Question 1

What does TrustDyne scan?

Accepted Answer

Firmware images, Android and iOS apps, Windows and macOS binaries, web applications, code repositories and AWS accounts. Cloud coverage is AWS only. Azure and Google Cloud are not supported yet.

Question 2

How does the fix re-test work?

Accepted Answer

For web findings, TrustDyne keeps the original proof-of-concept request and runs it again against your patched site. The result is either closed (the request no longer works) or still open. It is a re-run of the same test. It does not prove that no other route to the same flaw exists.

Question 3

Can my source code stay on my own machine?

Accepted Answer

Yes, in local mode. A model runs on your hardware, scans the code there, and nothing is sent to TrustDyne. The cloud scanners need you to upload a build, and uploaded files are deleted from storage when analysis finishes. Enterprise accounts can also point each AI feature at their own Bedrock, Azure OpenAI or self-hosted endpoint.

Question 4

How are compliance findings mapped?

Accepted Answer

Each finding is matched to records in a corpus of 79 obligations across 27 frameworks, using CWE identifiers and keywords. No AI is involved in the lookup. When a report is written, the AI is handed only the matched records and may cite only those.

Question 5

What do I get from a scan?

Accepted Answer

A report with a software bill of materials, prioritised vulnerabilities, suggested fixes and compliance mapping. Reports are signed with an AWS KMS key, so a customer or insurer can check that a report has not changed since TrustDyne issued it.

Question 6

What does it cost?

Accepted Answer

The Free plan is £0 with 5 scans a month. Starter is £99 a month and Growth is £299 a month. Enterprise is priced per agreement. A one-off Expert-Led Security Assessment, where a person tests your web app and signs off a report for your customer, is £1,200.

Provider	What for	Location
Amazon Web Services (AWS)	Hosting, compute, storage, encryption keys (KMS), database, authentication (Cognito), email delivery (SES), content delivery (CloudFront), audit logging and AI model access (Bedrock)	United States (us-east-1, N. Virginia)
Anthropic, via Amazon Bedrock	AI models used for analysis and remediation suggestions. Models run through AWS Bedrock. Under AWS's terms prompts and outputs are not shared with the model provider or used to train models.	United States (via AWS)
Stripe	Card payments and subscription billing	Ireland and United States
Google Fonts	Web fonts delivered to your browser when pages load (receives your IP address and browser details)	Global

Sub-processors

Current sub-processors

Only if you connect them

Questions or objections