# AX Check: securitypalhq.com Checked 2026-09-22. SecurityPal hides pricing entirely, showing only $, $$, $$$ symbols. No dollar figures, units, or limits appear anywhere; tiers are gated behind a "Contact Us" or demo request. ## Onboarding needs a login ## Coding sessions All three independent sessions (DeepSeek V4 Pro, Kimi K3, Qwen 3.8 Max) completed their task but could not find any public pricing. Kimi K3 and Qwen 3.8 Max both explicitly stated no dollar figure exists and declined to invent one, only speculating that costs are likely based on annual contracts scaled by seats or volume. ### DeepSeek V4 Pro [View public run](https://agents.withgauge.com/p/runs/2e1a9dfb-f35e-412b-a509-0b2d845175e5) · [Read transcript](https://www.ax-check.com/securitypalhq.com/sessions/deepseek.json) #### End-to-end onboarding - **Onboarding needs a login**: The agent found SecurityPal's real hosted API and read the actual public API reference from GitHub, but never obtained a token. It only probed the hosted endpoint with no token (401 Unauthorized) and with a fabricated placeholder token (401 invalid key), which is the opposite of a successful authenticated call. No self-serve signup exists; a token requires a human to log into the app UI and generate it manually. Event 153: ```text error: HTTP 401 from GET https://app.securitypalhq.com/api/v1/auth/me {"detail":"{'detail': ErrorDetail(string='API Key is invalid', code='authentication_failed'), 'code': ErrorDetail(string='authentication_failed', code='authentication_failed')}"} exit=1 ``` Event 136: ```text HTTP 401 {"detail":"Unauthorized"} ``` Event 115: ```text Base URL: `https://app.securitypalhq.com/api` - Auth header: `Authorization: Bearer $SECURITYPAL_API_TOKEN` ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No self-serve token creation for the public API**: The API reference and quickstart require a personal access token generated manually in the account settings UI (app.securitypalhq.com/settings#api). There is no signup or token-issuance endpoint the agent could call programmatically, so it could not obtain real credentials and could not run any authenticated call end-to-end. This is a product/process constraint (sales/account-gated access), not an agent error. Event 114: ```text Create a SecurityPal personal access token for the customer account you want to query at , then export it before using the helper commands ``` Event 155: ```text I cannot run it end-to-end because there's no public self-serve API signup and I can't create a SECURITYPAL_API_TOKEN on your behalf — it requires logging into app.securitypalhq.com/settings#api ``` - **No public pricing information**: The /pricing path redirects to a generic platform marketing page with no dollar figures or tiers; every paid conversion path is a 'Get a Demo' / contact-sales CTA. This is product/marketing-site behavior, confirmed by the agent scanning both the pricing page text and the sitemap for pricing-related URLs and finding none. Event 60: ```text Get started now Read case studies Cybersecurity Assurance Management Platform (CAMP) ``` Event 123: ```text https://www.securitypalhq.com/blog/hidden-costs-of-manual-security-reviews ``` #### Suggested Changes - **Add a visible link from the pricing page to sales contact or self-serve signup**: On www.securitypalhq.com/pricing (which currently just redirects to /platform with no pricing detail), add either indicative pricing or a clear single CTA to request pricing/demo. Verify by curling /pricing and confirming it returns pricing content or an unambiguous next-step link instead of generic platform marketing copy. Event 60: ```text Assurance Management Platform Comprehensive Solutions for Modern Security, GRC, and GTM Teams AMPlify customer assurance with SecurityPal's Cybersecurity Assurance Management Platform (CAMP) ``` - **Link the API reference from a discoverable developer/docs page**: The only path to the API reference (references/api-reference.md in the securitypalai-claude-marketplace GitHub repo) is via a blog post about the Claude Code plugin. Add a /developers or /docs route on securitypalhq.com (both currently 404) that links directly to the GitHub API reference so developers do not need to discover it through an unrelated blog post. Verify by requesting securitypalhq.com/developers and confirming it resolves and links to the API reference. Event 26: ```text === /developers === 404 https://www.securitypalhq.com/developers === /platform === 200 https://www.securitypalhq.com/platform === /docs === 404 https://www.securitypalhq.com/docs ``` Event 73: ```text href="https://github.com/SecurityPal/securitypalai-claude-marketplace" ``` ### Kimi K3 [View public run](https://agents.withgauge.com/p/runs/27c02a30-41bf-48b6-98b3-4da3bfcdab86) · [Read transcript](https://www.ax-check.com/securitypalhq.com/sessions/kimi.json) Agent states 'There is no public pricing' and only speculates the model is 'likely annual contracts scaled by questionnaire volume/seats/modules' — no dollar figure or cost estimate is ever given, so there's no price tied to assumptions, just an absence-of-pricing statement. #### End-to-end onboarding - **Onboarding needs a login**: The agent could not find any self-service way to obtain API credentials for SecurityPal. Signup is demo-gated and no public API/SDK documentation exists, so no credential-obtaining or authenticated operation ever occurred. Event 22: ```text https://www.securitypalhq.com/api -> 404 https://docs.securitypalhq.com -> 000 https://api.securitypalhq.com/v1 -> 200 https://www.securitypalhq.com/developers -> 404 ``` Event 30: ```text Signup is demo-gated ("Get a Demo"), so there's no self-serve account I could even obtain credentials from. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No public SDK, package, or API documentation for SecurityPal**: The agent checked npm, PyPI, and several plausible documentation subdomains/paths (/api, /developers, docs.securitypalhq.com) and found no package or developer docs. This is a product characteristic (no self-serve developer surface), not a test-environment or agent error. Event 10: ```text npm error 404 Not Found - GET https://registry.npmjs.org/securitypal - Not found ``` Event 22: ```text https://www.securitypalhq.com/api -> 404 https://docs.securitypalhq.com -> 000 https://api.securitypalhq.com/v1 -> 200 https://www.securitypalhq.com/developers -> 404 ``` - **Signup gated behind sales demo, blocking credential acquisition**: The website only offers a 'Get a Demo' path rather than self-serve signup, so the agent had no way to generate API credentials on its own to test any product operations. Event 30: ```text Signup is demo-gated ("Get a Demo"), so there's no self-serve account I could even obtain credentials from. ``` - **No public pricing information available**: The pricing page contains no tiers or dollar figures; pricing is only available by contacting sales, which the agent could not do within the session. Event 30: ```text There is no public pricing. The site has no pricing tiers or dollar figures — it's enterprise, contact-sales/demo-based pricing, typical for this category ``` #### Suggested Changes - **Publish self-serve API documentation and signup**: The site currently returns 404 for /developers and /api and docs.securitypalhq.com does not resolve. Add a public developer portal with API reference and a self-serve signup or sandbox key so external tools/agents can integrate without going through a sales demo. Verify by confirming docs.securitypalhq.com or www.securitypalhq.com/developers returns a real page with API credentials instructions. Event 22: ```text https://www.securitypalhq.com/api -> 404 https://docs.securitypalhq.com -> 000 https://api.securitypalhq.com/v1 -> 200 https://www.securitypalhq.com/developers -> 404 ``` - **Publish pricing tiers on the pricing page**: The /pricing page (101KB of HTML) contains no dollar figures or tiers, only marketing copy. Add at least indicative pricing or a tier breakdown so prospective users can evaluate cost without requesting a demo. Verify by checking that the pricing page text includes concrete price points or tier names. Event 30: ```text There is no public pricing. The site has no pricing tiers or dollar figures — it's enterprise, contact-sales/demo-based pricing, typical for this category ``` ### Qwen 3.8 Max [View public run](https://agents.withgauge.com/p/runs/17a637a3-e9f1-4bb8-8019-ead82d33bad3) · [Read transcript](https://www.ax-check.com/securitypalhq.com/sessions/qwen.json) Final output explicitly refuses to give a number ('Pricing: Not publicly disclosed... I can't give you real numbers, and I won't invent any'), so no cost figure with stated assumptions is provided. #### End-to-end onboarding - **End-to-end onboarding not demonstrated**: The agent never attempted credential acquisition or an authenticated product operation. It only probed for a public SDK/API package (npm, PyPI) and fetched the marketing site, found no developer docs, pricing page, or API reference, and stopped per the seed prompt's instruction to halt if no developer workflow exists. Event 13: ```text npm view securitypal 2>&1 | head -5; pip index versions securitypal 2>&1 | head -5; pip download securitypal --no-deps -d /tmp/sp 2>&1 | head -5 ``` Event 31: ```text There is no `securitypal` package on npm or PyPI (404 on both), and their site has no developer docs, API reference, or docs links at all. ``` #### Hallucinated URLs None identified in this transcript. #### Blockers - **No SDK, API, or developer docs found for SecurityPal**: Product behavior, not agent error or missing credentials: the agent checked the two standard package registries and the vendor's marketing site and found no installable package, no API reference, and no docs links. The vendor site frames the product explicitly as a managed human-plus-AI service rather than a self-serve developer tool, so there was nothing to build an SDK/API example against. Event 19: ```text npm error 404 npm error 404 'securitypal@*' is not in this registry. npm error 404 ERROR: No matching distribution found for securitypal ``` Event 24: ```text Not a tool you manage. An end-to-end system with expertise that owns the job from intake ㅤ to done ``` - **No public pricing page**: Product behavior: the /pricing path on the vendor site returns a redirect rather than a page with pricing details, and the rest of the site is demo-request driven, so the agent could not report concrete pricing figures. Event 29: ```text 301 ``` Event 31: ```text Pricing: Not publicly disclosed. There's no pricing page (it just redirects); the site is entirely "Get a Demo" / sales-contact driven. ``` #### Suggested Changes - **Publish a developer API or SDK reference if one exists**: If SecurityPal offers any programmatic integration (API keys, webhooks, SDKs), link it from the main site navigation or footer. Verify by re-running a package registry lookup (npm/PyPI) or checking for a /docs or /api path that returns real content instead of a 404 or redirect. Event 19: ```text npm error 404 npm error 404 'securitypal@*' is not in this registry. ``` Event 24: ```text Platform Assurance Management Platform Concierge Agents Questionnaire Concierge Trust Center Knowledge Library Vendor Assess (TPRM) vCISO Solutions ``` - **Add a pricing page with at least indicative tiers or ranges**: Replace the redirecting /pricing path with a page showing plan structure or a range, even if final cost is quote-based. Check by fetching https://www.securitypalhq.com/pricing directly and confirming it returns page content instead of a 301 redirect away from pricing detail. Event 29: ```text 301 ``` ### Task given to each agent Help me build a simple example using SecurityPal. Tell me how pricing works, and briefly tell me whether this product will be easy for you to manage. Let me know if you get blocked. If this product has no developer workflow you can act on, say so plainly and stop. Stay light: use the hosted product through its SDK or API. Do not start local service stacks or wait for long-running commands; if the quickstart requires either, say so plainly and stop. No product credentials were supplied and no purchases were authorized. ## Score: B · 77/100 (provisional) Grades come from completed site checks. Coding sessions and skipped checks do not affect the score. ### Clarity - **Skipped** — Homepage answers Markdown requests ```text This check could not be assessed within the scan. ``` - **Skipped** — llms.txt provides an actionable documentation index ```text This check could not be assessed within the scan. ``` - **Skipped** — llms.txt provides navigation guidance ```text This check could not be assessed within the scan. ``` - **Skipped** — llms.txt mentions offered API, MCP, and skills ```text This check could not be assessed within the scan. ``` - **Pass** — A compact guide representation exists ```text llms.txt is a compact Markdown guide covering platform, products, resources and contact. ``` - **Pass** — A focused guide is directly retrievable ```text llms.txt fetched directly at /llms.txt as text/plain Markdown, 2189 tokens. ``` - **Pass** — Equivalent instructions fit a token budget ```text llms.txt is 2189 tokens, well under 8000 and far below the 20691-token HTML homepage. ``` - **Skipped** — Product-docs links survive format changes ```text Homepage Markdown unsupported, so link preservation across formats cannot be measured. ``` - **Pass** — The compact guide is independently actionable ```text llms.txt is a compact, organized guide covering platform, products, resources and contact. ``` - **Pass** — Install and next-step links resolve ```text Get-started page fetched successfully; llms.txt Get Started link resolves to it. ``` ### Onboarding - **Skipped** — Docs lead to a relevant quickstart ```text This check could not be assessed within the scan. ``` - **Skipped** — Installation commands are extractable ```text This check could not be assessed within the scan. ``` - **Skipped** — Code examples are available without interaction ```text This check could not be assessed within the scan. ``` - **Skipped** — Prerequisites and auth boundaries are explicit ```text This check could not be assessed within the scan. ``` ### Pricing - **Failed** — Pricing is readable without interaction ```text Homepage tiers show only '$', '$$', '$$$' symbols, not readable prices. ``` - **Failed** — Prices are stated, not gated ```text No numeric prices anywhere; tiers gated behind 'Contact Us' and demo request. ``` - **Failed** — Pricing units and limits are explicit ```text Tier cards list features but no pricing units, seats, or usage limits. ``` - **Failed** — Agents identify pricing and its assumptions ```text 2 of 3 sessions were judged on pricing; 2 fell short. Kimi K3: Agent states 'There is no public pricing' and only speculates the model is 'likely annual contracts scaled by questionnaire volume/seats/modules' — no dollar figure or cost estimate is ever given, so there's no price tied to assumptions, just an absence-of-pricing statement. Qwen 3.8 Max: Final output explicitly refuses to give a number ('Pricing: Not publicly disclosed... I can't give you real numbers, and I won't invent any'), so no cost figure with stated assumptions is provided. This behavioural item does not affect the fast grade. ``` ### Activation - **Skipped** — An API reference or OpenAPI spec is reachable ```text No API reference or OpenAPI spec appears in the fetched SecurityPal pages. ``` - **Skipped** — An MCP server is documented and well-formed ```text No MCP server is documented in the fetched SecurityPal pages. ``` - **Skipped** — A CLI install path is documented ```text No CLI install path is documented; SecurityPal is a managed SaaS platform. ``` - **Skipped** — SDK packages resolve on their registries ```text No SDK or developer package registry result was supplied for SecurityPal. ``` - **Skipped** — Agent skills are published ```text No agent skills are published in the fetched SecurityPal pages. ``` [Full report data](https://www.ax-check.com/securitypalhq.com/report.json)