phew

BACKGROUND

Introduce your business and what you do there.

I’m the co-founder of Reallo Limited, a fintech company that uses open banking to automatically redirect people's everyday underspending into savings and investments.

OPPORTUNITY / CHALLENGE

What challenge were you trying to address with phew?

We hired phew to run an independent penetration test of our platform before launch. We had three specific objectives: identify and validate security vulnerabilities across our web application and API since we handle sensitive financial data and live bank connections through open banking; remediate every finding and have phew verify the fixes through retesting rather than self-attesting; and obtain an independent security assurance report, which is a required step in our accreditation process with our open banking provider.

SOLUTION

What was the scope of their involvement?

phew carried out a full penetration test of our platform against our staging environment, covering both the web application and the API. The work ran end to end: an initial assessment that produced a structured findings report, then remediation support, then retest rounds to independently verify each fix.

What is the team composition?

We worked with 2–5 teammates from phew.

How did you come to work with phew?

We found phew through an online search. We chose them over other options because they had high ratings, their pricing fit our budget, and they offered good value for the cost.

How much have you invested with them?

We spent less than $10,000.

What is the status of this engagement?

We worked together in June 2026.

RESULTS & FEEDBACK

What evidence can you share that demonstrates the impact of the engagement?

phew identified nine findings, and we 100% remediated and independently retested them as fixed, with zero issues left open. The engagement produced a verified clean security posture and the assurance report that unblocked our open banking accreditation. From a scope and quality standpoint, the report covered everything required for the security assurance step. It documented the full assessment, the remediation of all nine findings, and phew's independent verification of the fixes, which was exactly the form of third-party validation our open banking accreditation called for. The report was thorough and clearly structured and gave us confidence it would stand up to external scrutiny.

How did phew perform from a project management standpoint?

phew's project management was excellent. Communication was clear and responsive throughout, and the findings report was well-structured and prioritized by severity, which made remediation easy to plan rather than wade through an unsorted list. They delivered on time and were genuinely flexible when it counted — when we were ready for retesting, they fit us in the very next day after we requested it, which kept our moment going and meant we weren't left waiting to verify fixes. For a small team like ours, that responsiveness and low-overhead organization was exactly what we needed.

What did you find most impressive about them?

phew understood the realities of a small pre-launch fintech — rigorous on security but realistic on budget and timelines, and they never treated us like a minor account. The responsiveness stood out: they fit us in for retesting the next day and verified every fix themselves rather than leaving it to us. That loop-closing rigor was exactly what we wanted from a security partner handling financial data.

Are there any areas they could improve?

On one of the smaller findings, slightly clearer guidance from the start on exactly what the fix needed to satisfy would have let us resolve it correctly in a single pass rather than doing extra work to be sure. It was a minor point on an otherwise very well-run engagement, and their fast responsiveness meant any back-and-forth was sorted quickly.