Viverna checks your website, email and servers the way an attacker would, explains what it found in plain English, and hands you the fix already in motion: a pull request, a DNS record ready to paste, or a takedown already filed.
For small businesses and early-stage SaaS teams across Canada. Based in Toronto, Ontario.
No DMARC policy on yourfirm.ca
Anyone can send email that looks like it came from your domain, including invoices with their bank details on them.
; add one TXT record to yourfirm.ca + _dmarc TXT "v=DMARC1; p=none; + rua=mailto:dmarc@yourfirm.ca"
Not sure you have a problem?Send your domain. You'll get one real finding from your own site by email, free, with no access needed and no obligation. Verify it yourself before deciding anything.
Request my free findingDifferent businesses get hit in different places. Here's where the gaps usually are, and the service that closes them first.
Wire-fraud and impersonation usually start in the inbox. If your domain has no email authentication, anyone can send a convincing "change of payment details" email as you.
Under PHIPA you're accountable for patient information. Online booking tools, forgotten staging logins and outdated plugins are where it leaks.
An enterprise buyer's security questionnaire can stall a deal for weeks. A leaked API key or open staging environment is far cheaper to fix now than mid-deal.
On WooCommerce, Magento and custom builds, an outdated plugin is a common way card-skimming code ends up in your checkout without you noticing.
Tenant records, deposit payments and look-alike domains make you a target for payment redirection scams aimed at your clients.
Fixed scope, fixed price range, agreed before any work starts. Final price depends on the size of your setup. All prices in CAD.
A quick outside look at what anyone on the internet can see about your site. The easiest way to find out whether you have a problem.
Stops people from sending email that looks like it came from you. Most businesses have never set this up, and it's usually the fastest visible win.
Price depends on how many sending services need mapping. Included free on every Full Audit or Bundle.
Finds fake copies of your site set up to steal your customers' logins or payments, then files to get every one taken down.
Scales with the number of confirmed clones. Formal domain disputes (UDRP) against repeat offenders need a lawyer; those are flagged for you, not filed.
A hands-on review of your web application, the way an attacker would approach it.
Locks down the servers your app runs on and shows you the measured improvement.
Bundle discount for 3 or more servers.
The Full Web App Audit and Server Hardening together, for teams that want the whole stack reviewed at once.
A free finding or a Security Snapshot. It only looks at what anyone on the internet can already see, so no access or passwords are needed.
A short call in plain English: what each finding means for your business, and which ones actually matter this month.
Deeper testing only happens under a written scope agreement. Fixes arrive as pull requests your developer can review, DNS records ready to paste, or takedown reports already filed.
Look-alike sites come back under new domains and new email senders appear. A retainer keeps someone watching after the report is done.
Available after your first audit, once there's a known baseline to watch. Prices per month, in CAD.
$250–400/month
Someone keeping watch between audits.
Email support, 48-hour response
$700–1,200/month
Teams shipping new features every month.
Everything in Monitor, plus:
Priority support, 24-hour response
$1,800–3,000/month
Companies selling to enterprise or raising money.
Everything in Managed, plus:
Direct Slack channel
Neither email security nor clone sites stay fixed on their own. Someone who cloned your site once will often do it again under a new domain, and your DMARC policy needs updating every time you add a new tool that sends email. A retainer means someone is watching continuously, not just once.
The scanner behind every Security Snapshot is built in-house. These two are next.
Upload your codebase and get automated security testing back, with a proposed fix for each problem written as a diff against your original file. All that's left is reviewing and merging it.
For Canadian businesses using or selling AI tools in Europe and the UK. Translates the EU AI Act, UK AI regulation and provincial privacy law into a list of what you actually need to do.
Viverna is run by O.D.A Adetunji, a computer science and networking student at Ontario Tech University and a full-stack developer who builds and secures his own products. You deal with the person doing the work, from the first scan to the last fix.
The toolkit covers web application testing against the OWASP Top 10, vulnerability scanning with Nuclei and Nikto, secrets detection with Gitleaks and TruffleHog, TLS auditing, Linux hardening with Lynis, dependency and container scanning, and Burp Suite for manual testing.
Viverna is part of ADA Inventive.
CompTIA Security+
Property management platform for Canadian landlords.
University-verified social platform with location anonymization and system-level encryption.
Tool for scanning domains and websites for publicly exposed credentials and issues
Each one ships with rate limiting, idle-session timeouts, lockout after repeated failed logins and CAPTCHA on sensitive pages.
Not for a free finding or a Security Snapshot. Both only look at what is already publicly visible. A Full Web App Audit or Server Hardening needs your written authorization and an agreed scope before any testing begins.
Scope and timing are agreed with you in writing first. Anything that could affect a live site is either scheduled with you or run against a staging copy.
This works alongside them, not instead of them. It's an outside view of what the public internet can see, which most IT providers only check when asked. Fixes are delivered as pull requests and records your team can review before anything changes.
Ask for one free finding. You get a real issue from your own site by email, and you can verify it yourself or with your developer before deciding anything.
Yes. That's part of the Partner retainer, along with a quarterly report written for investors and enterprise buyers.
Monitoring only works once there's a known-good baseline to watch against. The first audit sets that baseline.
Tell Viverna what you run. The free finding and the Security Snapshot only look at what's already public, so all that's needed is your domain.