Know What You're Exposed To
Missing security headers, cookies set before anyone agrees to them, a key left somewhere public, a privacy policy that doesn't match what the site collects — none of it shows up until someone asks, or something goes wrong. We help in three ways:
If your site collects any personal data — a contact form, bookings, accounts, payments — yes. Most sites have at least one gap the owner doesn't know about — cookies set before consent and missing security headers are the most common.
No — it's a technical and practical compliance check, not legal advice. For contracts or anything high-risk (special category data, large-scale processing) we'll flag where you need a solicitor.
A written report: what was checked, what passed, what didn't, and a prioritised fix list. Fixes can be included or quoted separately.
The base audit only needs your live URL. A deeper check (database rules, hosting config) needs read access to the relevant dashboard — never your live credentials shared insecurely.
Standard audit: 3–5 days. Full audit with fixes: 1–2 weeks depending on what's found.
Service 01
Know what your website is exposing, before someone else does.
Most sites get built for speed and never get a second look at what they're exposing. We run a full check against your live site or app — security settings, cookies and consent, exposed keys, database access and your legal pages — and give you a plain-English report of what's wrong, how serious it is, and exactly what to fix.
Any site that collects personal data — a contact form, bookings, accounts or payments. If your site does any of those, it needs checking.
A standard audit takes 3 to 5 days. The base check only needs your live web address.
No — it's a technical and practical compliance check. Where you need a solicitor, we'll say so.
Your web address and what it collects. We reply with a quote.
Get a security check → PricesA full check and written report from £249.
See security check prices → Book a meetingWorried about something specific? Talk it through first — no obligation.
Book a call →£199/site
Running several sites? A discount per site from the second one.
Get a quoteQuoted
Health, disability or children's data needs a deeper check, scoped individually.
Get a quoteFull VIP Service
Full audit, fixes implemented, processor agreement drafted, and a re-check once it's all live — the complete compliance clean-up.
£899starting
Ongoing Support
For sites that keep changing — a scheduled re-audit and priority fixes when something needs attention.
£150per month, starting
Service 02
Don't just find the gaps — close them.
A report is only useful if something changes. With Check & Fix we run the full audit, then implement the fixes ourselves — security headers, database rules, a proper consent banner, updated legal pages — and re-check once it's all live, so you know the gaps have actually closed.
Owners who want it sorted rather than a to-do list — and sites handling bookings, payments or accounts.
A full audit with fixes usually takes 1 to 2 weeks, depending on what's found.
Tell us about your site. We reply with a written quote.
Get a Check & Fix quote → PricesAudit plus fixes from £450, quoted in writing.
See check & fix prices → Book a meetingWant to know what's involved first? Book a free call.
Book a call →Service 03
The paperwork UK GDPR expects, done properly.
If you build or run a website that handles someone else's customer data — as an agency, developer or freelancer — UK GDPR (Article 28) requires a written data-processing contract between you and your client. We draft it for the specific site, so both sides know who is responsible for what.
Web designers, developers, agencies and freelancers who host or manage sites for clients.
It's a practical template-based agreement. For high-risk processing we'll recommend a solicitor reviews it.
Tell us about the site. We reply with a quote.
Get a quote → PricesA processor agreement for one client site, £150.
See paperwork prices → Book a meetingNot sure if you need one? Ask us — no obligation.
Book a call →£150
Written Article 28 contract for a client site you build or run.
Get a quote