Agency-coordinated
Your agency remains the project contact, coordinates written authority and nominates the report recipients. LetsSecure performs the agreed audit and returns the reviewed handoff.
Give clients independent security evidence without building an in-house security team.
LetsSecure reviews an authorised website, separates useful evidence from tool noise and gives your agency a developer-ready handoff. Start by putting your own website through the same process at no charge.
See the deliverable before you put it in front of a client.
Your complimentary audit uses the same scope, review process and reporting structure as a paid client engagement. Your team can judge the evidence, language and developer guidance before deciding whether LetsSecure belongs in a project.
For account teams Explain what deserves attention in language a client can act on.
For developers Receive ranked tasks backed by evidence and remediation direction.
For handover Record what was reviewed, excluded and ready for rechecking.
Keep control of the client relationship.
Choose the handoff that fits the project. Before work begins, LetsSecure and the agency confirm who will communicate with the client, who receives the report and who is responsible for remediation.
Direct introduction
Your agency introduces the client. LetsSecure confirms scope, authority and booking directly, while including the nominated agency contact where the client agrees.
Four steps from scope to recheck.
The client or authorised agency confirms the systems LetsSecure may assess. Third-party platforms remain excluded unless their owner separately authorises testing.
- 01 / AuthoriseConfirm ownership, client authority, permitted assets and exclusions.
- 02 / AssessReview the public surface and approved logged-in journeys using controlled checks.
- 03 / HandoffDeliver owner context, ranked developer tasks and supporting evidence.
- 04 / RecheckVerify reported fixes requested within the included 14-day window.
One report for the client and the developer.
- Scope and assessment limitations
- Business-readable executive summary
- Ranked developer remediation plan
- Finding evidence and validation notes
- Positive controls and test coverage
Clear responsibilities before the audit starts.
Your agency retainsLetsSecure providesThe client receives
Client relationship and project managementScope confirmation and controlled assessmentPlain-language owner summary
Implementation estimates, development and backupsEvidence review and prioritisationRanked findings with supporting evidence
Deployment and production change controlDeveloper-ready reporting and included recheckPractical remediation direction
Start with your agency. Refer only if the work fits.
The first audit of your agency's own public website is complimentary. There is no requirement to purchase another service or refer a client afterward.
- One complimentary initial audit per Australian agency
- Agency-owned website and written authority required
- Third-party systems remain excluded without separate owner authority
- Scope and scheduling confirmed before testing begins
What agencies usually need to know.
These answers set the starting position. Any different communication, reporting or delivery arrangement must be agreed before a client books.
Who can request the complimentary audit?
Australian agencies that design, build, host or maintain client websites can request one initial audit of their own public agency website, subject to written authority, agreed scope and scheduling.
Does the agency have to refer clients afterward?
No. The purpose is to let your team inspect the real assessment and report before deciding whether it fits any client work.
Who communicates with a referred client?
That is agreed before the engagement. The agency can coordinate the audit, or introduce the client for direct scope and booking. Report recipients are confirmed during authorisation.
Are reports white-labelled?
Current reports are LetsSecure-branded. If a project needs a different delivery arrangement, it must be agreed before the client books.
What are the audit boundaries?
Testing stays within systems authorised in writing. Third-party systems remain excluded without separate owner authority, and authenticated testing uses a dedicated temporary account. LetsSecure does not perform denial-of-service, social engineering or destructive exploitation. The service is not a certification, guarantee or complete penetration test.
Put your own website through the process first.
- Email your agency website and authorised contact.
- Confirm eligibility, permitted assets, exclusions and scheduling.
- Receive the reviewed report and decide whether the service fits client work.