Least access
We ask for the minimum access needed for the agreed scope, read-only by default, and time-limited. Production customer data is not required unless you explicitly decide otherwise. [TO BE CONFIRMED LEGALLY]
For builders of apps & AI solutions
Ship apps and AI agents your enterprise customers can trust.
Global X Solutions checks what your app and your AI agents really do with data — and gives you evidence you can hand to a customer's security team.
01 — Proof
We hold ourselves to the same standard.
Our own iOS app, PatternLens, runs on-device with no cloud backend. Its App Store privacy label reads “Data Not Collected”.
We review your product with the same method: declarations checked against observed behaviour, with evidence for every finding.
02 — How it works
Four steps, each agreed in writing
Scope
We agree which apps, systems, vendors and data flows are in scope, and what access we need — read-only wherever possible.
Review
We map data access, permissions and third-party flows against your own policies and the applicable requirements you name.
Report
You receive findings with evidence, risk rating and a prioritised fix list your teams can act on.
Verify
After fixes, we re-check the agreed items and document what changed.
03 — iOS privacy audit
Your App Store label should match your traffic
We compare what your iOS app declares with what it actually sends over the network, including every bundled SDK.
- App Store privacy label vs. actual network traffic
- Privacy manifest (PrivacyInfo.xcprivacy) and required-reason APIs
- Third-party SDK inventory and their data flows
- Tracking domains and undeclared endpoints
04 — AI agent access review
Know what your agents can reach
AI agents and automations hold keys, tokens and connectors. We map what each one can read and write, and whether customer data leaves for external models or vendors.
- API keys, tokens, OAuth scopes and connectors
- Permissions vs. actual need (least privilege)
- Customer data flows to external models and vendors
- A prioritised fix list
05 — Evidence pack
Answer security questionnaires with evidence
Enterprise and financial-sector customers send long security questionnaires and expect suppliers to support DORA and NIS2 supply-chain requirements. We prepare a factual evidence pack from our review.
- Data-flow and sub-processor map
- Permission and access inventory
- App privacy declarations with supporting evidence
- Inputs for DORA / NIS2 supplier questionnaires
06 — Ongoing monitoring
Updates change things
New releases, SDK updates and vendor changes can quietly change data flows and permissions. On request, we repeat agreed checks after updates or vendor changes and flag differences against the last baseline.
Available on request.
Why an EU-based partner
Why an EU-based partner
- EU-based (Polish) company. Client data stays in the EU.
- NIS2 / KSC supply-chain requirements. Poland's amended National Cybersecurity System Act (KSC) has been in force since 3 April 2026; obligations for in-scope entities apply by 3 April 2027.
- Evidence-based reviews of apps, SDKs, vendors and permissions.
- Working hours that overlap with the EU and the US morning. English and Polish.
No certifications or clearances claimed.
07 — Data & privacy
How we handle your data during an engagement
The points below are our stated working principles, not a certification or a confirmation of regulatory compliance. Contract terms (including a data processing agreement where required) take precedence. [TO BE CONFIRMED LEGALLY]
Minimisation & retention
After the audit is completed, we return all documentation and materials received from the client and securely delete our working copies within 30 days, confirmed in writing. We do not retain client audit data. We keep only what the law requires: the contract, invoices and related accounting records (generally 5 years from the end of the financial year, Polish Accounting Act art. 74; Tax Ordinance art. 86). [TO BE CONFIRMED LEGALLY]
No resale, no reuse
We do not sell, rent or reuse your data or findings, and we do not name you as a client without your written consent. [TO BE CONFIRMED LEGALLY]
Confidentiality
Engagements can be covered by an NDA and, where we process personal data on your behalf, a data processing agreement under GDPR Art. 28. [TO BE CONFIRMED LEGALLY]
Your rights (GDPR)
Individuals can request access, rectification, erasure, restriction, portability and objection, and may lodge a complaint with a supervisory authority (in Poland: UODO). [TO BE CONFIRMED LEGALLY]
Transparency
Controller: Global X Solutions, KRS 0000646869. Data contact: office@globalx.pl. Legal basis: performance of a contract (Art. 6(1)(b) GDPR), legal obligations such as accounting and tax (Art. 6(1)(c)), and legitimate interest in handling correspondence and defending claims (Art. 6(1)(f)). Where we process personal data on a client's behalf, we act as processor under Art. 28 GDPR and return or delete it at the end of the services (Art. 28(3)(g)). [TO BE CONFIRMED LEGALLY]
This site uses privacy-friendly, cookieless aggregate analytics (Cloudflare Web Analytics); no cookies, no cross-site tracking, no personal profiles. No third-party fonts. The contact form opens your own e-mail client; nothing is sent to a server.
08 — Contact
Request a scoping call
Tell us what you want reviewed. We will reply with questions and a proposed scope.
E-mail: office@globalx.pl