Skip to content
Noroxi

Your clients ask “is our site secure?”Answer under your own brand.

Bulk-add and label client domains. Noroxi scans them and groups the findings per client; you deliver the report with your name and logo as a PDF, a share link or a monthly email.

Create an agency account See the sample report

White-label reports, client labels and share links are on the free plan too.

The report your client sees

The live report, the PDF and the share link come from the same data. The agency and domains in the sample are fictional; the grade formula, remediation plan, effort and role come from the real report rules.

  • Your agency name and logo at the top, then the client label and domains.
  • The overall grade is the weighted average of the tool scores; with an open critical or high finding the letter is capped at C.
  • The remediation plan is grouped by root cause: one task can close several findings, each with an estimated effort and owner role.
  • Your contact line at the bottom, plus a small “Produced with Noroxi” line.
  • Assignees, finding notes, due dates and evidence are left out of the version that goes to the client.

Sample client report · agency and domains are fictional

Example Agency · Security report

North Group

kuzey-yazilim.example · anadolu-lojistik.example

Overall grade

83/100

Capped at C because critical or high findings are open; the score itself is unchanged.

Prioritised remediation plan

  1. Complete email authentication (SPF, DKIM, DMARC)

    High1 hourEmail administrator

  2. Remove sensitive files exposed on the server

    High30 minHosting provider

  3. Add the missing security headers

    Medium30 minWeb developer

Example Agency · security@example-agency.example

Produced with Noroxi · noroxi.com

From client to delivery

Each step has its own page in the panel; no separate tool or spreadsheet to keep.

  1. 01

    Bulk-add

    Add domains from a list or CSV (up to 500 rows, optional client label). Preview first, then confirm; your plan's domain limit applies.

  2. 02

    Scan

    Start the scorecard, WP Lens and port scan from the Scans page. The inventory refreshes weekly on the free plan and daily on Pro and Team.

  3. 03

    Manage findings

    Assign, accept or mark as false positive; add what you found during a test by hand, attach up to 5 encrypted evidence files per finding, retest tool and WP Lens findings in one click.

  4. 04

    Branded report

    A live report, a full PDF and a one-page executive summary per domain or client; your expert note, an archive and a share link valid for 30 days.

  5. 05

    Monthly email

    On Pro and Team, on the 1st of every month to up to 5 recipients with the summary and the full report as PDFs; recipients unsubscribe in one click.

What your agency gets

  • White-label reports

    Your agency name, logo (PNG or JPEG, up to 300 KB) and contact line on the report, the PDFs and the share link; the monthly email comes from “<your name> via Noroxi”. In a team only the owner edits the brand.

  • A view per client

    Give a domain a client label; findings, scans and reports filter and group by it. All of a client's sites in one report.

  • Expert note and archive

    Add your own commentary to the report (up to 4,000 characters); it shows in the share link and the PDF. Archive the report as it stands today (up to 500 entries) and share any version by link.

  • Pentest workflow

    Manual findings, CVSS (only from the CVE record or your own vector; never estimated), encrypted evidence (up to 1.5 MB), activity history, bulk actions on up to 200 findings at once.

  • Due-date targets

    Suggested per severity: critical 7, high 30, medium 90, low 180 days; save your own, and overdue findings stand out in the list.

  • Team and issue trackers

    A team by invite link; the owner's plan carries over to members. From a finding, open a pre-filled issue in GitHub, GitLab, Jira or Linear (no token stored).

Plans

Every agency feature is on every plan; only the monthly client report email is paid. Pro and Team raise the domain, team and scan limits.

PlansFree$0Pro$29/moTeam$99/mo
Domains115100
Team members310100
InventoryWeeklyDailyDaily
Scans per hour1060200
Deep scans (with authorization)—YesYes
White-label, note, archive, share link, manual findingsYesYesYes
Monthly client report email—YesYes

No auto-renewal.All plan details

Questions

Will my client see the Noroxi name?
If you enter your brand, the report opens with your name and logo, and the monthly email comes from “<your name> via Noroxi”. A small “Produced with Noroxi” line stays at the bottom of the report and the email.
Who holds the data?
Findings, reports, notes and evidence stay in your Noroxi account, in a space shared with your team; users outside your team don't see them. Evidence is stored encrypted and opens only for signed-in team members. The share link, the PDF and the monthly email that go to the client leave out assignees, finding notes, due dates and evidence; the link is valid for 30 days and can be revoked at any time.
What are the rules for port scans and deep scans?
Light scans are open on every plan. Deep scans (full subdomain discovery, WP Lens deep file checks, unauthenticated service checks in the port scan) run on Pro and Team. The port scan is on every plan (per day: 5 free, 10 on Pro, 50 on Team); deep scans and the port scan ask you to confirm, every time, that you are authorized to scan the target, and the confirmation is recorded. Getting your client's permission is up to you. Domains behind a CDN are not port-scanned; government domains are never scanned by any tool.
Is white-label paid?
No. Brand, expert note, archive, PDF, share link, client labels, bulk import, manual findings, evidence, retest and due dates are on every plan. Only the monthly client report email is paid.
How many clients can I add?
The limit is the number of domains: 1 on the free plan, 15 on Pro, 100 on Team. In a bulk import, rows over the limit are shown separately in the preview and not added.

Not there yet

  • Your client has no login of their own; they receive the report as a PDF, a share link or the monthly email.
  • One team per person; instead of a team per client, use client labels.
  • Reports are not served on your own domain; the share link is on the Noroxi address.
  • Bulk import does not start scans; the domains join the regular scan schedule.

Set up your agency account

A five-step setup opens after sign-up: brand, clients, team, due dates, monthly report. Skip any step you like.

Create an agency account