yof
Pricing
Checks of your own apps are free. Reports are one-off orders: you pay once. Patch is the only subscription. Prices are in US dollars.
A full report on a demo app, with the files that come with it.
Payment opens soon. Reports can't be ordered yet, and nothing is charged. Patch is free early access until then.
Reports
| Security report: Outside | Everything yof can check from the outside, with coverage and every check listed. | $149 one-off |
|---|---|---|
| Security report: Full | Outside, plus inside your code through GitHub, plus your attack results. | $499 one-off |
| Compliance pack | The Full report, mapped to OWASP ASVS, SOC 2, ISO 27001, GDPR and the laws you pick for your country, with the history of your checks as evidence. | $1,490 one-off |
| EU CRA readiness pack | For companies that ship software or devices into the EU: Cyber Resilience Act readiness with an SBOM, the ENISA check for exploited vulnerabilities, a vulnerability-handling policy to adapt and Art. 14 reporting drafts, mapped to NIS2, DORA, the AI Act and GDPR. Reporting duties apply since 11 September 2026, most others from 11 December 2027. | $990 one-off |
| AI assistant test | Your assistant tested with your consent against the OWASP Top 10 for LLM Applications, and its answers checked against the facts on your own pages. | $299 per assistant one-off |
| Retest + 90-day certificate | We check again after your fixes and show what is fixed. | $99 one-off |
| Fix pack | Patch opens fix pull requests for one report. You review and merge. | $199 one-off |
| Security questionnaire autofill | One questionnaire filled from your yof evidence and your saved answers. Anything yof can't back up is left for you. | $199 one-off |
| Agency bundle | Ten Outside reports for your clients, without yof branding on the cover. | $990 one-off |
Free in the yof app: the CRA reporting helper shows the Art. 14 deadlines and drafts the reports for any exploited vulnerability yof finds in your packages. You check and submit them yourself.
If yof can't finish a report within 14 days, you get your money back.
A report shows what yof's checks found on the day they ran. It never says an app is safe, certified or compliant.
Size limits per order
- One domain per report.
- For reports that read code: one repository of up to about 150,000 lines.
- Only for an app you have proved is yours.
Patch: $29 a month
Patch watches your app, reads your linked repository and opens fix pull requests. You review and merge every change.
Patch costs $29 a month and includes one Outside report every quarter.
Ordering means you accept the Terms of service. How we handle your data: Privacy policy.
Starting a company? See yof Spark for Startups