About Aevral

What Aevral does

PR security review

PR review is live on install: installing the App starts reviews.

For each supported pull request, Aevral reads the diff of the changed files, the most security-relevant in full, and looks for security flaws on the added lines across access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security.

It posts an advisory GitHub Check with inline comments, up to five findings per review, and says when it held more back. Leads it could not prove are listed in the Check as unverified, never as comments.

It never blocks a merge.

Whole-repo scan

Press Scan and Aevral reads the default-branch snapshot of the repository: cross-file context, the authorization rules behind each route, the business logic that decides who may access what.

You get a GitHub Check on the scanned commit and a console report with evidence for every finding.

Suggested fix

Each finding carries a fix prompt you copy into Claude Code, Cursor, or Codex, and can carry a suggested diff you apply. You review the fix before merge; Aevral does not commit, push, or auto-merge patches.

What makes Aevral different

Open-source models, processed in the US today.

Claude Security runs Claude models and Codex Security runs OpenAI models. Aevral runs open-source models, processed in the US today with an EU-only option announced, and the transparency report publishes scope, method, and the frozen eval matrix.

One bill per organization, not per seat.

Claude Security is bought as Claude Enterprise seats plus tokens. Aevral prices per organization: paid PR plans from $49 per month, scan plans from USD 0 for public repos through USD 1,699 self-serve, excluding VAT.

Inviting a teammate never changes the bill.

No enterprise floor to start.

Hosted Claude Security scans require Claude Enterprise.

Aevral's free tiers need no card: one authorized public-repo scan a month, and PR review, live on install, free at 25 private reviews a month after the 14-day trial, plus 500 public reviews a month.

One job, hard bounds.

Today Aevral's PR review looks for access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security; whole-repo scans read authorization, IDOR, and business-logic access control only. Not memory corruption, not secret or dependency scanning, not a general SAST.

Reviews are capped at five findings, grounded on the added lines, and the Check still reports when there is nothing to say.

A finding is a lead, not a confirmation.

Every finding carries the file, the lines, and the reason a human should look. No catch-rate boasts, no patches applied for you. Nothing merges without the human.

Who Aevral is for

Small commercial GitHub teams, where the founder or the lead pays for the tool and owns security.

Security engineers outnumbered by repositories and pull requests.

AI security engineers, and teams shipping agent-written code that still needs a human merge.

Open-source maintainers of public repositories, the free lane.

The team behind Aevral

Aevral is built by Better ISMS EURL, a one-founder software company in Paris. Tristan Roth started the company to build compliance software: ISMS Copilot, the ISO 27001 and GRC assistant, came first, then heyGRC, the pull-request compliance reviewer, and ismsdirectory.com, the directory of ISMS tools.

Aevral is the code-security side of the same job: reading source the way a security reviewer reads it, for who has access to what. One EURL, no outside investors. Better ISMS is getting ISO 27001 certified and is not certified today; the intended scope includes Aevral, and the evidence is public at the family trust center.

Working with Aevral

Channels

Aevral talks where the work happens: an advisory GitHub Check and inline comments on the pull request, scan reports in the console, and the contact form for a human. There is no marketing inbox on this site.

Onboarding

Install the GitHub App; PR review is live on install. Sign in with GitHub to connect it. Complete Setup when you want the first scan. The owner can turn reviews off at any time; reinstalling the App turns them back on.

Cadence

Reviews run when a pull request is opened, reopened, or synchronized, and the same head is never counted twice. Scans run when you press Scan, or on a recurring schedule on a paid scan plan.

Who answers

A one-founder company. The contact form reaches Tristan Roth directly; the person who answers is the person who builds.

PR review status

PR review is live on install: installing the App starts PR reviews on the next pull request.
Installing the App starts reviews, even before anyone signs in.
Signing in to the console with GitHub later connects that install.
Setup Complete can still turn them off.
Reviews can be disabled at any time; reinstalling the App turns them back on.
Paid PR plans are live in the console.

Talk to us

The contact form is the fastest route: tally.so/r/PdxdbV. We do not publish a marketing inbox on this site.

Key facts

Product

Aevral, an AI security reviewer for GitHub pull requests.

Product type

Application security software (SaaS) for GitHub teams.

Launched

2026

Company

Better ISMS EURL, RCS Paris 943 594 648

Founder

Tristan Roth, founder and manager

Registered address

60 rue François 1er, 75008 Paris, France

Website

aevral.com

Core offering

PR security review (live on install) across access control, business logic, injection, XSS, SSRF, path traversal, and LLM-integration security, and whole-repo scans for authorization, IDOR, and business-logic access control, with suggested fix prompts.

Pricing

Per organization, not per seat. PR free tier live: 500 public reviews a month, 25 private a month after the 14-day trial; paid PR plans from $49 per month. Scans from USD 0 for public repos through USD 1,699 self-serve; Enterprise quoted from USD 3,300 per month equivalent. HT, B2B, excluding VAT.

Contract terms

Self-serve plans are monthly per organization; free tiers need no card. Enterprise is an annual commitment with invoice billing.

Services

PR security review, whole-repo scan, fix prompts, advisory GitHub Checks, aevr_ API keys.

Communication

GitHub Check and inline comments on the pull request, console reports, contact form.

Customers

Counts are not published; no customer is named without consent.

Competitors

Named competitors: Claude Security (Anthropic) and Codex Security (OpenAI). Aikido, CodeRabbit, Greptile, SonarQube, and others are complementary platforms, documented at /compare.

Social

X: @Tristanyway. GitHub: better-isms.

Frequently asked questions

Who builds Aevral?

Aevral is built by Better ISMS EURL, a Paris company founded and run by Tristan Roth. The same company builds ISMS Copilot, the ISO 27001 and GRC assistant, and heyGRC, the pull-request compliance reviewer.

Is Better ISMS ISO 27001 certified?

Better ISMS is getting certified and is not certified today. The intended certification scope includes Aevral. The programme's scope and status are public at the family trust center.

Is Aevral open source?

No. Aevral runs on open-source models, processed in the US today with an EU-only option announced; the product itself is not open source. The transparency report publishes scope, method, and the frozen eval matrix.

How is Aevral priced?

Per organization, never per seat.

The PR free tier is live: 500 public reviews a month, 25 private a month from install, plus a 14-day trial that starts when you sign in with GitHub and connect the install; paid PR plans start at $49 per month.

Scan plans run from USD 0 for public repos to USD 1,699 self-serve, and Enterprise is quoted. Prices are HT, B2B, excluding VAT.

How do I reach a human?

The contact form is the fastest route and reaches the founder directly. There is no marketing inbox on this site.

Security review, handled.

Install the GitHub App and PR review starts on. Sign in with GitHub to connect it, then press Scan for the repository you already have.

Install the GitHub App Log in Sign up

For professional use. By installing, you confirm you can act for the account or organization that owns it, and you accept the Terms and DPA on its behalf.