NullSquareAlpha

Your security agent, up and running.

Give it your website. Your agent starts with what anyone can see from the outside, then asks your permission before it does more.

Get started

An old computer on a desk in a dark room, lit by a desk lamp and by moonlight through the blinds. Its screen waits. Get started turns it on and opens the first step.

Building with the best

We build on the platforms you already run — your cloud, your code host, and the frontier models underneath the agents.

  • Microsoft
  • Amazon Web Services
  • Google
  • OpenAI
  • Anthropic
  • xAI
  • Moonshot AI
  • DeepSeek
  • GLM
  • GitHub
  • npm
  • Docker
  • Linux
  • Cloudflare
  • Cisco
  • Slack
  • Resend
  • Apollo
  • WordPress
  • Shopify
  • Wix
  • Squarespace
PENTEST

Coming next: continuous pentesting that proves every finding

The pentest agent will test your live services the way a real attacker would, only with your approval. It will prove every vulnerability it reports with a working exploit, then test again after your fix, so a finding closes only when it cannot get in again.

CODE REVIEW

Every pull request reviewed before it merges

The code review agent reviews each pull request you open, at its newest commit. It reads the code around every change, comments on the exact line, says what an attacker could do with it, and blocks the merge until an owner decides. When the fix is small and sure, it writes the commit, and pushes it only with your OK.

READINESS

Your compliance record, kept true every day

The readiness agent keeps your record toward SOC 2 or ISO 27001. It reads the documents you give it and links each one to the controls it really backs. It checks what it can see for itself: your website from outside and sign-in on Google Workspace. It answers customer security questionnaires from what the record shows, and it never claims a certificate you do not have.

WATCH

Know when a new CVE plausibly affects software you run

The watch agent tracks new disclosures and compares them with exact, attributable versions in your inventory. A match is a potential exposure, not a confirmed vulnerability, and it says so.

It does the work. You approve what changes.

This morningExample

Good morning, Sam. I looked at forma.example from outside overnight: one new host, nothing else changed. Ask me anything about it.

Set up your agentYours starts with your own website. Free to start.

Show customers you take security seriously.

Checked by NullSquareSee a verification page

Start free. Choose Pro when you want more.

Free
Try it on your own website$0/mo
  • $5 of agent use when you prove your domain
  • Every feature, from compliance to code review
  • No card needed
Get started
Pro
Your security agent, every month$25$50/moAlpha price: 50% off for as long as you stay subscribed
  • $50 of agent use every month
  • What you do not use carries over
  • Cancel any time
Get started

Every plan includes a full activity log • every turn in a sealed container • evidence mapped to your compliance controls

Do I need to install anything on my servers?
No. Your agent works from outside, and through what you choose to connect, such as GitHub for code review. Nothing runs on your servers.
How is my agent’s work paid for?
Each time your agent works, its cost comes out of your balance. Free gives you $5 once you prove your domain. Pro adds $50 every month, and what you do not use carries over. You can see what is left at any time.
What does my agent work on today?
Four kinds of work:
  • Your website from outside: email records, certificates, public hosts and the software it shows. Nothing is tested.
  • Code review on every pull request, with the code checked out at that commit
  • Compliance readiness for SOC 2, ISO 27001 and others, with your records, evidence and policy drafts
  • A watch for new vulnerabilities in the software you run
  • Coming next: testing a live website, only on a site you have proven is yours, after you approve its exact terms