Your application runs on SQL Server.Who is watching it?

Don't trust us. Take away our ability to do harm.

Every query the script can run is published. All of them read-only — and the delivery pipeline fails if a single one is not.

-- SEC012 · compte de service du moteur
SELECT TOP 1
    ISNULL(service_account, '') AS service_account,
    ISNULL(startup_type_desc, '') AS startup_type_desc
FROM sys.dm_server_services
WHERE filename LIKE '%sqlservr.exe%'

Real excerpt from the collector: no writes, no network calls.

• Read-only, verifiable query by query
• Three privilege tiers: you choose what we may read
• Nothing installed, no agent, no inbound connection

You receive the script before the audit: your DBA reads it in full, before we run anything at all.

What you receive

• Board report · PDF
• Technical report · PDF
• Online workspace

See the full pricing details

Indicative prices in EUR, excl. VAT. The quote is issued after a first 30-minute call.

The questions we get asked

The ones executives ask, and the ones asked by the IT person they forward this page to.

Can the collector change anything on my production server?

No. It performs no writes on your databases: no CREATE, no ALTER, no DROP, no INSERT, no UPDATE, no DELETE. Its queries run without taking locks, so it cannot slow your application down. This is not a statement of intent: on every change to the collector, the delivery pipeline analyses the entire body of queries and refuses to ship if a single one is not read-only — or if a single one could not be extracted for review.

Can we review the queries before letting them run?

Yes, and it is built for that. One collector option writes every query it can run into a .sql file, each with its check identifier and the matching line of the script. That command does not connect to SQL Server, needs no privileges and runs no audit: the script analyses itself, then stops. You hand the file to your DBA or your security officer. The collector is plain PowerShell — no binary, no obfuscated code.

What privileges do you need on the server?

As few as possible, and you decide. The default tier is a login that can only read server state, metadata and the msdb history: it reaches the contents of none of your business tables. Two broader tiers exist to cover more checks; the broadest one requires sysadmin and is therefore no longer read-only by construction — it is disabled once the audit is done. In every case, the result names what could not be assessed for lack of privileges, and why.

How much of my time does this take?

Two meetings and five minutes of hands-on work. A 30-minute scoping call up front, a 45-minute video debrief at the end, and in between you run the script yourself. Nothing to install on your servers, no agent, no inbound connection. The analysis and the writing are on our side; the debrief is scheduled within five business days of the collection reaching us.

What exactly do I receive?

Two PDF reports: the board report, in plain language, readable without a DBA, and the technical report with the matching T-SQL commands. With them, your score out of 100, the breakdown by domain, and an action plan ranked by risk, by effort and by score points recovered. The results stay available in an online workspace, and the video debrief is there to settle priorities with your team.

How much is it, and what makes the price move?

From €1,490 excl. VAT for a single instance. What moves the price is the number of SQL Server instances to audit, not the number of days spent. Every tier is a fixed package: the quoted price is the final price, no day is billed separately, and the price per instance falls as the fleet grows. The scope is settled in the first call, before any invoice.

Where does my data go?

The collector reads no business data: only system catalogues and engine metrics. What it produces is a file of configuration facts and findings, and nothing leaves your environment automatically — you are the one who sends it to us. The platform is hosted in France, with a European provider: your data never leaves the EU. Findings and personal data are encrypted at rest, your data is neither sold nor rented, and your organisation stays in charge of how long it is kept and when it is deleted. The detail is in the privacy policy.

Why pay, when free tools exist?

They exist and they are good: Microsoft publishes one, and so does the SQL Server community. They produce raw data you have to know how to read — in other words, they assume a DBA. What you pay for here is not the collection, it is the interpretation: an expert reads your results, translates them into risk for your business, ranks them by priority and explains them to you. If you have a seasoned SQL Server DBA in-house, a free tool may well be enough.

What happens after the audit?

You leave with an action plan ranked by priority, which your team carries out. Applying the fixes is not part of the audit: that is a separate engagement, by quote. Three to six months later, a control re-audit measures what actually held. And if you want to stay covered over time, the advisory follow-up re-audits regularly and keeps the action plan up to date. None of this is compulsory: the audit stands on its own.