A new brand, built on fifteen years of craftsmanship
Ethic is Zenjoy’s AI studio, based in Leuven. What we check in your app, we do every day in our own work. If it then needs finishing and maintaining, the same team can do that.
15 years
building and maintaining software
400+
organisations
4 years
AI in our own work every day
Frequently asked questions
What people often ask us
Question not listed? Just ask us.
Data processing agreement on request.
Do you get access to our data?
Preferably not. We work with read access to the code and a test environment with test data. If we do need real data, we agree in advance what, for how long and read-only.
Do you sign an NDA and a data processing agreement?
If you ask for a confidentiality or data processing agreement, we arrange it before the start. If you work with your own template, we’re happy to review it.
Does this also work for tools other than Lovable?
Yes. Bolt, Replit, Cursor, v0 or Claude Code: we look at what comes out of it, so the code, the database and the hosting. We’re also happy to check an app a colleague wrote without AI.
Is this a pentest?
Not the heavyweight kind. We check what most often goes wrong in apps built with AI, in the code and in the app itself. If your app handles sensitive data, such as health or pupil data, we recommend a full pentest afterwards.
Should the maker be worried?
No. Building a working app is a real achievement. We look at the app, not the person, and explain every fix. That way the maker learns something too.
Do we have to buy anything from you afterwards?
No. The verdict and the fix list are yours. You can work through them yourself or with another partner.
Want to know if your app is ready to use?
In a 30-minute conversation we look at what your app does, and whether a Reality Check makes sense.
No obligation · 30 minutes · online, with someone who builds apps