14 services · GEO + security
Starting prices shown up front, excluding VAT. Each service has its own page: what you get, how we work, how long it takes.
AI MYSTERY SHOPPER
20 real questions, asked 3 times on 4 AI assistants: 240 answers in 48 hours, showing who gets your customers instead of you.
AI TRAFFIC
Visits, orders and forms coming from ChatGPT, Perplexity, Gemini and other AI assistants, separated from the rest of your traffic.
GEO SCAN
Full AI visibility audit: GEO score, 15+ prompts across 4 platforms, report with prioritized steps.
AI BLUEPRINT
12-month GEO strategy with roadmap, measurable goals and monthly actions.
SCHEMA FORGE
Technical implementation: JSON-LD, llms.txt, robots.txt and an /ai page — ready-to-paste code.
AI MIRROR
AI reputation report: 100+ prompts, what each platform says about the brand, sentiment analysis.
NIȘA X-RAY
X-ray of your niche in AI: 10-20 competitors, GEO ranking by vertical, positioning opportunities.
NATIVE BUILD
A new site, built right from day one with GEO foundations, technical SEO and security — not retrofitted.
PRODUCT FEED
Your product list in the format required by Google Merchant Center and AI shopping assistants, error-free and checked monthly.
ENTITY
Your company's Wikidata entry, with sources, and the same data in registries, directories and on your site, so AI recognises you.
LOCAL
Your Google Business Profile fully set up, with verification prepared and the same data as your site.
ACCESS CHECK
Your site checked against WCAG 2.1 AA (keyboard, screen reader, contrast, forms), with every issue and its fix.
RE-BUILD
Your existing site through every scan, with a rebuild plan: each problem and its fix, ordered by impact. Implementation available as an add-on.
NIS2 SCAN
Assessment of the exposed perimeter, framed against the NIS2 measures: technical evidence, not a compliance certificate. Starts after written authorisation of the targets.
Prices, excluding VAT, are on each service page. The first consultation is free and includes a mini-scan: 5 questions on 2 AI assistants.
First consultation is free. We'll show you your brand's GEO score and explain exactly what needs to be done.
Talk to a GEO expertSecurity · NIS2
We assess an organisation's internet-facing technical perimeter and frame every finding against the NIS2 security measure it touches. The service produces verifiable technical evidence, not a compliance certificate.
Directive (EU) 2022/2555 · Regulation (EU) 2024/2690 · OUG 155/2024 with Law 124/2025 · Law 123/2026
What it is and what it is NOT
It does not certify NIS2 compliance. No external scan can.
Of the ten measures in Art. 21(2), none is fully verifiable from outside. The checks touch eight of them — all except risk analysis and incident handling — but touching a measure is not covering it: from outside you see one end of each. What the tool does is produce technical evidence that either contradicts or supports declared compliance.
The asymmetry that makes it useful: a FAIL is solid evidence of a gap, and a check that could not observe the target — a WAF refusing requests, a DNS that will not answer — returns ERROR, never FAIL; a PASS only proves an endpoint was configured correctly at scan time, and the report states next to every PASS exactly what it does not prove. That is why the external assessment comes with an organisational questionnaire covering the measures invisible from outside — risk analysis, incident handling, continuity, supply chain, training, access control, MFA, encryption at rest. Without it, a clean report would imply compliance.
Three complementary layers
01
How is the defender configured, seen from outside? Which exposed versions have actively exploited vulnerabilities?
Twenty passive checks across DNS, email, transport, HTTP and exposed surface, each tied to the Art. 21(2) measure it touches. Banner versions are correlated with CVE (NVD), proven exploitation (CISA KEV) and exploitation probability (EPSS).
02
What changed since the last run? Which subdomains exist in Certificate Transparency that nobody remembers?
One scan is a photograph; the second one tells you what changed. Every run produces the delta against the previous one: regressions, improvements, a new certificate, a header that vanished. Separately, Certificate Transparency lists every name ever issued a certificate and flags the recent ones.
03
Who is knocking at the organisation's door, how often, with what? Has anyone enumerated its zone?
Not a global observatory, but a small, targeted honeypot with an IP near the organisation: a handful of chosen ports, a static banner, a log of who, when, on which port. Plus a canary hostname planted in the DNS zone with no legitimate user — any connection to it means someone enumerated the zone.
How the report reads
Technical evidence
Observed directly, reproducible, with the raw response kept.
Weak signal
Can produce false positives or false negatives. Reported as such, never as a verdict.
Self-declared
From the organisational questionnaire, not technically verified.
A check that cannot run returns ERROR, never PASS: an unreachable host is not a safe host.
Coverage · 19 checks
| Layer | Checks | Art. 21(2) |
|---|---|---|
| DNS | DNSSEC, CAA, zone transfer | (e), (h), (i) |
| SPF, DMARC, MTA-STS | (h), (j) | |
| Transport | negotiated protocol and cipher, deprecated TLS, certificate, HSTS | (h), (c), (i) |
| HTTP | security headers, cookies, security.txt, version disclosure, mixed content | (e), (g), (i), (d) |
| Exposure | sensitive files, open ports (written authorisation only) | (e), (i) |
| Vulnerabilities | version → CVE (NVD) → active exploitation (KEV) → probability (EPSS) | (e) |
| Surface | subdomains from Certificate Transparency, which resolve, recently issued | (i), (f) |
Authorisation · rule of engagement
Actively scanning a domain you do not own, without written authorisation, may fall under Art. 360 of the Romanian Criminal Code. That is why this site has no button that scans a domain on demand. Three declared tiers: passive checks read what is public — DNS, certificates, headers; the exposed-files check sends a handful of HTTP requests to fixed paths, so we list it explicitly in the contract; and port scanning, the only active one, starts only with written authorisation, per target.
Findings about a real domain are an attack map, and the attacker IPs seen by the sensor are personal data. Reports are not published, not versioned in shared repositories, and are kept under limited retention. Credentials attempted by attackers are redacted from the log before it is written — the authorisation header, cookies and password fields — and a hash is kept in the password's place: enough to count how many distinct passwords were tried against the same user, not enough to recover any of them.
Who it is for
Essential and important entities under OUG 155/2024, their suppliers, and any organisation that has to show an auditor, a client or its own board what is visible from outside. The assessment starts after a scoping conversation and written authorisation of the targets.