Team
Your first app, covered properly.
Contact sales
Start scanning- 1 app, iOS or Android
- SAST, DAST, and SCA
- AI fixes on every finding
- Scan on upload
- Email support
Pricing
Priced per app.
Not per panic.
Every plan reads your app with SAST, DAST, and SCA, and every finding comes with a fix. Plans differ in how many apps, and how often.
Growth
iOS and Android, every build, in CI.
Contact sales
Start scanning- 1 iOS app and 1 Android app
- Everything in Team
- Scan every build from CI
- OWASP MASVS mapping and exports
- Issue tracker integration
Enterprise
For when security has a team, or needs one.
Contact sales
Talk to us- Unlimited apps
- Everything in Growth
- SSO, audit logs, and SLAs
- Human in the loop review
- Red Agent pentesting Coming soon
The fine print, made legible.
| Feature | Team | Growth | Enterprise |
|---|---|---|---|
| Apps | 1 | 2 (1 iOS, 1 Android) | Unlimited |
| SAST, DAST, SCA | Included | Included | Included |
| AI Triage | Included | Included | Included |
| Green Agent (AI remediation) | Included | Included | Included |
| When scans run | On upload | Every build | Every build |
| MASVS mapping | Not included | Included | Included |
| SSO and audit logs | Not included | Not included | Included |
| Human in the loop review | Not included | Not included | Included |
| Red Agent (agentic pentesting) | Not included | Not included | Coming soon |
Fair questions.
Does Nandee add anything to my app?
No. Nandee tests your app and helps you fix it. Nothing ships inside your build: no SDK, no runtime agent.
What counts as an app?
One app is one bundle ID (iOS) or package name (Android). The iOS and Android builds of the same product count as two apps. Debug, staging, and release builds of the same bundle ID count as one. React Native and Flutter apps follow the same rule.
Can we try it first?
Yes. Start with a free pilot on one app, including a full SAST, DAST, and OSS scan and a walkthrough of the findings with our team. No credit card required.
Where does our code go?
Your code and builds are processed in isolated, single-tenant scan environments, encrypted in transit (TLS 1.2+) and at rest (AES-256). We never use your code to train models. Source and binaries are deleted within 30 days of a scan, or sooner on request; findings stay in your workspace until you delete them. Healthcare customers can sign a BAA with us.
When does agentic pentesting arrive?
It comes to Enterprise first. Talk to us if you'd like early access.