Question 1

What is AppAudix?

Accepted Answer

AppAudix is an automated security scanning service that analyzes mobile applications (iOS and Android) for PCI-DSS compliance. We scan your app binary to identify security vulnerabilities and compliance gaps, providing detailed reports with remediation guidance.

Question 2

Do I need to provide source code?

Accepted Answer

No. AppAudix performs binary analysis on compiled app files (APK, AAB for Android, IPA for iOS). You simply upload your app file, and our scanner analyzes it without requiring access to your source code.

Question 3

How long does a scan take?

Accepted Answer

Most scans complete within 10 minutes. Complex applications with large codebases may take up to 15-20 minutes. You'll receive an email notification when your report is ready.

Question 4

Is my app data secure during scanning?

Accepted Answer

Absolutely. All app binaries are processed in isolated, air-gapped environments. Files are encrypted in transit and at rest, processed entirely in memory, and automatically purged after analysis. We never store your app binary.

Question 5

What version of PCI-DSS do you scan against?

Accepted Answer

We scan against PCI-DSS v4.0.1, the latest version of the standard released in 2024. Our scanner covers all 847 checkpoints relevant to mobile applications.

Question 6

Does a passing scan mean I'm PCI compliant?

Accepted Answer

A passing scan indicates your mobile app meets PCI-DSS technical requirements. However, full PCI compliance also requires organizational policies, procedures, and infrastructure controls that are outside the scope of app scanning. Our reports are designed to support your overall compliance documentation.

Question 7

Can I use your reports for PCI audits?

Accepted Answer

Yes. Our reports are designed to be auditor-ready and include detailed evidence for each finding. Many QSAs (Qualified Security Assessors) accept our reports as part of their assessment process.

Question 8

What happens if my app fails the scan?

Accepted Answer

You'll receive a detailed report identifying each failed requirement with specific code locations, severity ratings, and step-by-step remediation guidance. After fixing the issues, you can rescan to verify the fixes.

Question 9

What file formats do you accept?

Accepted Answer

We accept APK and AAB files for Android applications, and IPA files for iOS applications. Files can be uploaded via our web interface or through our REST API for CI/CD integration.

Question 10

What types of vulnerabilities do you detect?

Accepted Answer

We detect a wide range of issues including insecure data storage, weak cryptography, missing certificate pinning, hardcoded credentials, improper authentication, insecure network configurations, debug code in production, and many more PCI-relevant vulnerabilities.

Question 11

Do you support React Native, Flutter, or hybrid apps?

Accepted Answer

Yes. We scan the compiled binary, so we support apps built with any framework including React Native, Flutter, Xamarin, Cordova, and native development. Our scanner analyzes both native code and JavaScript/Dart bundles.

Question 12

Can I integrate scanning into my CI/CD pipeline?

Accepted Answer

Yes. We provide a REST API and CLI tools that integrate with popular CI/CD platforms including GitHub Actions, GitLab CI, Jenkins, CircleCI, and Bitrise. See our API documentation for details.

Question 13

Is there a free tier?

Accepted Answer

Yes. Free includes 3 scans per month, 1 framework per scan, and 14-day scan history. No credit card required.

Question 14

What's included in the paid plans?

Accepted Answer

Pro ($149/mo) adds 20 scans per month, all frameworks (max 2 per scan), enhanced static checks, AI remediation, and PDF/HTML/SARIF reports. Team ($599/mo) adds 100 scans, 2 AI Penetration Tests per month, DAST, read-only API access, and 1-year history. Enterprise (from $2,000/mo) is unlimited scans + unlimited pentest + AI build artifact detection + SSO + full API + dedicated support.

Question 15

Do you offer annual billing?

Accepted Answer

Yes. Pro and Team can be billed monthly or annually (two months included with annual). Enterprise uses annual contracts via Stripe, invoice, or AWS Marketplace.

Question 16

Can I cancel anytime?

Accepted Answer

Yes. All plans are month-to-month with no long-term commitment. You can cancel or change your plan at any time from your account settings.

Frequently Asked Questions

General

PCI-DSS Compliance

Technical

Pricing & Plans

Still Have Questions?

Cookie preferences