Skip to content
Gauge

ax-check.com

SecurityPal

securitypalhq.com

ax-check.com

Checked 22 September 2026

B

77/100

Agents need your login

SecurityPal hides pricing entirely, showing only $, $$, $$$ symbols.

No dollar figures, units, or limits appear anywhere; tiers are gated behind a "Contact Us" or demo request.

4 fixes to start with

Concrete changes, backed by what we found.

Onboarding

Give agents a clear login handoff and a way to resume setup.

Agents cannot progress through onboarding without human help. Provide an agent-accessible path through authentication and setup.

Docs

Publish a public pricing page that agents can read without interaction.

Homepage tiers show only '$', '$$', '$$$' symbols, not readable prices.

Docs

Publish prices alongside the sales contact.

No numeric prices anywhere; tiers gated behind 'Contact Us' and demo request.

Docs

State what each price includes and how overages are billed.

Tier cards list features but no pricing units, seats, or usage limits.

Recorded coding sessions

Same task, 3 models, no securitypalhq.com account. Recorded 22 September 2026 on Pi.

3 recorded · 1m 27s

1m 27s · recorded

Session findings

Select a finding to see it in context.

piv0.84.2
modelQwen 3.8 Maxcwd/sandbox/repo
Help me build a simple example using SecurityPal. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop.
Thinking…

I need to check what's available in the repository to understand what SecurityPal is.

$ ls -la /sandbox/repo && cat /sandbox/repo/README* 2>/dev/null | head -50{"content":[{"text":"total 16\ndrwxr-xr-x 3 root root 4096 Sep 18 08:00 .\ndrwxr-xr-x 7 root root 4096 Sep 22 14:39 ..\ndrwxr-xr-x 8 root root 4096 Sep 18 08:00…ctrl+o
{"content":[{"text":"total 16\ndrwxr-xr-x 3 root root 4096 Sep 18 08:00 .\ndrwxr-xr-x 7 root root 4096 Sep 22 14:39 ..\ndrwxr-xr-x 8 root root 4096 Sep 18 08:00 .git\n-rw-r--r-- 1 root root  408 Sep 18 08:00 .gitignore\n","type":"text"}]}
$ find /sandbox/repo -maxdepth 2 -type f | head -50{"content":[{"text":"/sandbox/repo/.gitignore\n/sandbox/repo/.git/COMMIT_EDITMSG\n/sandbox/repo/.git/config\n/sandbox/repo/.git/index\n/sandbox/repo/.git/HEAD\n…ctrl+o
{"content":[{"text":"/sandbox/repo/.gitignore\n/sandbox/repo/.git/COMMIT_EDITMSG\n/sandbox/repo/.git/config\n/sandbox/repo/.git/index\n/sandbox/repo/.git/HEAD\n/sandbox/repo/.git/description\n","type":"text"}]}
Thinking…

I'm checking the git history and the .gitignore file to understand what's been done in this empty repository.

$ cd /sandbox/repo && cat .gitignore && git log --oneline -20 && git show --stat HEAD | head -30{"content":[{"text":"# Keep generated and vendored files out of source diffs.\n\n# Logs / OS cruft\n*.log\n.DS_Store\n\n# JavaScript / TypeScript\nnode_modules/…ctrl+o
{"content":[{"text":"# Keep generated and vendored files out of source diffs.\n\n# Logs / OS cruft\n*.log\n.DS_Store\n\n# JavaScript / TypeScript\nnode_modules/\n.next/\ndist/\nbuild/\ncoverage/\n\n# Python\n.venv/\nvenv/\n__pycache__/\n*.py[cod]\n.pytest_cache/\n*.egg-info/\n\n# Rust\ntarget/\n\n# Go / PHP / Ruby vendored deps\nvendor/\n.bundle/\n\n# Java / Kotlin / Scala\n.gradle/\n\n# .NET\nbin/\nobj/\n\n# Elixir\n_build/\ndeps/\n\n# Dart / Flutter\n.dart_tool/\n9ebf5fb Initial workspace\ncommit 9ebf5fbd2cef623cbb4d140d0c660320192c4977\nAuthor: Workspace Bootstrap <workspace@localhost>\nDate:   Sat Jan 1 00:00:00 2000 +0000\n\n    Initial workspace\n\n .gitignore | 41 +++++++++++++++++++++++++++++++++++++++++\n 1 file changed, 41 insertions(+)\n","type":"text"}]}
Thinking…

The repository is empty — there's no SecurityPal code, SDK, or documentation. "SecurityPal" — is this a known product? It might be a fictional product. Let me check whether there's a package/SDK available (npm/pip), and whether there's network access. I'll do a quick check.

$ npm view securitypal 2>&1 | head -5; pip index versions securitypal 2>&1 | head -5; pip download securitypal --no-deps -d /tmp/sp 2>&1 | head -5{"content":[{"text":"npm error code E404\nnpm error 404 Not Found - GET https://registry.npmjs.org/securitypal - Not found\nnpm error 404\nnpm error 404 'secur…ctrl+o
{"content":[{"text":"npm error code E404\nnpm error 404 Not Found - GET https://registry.npmjs.org/securitypal - Not found\nnpm error 404\nnpm error 404  'securitypal@*' is not in this registry.\nnpm error 404\nERROR: No matching distribution found for securitypal\nERROR: Could not find a version that satisfies the requirement securitypal (from versions: none)\nERROR: No matching distribution found for securitypal\n","type":"text"}]}
$ curl -sI --max-time 8 https://securitypal.com 2>&1 | head -5; echo "---"; curl -s --max-time 8 https://pypi.org/pypi/securitypal/json 2>&1 | head -c 300; echo; curl -s --max-time 8 https://registry.np…{"content":[{"text":"HTTP/2 301 \r\ndate: Tue, 22 Sep 2026 14:39:56 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://www.securitypalhq.com/\r\…ctrl+o
curl -sI --max-time 8 https://securitypal.com 2>&1 | head -5; echo "---"; curl -s --max-time 8 https://pypi.org/pypi/securitypal/json 2>&1 | head -c 300; echo; curl -s --max-time 8 https://registry.npmjs.org/securitypal 2>&1 | head -c 300

{"content":[{"text":"HTTP/2 301 \r\ndate: Tue, 22 Sep 2026 14:39:56 GMT\r\ncontent-type: text/html; charset=UTF-8\r\nlocation: https://www.securitypalhq.com/\r\nreport-to: {\"group\":\"cf-nel\",\"max_age\":604800,\"endpoints\":[{\"url\":\"https://a.nel.cloudflare.com/report/v4?s=1Rm%2F1eqn4qzjkh6csnbq7Vih4qiTC7SKDjANCYnPaTRflPtXeOYRAg1RCzIAidoqepSEuMRPnPJqkyjRCtCyCnT7WtK%2B%2Bl0mcOKUS6Vtn8jE5UrwaJi2ELNxWMNCNaSNCNU%3D\"}]}\r\n---\n{\"message\": \"Not Found\"}\n{\"error\":\"Not found\"}","type":"text"}]}
Thinking…

securitypal.com redirects to securitypalhq.com. Let's check what that is — does it have developer-facing docs / SDK / API / pricing info?

$ curl -sL --max-time 10 https://www.securitypalhq.com/ -o /tmp/sp.html; wc -c /tmp/sp.html; python3 -c "{"content":[{"text":"247489 /tmp/sp.html\n Cybersecurity Assurance Management: AI + Certified Experts | SecurityPal AI Customers Platform Platform Assurance Man…ctrl+o
curl -sL --max-time 10 https://www.securitypalhq.com/ -o /tmp/sp.html; wc -c /tmp/sp.html; python3 -c "
import re,html
t=open('/tmp/sp.html',errors='ignore').read()
t=re.sub(r'<script.*?</script>','',t,flags=re.S)
t=re.sub(r'<style.*?</style>','',t,flags=re.S)
t=re.sub(r'<[^>]+>',' ',t)
t=html.unescape(re.sub(r'\s+',' ',t))
print(t[:2000])"

{"content":[{"text":"247489 /tmp/sp.html\n Cybersecurity Assurance Management: AI + Certified Experts | SecurityPal AI Customers Platform Platform Assurance Management Platform Concierge Agents Questionnaire Concierge Trust Center Knowledge Library Vendor Assess (TPRM) vCISO Solutions Industries Healthcare & Life Sciences Financial Services & Insurance Information Technology & SaaS Industrial & Manufacturing Research Resources Resources Case Studies Reports Blog How Iterable Scaled Customer Trust and Accelerated Sales with SecurityPal AI Tavus Accelerates Enterprise Deal Velocity with SecurityPal’s Assurance Management Platform 2026 Security Assurance Insights: What the Data Actually Shows 20 Insights After Answering 2 Million Security Questions How to Automate Security Questionnaires With LLMs (And Where DIY Automation Breaks Down) Security Questionnaire Volume Is Surging — Here's What the Data Shows Company Company About SACC Vision Press Careers Log In Get a Demo Log In Get a Demo Hyper-Supervised Intelligence for Cybersecurity Assurance Harness AI With Concierge Experts Same-Day or Faster Turnaround On Security Questionnaires Vendor Assessments InfoSec Assessments Trust Center Management Audit Readiness InfoSec Redlines GRC Tasks DDQs RFPs Assurance Requests Evidence Requests Security Questionnaires Not a tool you manage. An end-to-end system with expertise that owns the job from intake ㅤ to done ㅤ Get a Demo Case Studies Customer Assurance GRC Busywork Security Redlines Requests for Proposals Security Questionnaires Audit Responses Vendor Assessments Trusted by Fortune 500s, Global 2000s and Category-Defining Companies SecurityPal is easily one of the best investments we have made. Their turnaround time, due diligence and customer service is second to none. They have quickly demonstrated comprehension of our security program and help us explain it to our customers. This has allowed our security team to focus on high-leverage investments in security and our sales team to win more customers faster. Dev A\n","type":"text"}]}
Thinking…

SecurityPal is a cybersecurity assurance management company — a human-driven, concierge-style service ("Not a tool you manage. An end-to-end system with expertise that owns the job"). No SDK, no public API, no developer workflow. Pricing is likely not disclosed either — "Get a Demo". Let's quickly check whether there's a pricing page.

$ grep -oiE 'href="[^"]*(pricing|developer|api|docs)[^"]*"' /tmp/sp.html | sort -u | head; curl -s -o /dev/null -w "%{http_code}\n" --max-time 8 https://www.securitypalhq.com/pricing{"content":[{"text":"301\n","type":"text"}]}
Thinking…

There are no links to pricing, developers, API, or documentation. /pricing redirects (301 — probably to the homepage or a demo page). Conclusion: SecurityPal has no developer-facing workflow. Per the instructions: I'll communicate that clearly and stop.

Stopping here — SecurityPal has no developer workflow I can act on.

What I found:

  • What it is: SecurityPal (securitypal.com → securitypalhq.com) is a cybersecurity assurance management service — AI plus certified human concierge experts who handle security questionnaires, vendor assessments, DDQs, trust centers, and audit readiness on your behalf.
  • No SDK or API: There is no securitypal package on npm or PyPI (404 on both), and their site has no developer docs, API reference, or docs links at all. Their own positioning is explicit: "Not a tool you manage. An end-to-end system with expertise that owns the job from intake to done." It's a managed human service, not a developer product.
  • Pricing: Not publicly disclosed. There's no pricing page (it just redirects); the site is entirely "Get a Demo" / sales-contact driven. Pricing is almost certainly custom-quoted per engagement (volume of questionnaires, scope of services). I can't give you real numbers, and I won't invent any.
  • Ease of management for me: Not applicable — there's nothing programmatic to manage. Engaging with it would mean a human sales/demo process, contracts, and uploading security documentation through their customer portal, none of which is a workflow I can execute.

Blocked on: building "a simple example using SecurityPal" — there is no SDK, API key flow, or quickstart to build against. Per your instruction, I'm stopping rather than scaffolding something fictional.

If you actually meant a different product (e.g., a security-scanning tool with an API), tell me the right name/URL and I'll take another pass.

AX Fundamentals

23 checks. Open an area for details.

This check is a quick preview. Test more tasks and models with Gauge Agents.

Test your product with Gauge Agents

AX Check by Gauge