Blog · By Rea Hailley, CEO and Co-Founder
Does Your App Need a Security Review? A Plain-Language Guide for Business Owners
Security should match consequence. The more sensitive the information your app handles, and the bigger the actions it can take, the earlier security belongs in your plan. In Canada, independent security reviews start around $2,500 CAD, a fraction of what retrofitting costs after launch.
Why it matters: security handled late is one of the main ways business owners end up paying twice for the same app.
- Five questions determine most of the security conversation, and none of them are technical
- There is no universal "secure app certificate", and anyone selling you one is selling you a story
- A review before architecture is locked in costs thousands; a retrofit after launch costs tens of thousands
I co-founded New Idea Machine, a Calgary custom software and AI company, and I am not a security expert. That is the point of this guide. You should not have to become one either. What you need is the same thing I needed: a plain-language way to recognize when a project has crossed the line where independent security belongs in the plan, and roughly what to budget when it does.
What is the difference between security, compliance, and certification?
These three words get used interchangeably, and they should not be:
- Security is the set of controls that reduce risk: who can get in, what they can see, what gets logged.
- Compliance is meeting the legal, contractual, and industry obligations that apply to your specific business and data.
- Certification is formal evidence against a specific standard, where a recognized validation path exists.
There is no universal "secure app certificate." The correct requirements depend on your actual product, your data, your users, and where you operate. A developer who promises your app will simply "be compliant" without asking what data it handles and where your customers are is telling you what you want to hear.
When should security be involved in a software project?
Think in three bands:
- Your builder handles it. Public marketing sites, low-risk prototypes, and internal tools that hold nothing sensitive. Good hosting, admin access control, updates, and privacy basics cover it.
- Independent review before launch. Anything with logins: customer portals, apps holding personal data, internal AI working with company data, integrations between systems. The team that built it should not be the only team checking it.
- Security at the table before architecture is locked in. Health or financial information, payment authority, regulated decisions, and AI agents that can act on other systems. Here, security shapes the architecture. Bolting it on later is the expensive path.
The five questions that determine most of it
You can have this conversation with any developer, today, without a technical background:
- What information does it handle? Public, personal, financial, health, or regulated data are different worlds.
- Who can access it? Customers, staff, contractors, vendors, and AI systems all count.
- What does it connect to? Payment systems, your CRM, email, files, other APIs.
- What can it change or cause? Read-only is one thing. Sending messages, changing records, or moving money is another.
- Where will it operate? Jurisdictions, customer contracts, and sector rules change the obligations.
If your developer cannot walk you through these five in plain language, that itself is an answer.
What does a security review cost in Canada?
Indicative planning ranges, in Canadian dollars, based on the security specialists we work with:
- Authenticated app or customer portal: independent review from $2,500 CAD, typically delivered in about two weeks as a risk map with a prioritized action plan.
- App handling sensitive personal data: from $3,500 CAD.
- Payment or financial workflows: from $5,000 CAD, with complex remediation work from $15,000 CAD.
- Health information apps: from $5,000 CAD, plus specialist scope where privacy assessments are required.
- AI agents with system access: from $3,500 CAD.
- Ongoing security assurance: from $1,500 CAD per month where the system keeps changing.
These are planning numbers, not quotes; final scope depends on the actual system, data, and jurisdiction. But notice the shape of them: every figure on that list is a fraction of what our clients have paid to fix security after the fact.
What about AI agents?
AI adds one question on top of everything above: what can this system ultimately cause? An AI agent that summarizes your meetings is a different animal from one that can send emails, change records, or spend money. For agents that can act, a proper review checks that its credentials and permissions are limited to what the task requires, that consequential actions need human approval, that everything meaningful is logged, and that there is a way to stop it and roll it back. We build our agents this way from day one, and it is why nothing goes into a client's systems without a human approving it.
What happens if you skip it?
We meet the aftermath regularly in our project rescue work. One client spent $150,000 with another team before finding us. Her team had told her the app was secure. It was not, and making it right was part of the rescue. That is the strongest argument for independent verification: the team that builds your app should not be the only team vouching for its security. Skipped security does not show up as a bug. It shows up later, as a failed customer review, a procurement process you cannot pass, or a rebuild you already paid for once.
What does it look like when it is done right?
One of our clients is a nurse who built a health app with us. Because of the nature of her app, security and compliance were built in from the very beginning, shaping the architecture rather than patching it, and doing it in that order saved her more than thirty thousand dollars. Security shaped the product from day one instead of becoming an invoice at the end. And we do not grade our own homework: we bring in independent security specialists to check the work.
Where do you start?
Not with a security shopping list. Start with the five questions above, answered for the app you have or the app you want to build. Bring them to a complimentary meeting and we will tell you which band your project actually sits in, what belongs in the architecture, and when an independent review is worth the money, including when it is not.
No pitch. No pressure. Just clear advice.
This guide is general planning information, not legal advice. Requirements depend on your actual system, organization, and jurisdiction, and should be confirmed with qualified specialists.
Rea Hailley is the co-founder of New Idea Machine, a Calgary custom software and AI company that builds apps, automations, and AI agents that business owners own outright.