Mehta Foundry is a studio that builds applications and automation, tests software for security weaknesses with written permission, and makes games, animation and 3D work. Every job starts with a written scope and a fixed price.
Two service lines have published offers and examples: AI automation and cybersecurity. The rest are available on request. Send a short brief and we’ll reply with a scope.
Nine services, from Doc-to-Data (documents to checked records, fixed price from USD 1,200) to inbox triage with drafted replies, website help answers from your own documents, internal knowledge search, lead capture to CRM, scheduled reports, data sync between tools, product catalogue content and document checklist checks. Every workflow keeps a log and waits for your approval before anything is sent or changed.
Penetration testing, red team exercises, vulnerability assessment and security research, for systems you own or are authorised to have tested. Always under a signed scope.
Web applications, dashboards and internal tools, from first spec to a deployed product. Built in milestones you can try as we go, with the code, credentials and a short runbook handed over at the end.
iOS and Android apps and the API behind them. Scoped up front, built in testable milestones, and shipped to the stores under your accounts.
Small games and playable prototypes for mobile and the web. Send the idea, the platform and the timeline, and we’ll come back with a scoped plan.
2D and motion animation for product explainers, launches and social posts, produced to your brand and aspect ratios.
Models for products, games and visualisation, delivered in the formats your pipeline uses.
Ad creative and variations for campaigns, made to your brand guide and each platform’s specs, so you can test more than one idea.
Short animated pieces, from script and storyboard through to the final render and sound.
Scripts, integrations, data tooling and anything that doesn’t fit a box. Describe the problem and we’ll reply with a scope and a fixed price.
Hands-on testing of commercial web apps, APIs and mobile apps, guided by the OWASP Top 10, the OWASP API Security Top 10 and OWASP MASVS. Authorised testing only.
Manual testing of a web app, API or mobile app to find what an attacker could exploit, with a non-destructive proof for each finding.
Objective-based exercises that test how far an attacker could get against systems you own, inside an agreed rules of engagement.
A broader, lighter-touch review of your applications to find and rank known weaknesses, with a prioritised list of fixes.
Focused research on software you own, including reverse engineering of client-owned binaries, written up as clear, reproducible findings.
USD 1,500
USD 3,000
USD 5,000
Extra work is USD 90 an hour and only with your written approval first. 50% on signature, 50% on delivery of the report.
Testing is point-in-time and isn’t a compliance audit or certification.
There are no client case studies here yet. Everything below is an example or a sample document, labelled that way, and none of it is client work. Every example document carries an “EXAMPLE DOCUMENT” banner.
12 example invoices, receipts and bank statements with 7 problems placed on purpose: wrong totals, wrong VAT rate, missing tax, a tip left out, a broken running balance, an incomplete client collection and a duplicate invoice. In this example, every one of them was flagged.
14 example shipping documents across 3 shipments with 9 problems placed on purpose, including container and air waybill check digits, HS code format, quantity and weight mismatches and duty arithmetic. In this example, all 14 were routed as expected.
20 example invoices from 6 countries in English, German and French layouts, with 9 problems placed on purpose. In this example, the arithmetic, tax rate, credit-note and duplicate checks routed all 20 as expected: 11 ready, 9 to review.
10 example leases, tenancy agreements, service-charge budgets and contractor invoices with problems placed on purpose, such as a wrong end date, a deposit above the legal cap and a break date after expiry. In this example, 10 of 10 were routed as expected.
11 example UK CIS applications, Irish RCT notices and Indian RA bills with problems placed on purpose, such as CIS deducted on materials, VAT charged under reverse charge and expired insurance. In this example, 11 of 11 were routed as expected.
The scope and rules of engagement every security job starts with: authorisation, in-scope and out-of-scope assets, permitted activities, test window, emergency stop contacts and how critical findings are reported. Blank placeholders throughout.
Three example walkthroughs for an example shop: inbox triage with drafted replies, answers from help-centre pages with the source quoted, and a weekly report calculated from an order export. Not client work; the output is shown as produced.
Example results show how the checks and routing behave on example documents. They aren’t accuracy figures for real documents. On a real project, the number that matters comes from a test on 30–50 of your own documents.
Every engagement follows the same four steps, with the scope and price agreed in writing before work starts.
India and South Asia, the UK and Europe, and the US and Canada. Prices in USD, GBP, EUR or INR.
We list every service your data passes through before we start, keep it in the region you choose and delete it when you ask. UK and EU clients can have a data processing agreement.
Unmeasured accuracy figures, ROI numbers or guarantees. You get measured results on your own material and a clear list of what’s out of scope.
Tell us what you need. We’ll reply by email with next steps, and for most work a written scope and fixed price.