One project. One price. No subscription.

Different beast. Snyk and Aikido sell an internal dashboard to in-house teams: per-developer subscription, report stays on your side. Hykaro produces a white-label PDF you hand to your client with your invoice. It's a vendor tool, not an internal-team tool.

Essential tier and up: your logo, signature, color. No Hykaro mention visible to the client. The €19 demo is intentionally Hykaro-branded (qualifying gate).

Scaleway Paris hosting (Postgres + R2-compatible). No data leaves the EU, no US sub-processor in the scan pipeline. DPA available on request.

Unlimited. Webhook, CI/CD, manual: scan as much as you want during your tier window (7 / 30 / 90 days). Server-side anti-abuse: same commit SHA triggered twice returns cached result (0 compute, 0 latency). 30-min cooldown between manual scans of the same target. Hard cap 60 scans/h per organization, you'll never hit it in normal use.

Not in MVP. One-shot tiers are designed for delivery moments (pre-deployment audit, pre-handoff audit), not for continuous pipeline gating. Investing 2h integrating a tool that becomes inactive after your window isn't worth it. For that use case, the Studio monthly tier arrives in phase 3 (RFC-014). In MVP, you use the GitHub webhook for auto-scan on push during your window, useful for sprint iteration, not for continuous deploy gating.

Yes. Included free in all paid tiers (Essential, Standard, Premium). Not in the €19 demo. Toggle the 'accessibility' profile when you scan, and Hykaro generates a quantified RGAA score + WCAG 2.1 AA + EAA checklist + prioritized correction plan, in the same PDF section as security. Particularly useful for FR agencies delivering to clients subject to EAA (effective June 28, 2025).

Yes but opt-in, not default. The 'quality' profile (phpcs, eslint, tsc, depcheck, knip…) is very noisy and would drown out real security findings if enabled by default. You toggle it intentionally when you want a code-quality audit beyond security. All tiers. These findings are capped at 'low' severity so they don't pollute critical/high KPIs.

Several. A project holds multiple targets: a Git repo + a frontend URL + a separate backend repo, for example. Essential tier = up to 3 targets, Standard = 5, Premium = 10. A webhook hitting any target triggers a project-wide scan.

The project goes read-only: you can re-download the PDF (per the tier retention) but no more scans. To extend, buy a tier again. No hidden subscription.

Full refund if the scan fails technically or the report is empty. No "changed my mind" refund once the PDF is downloaded: the deliverable is irreversible. Consistent with a client deliverable.

Next.js, React, Node, TypeScript, PHP, Symfony, Laravel, Python, Go. Auto-detection at clone. If your stack isn't listed, I'll tell you on the demo whether Hykaro is a fit, no surprises.

The Hykaro CLI is open-core, so yes. The SaaS is the managed option (orchestration, PDF, AI triage). On-prem is available on the Enterprise tier (phase 3). Reach out.

AI triage by Claude only receives consolidated findings (CWE, file:line, 5-line max snippet). No secrets, no full code, no client data. And you can disable AI triage with no extra cost.