Cycling through all six. Tap any point to stop.

Measured on six things

All-in-one HR, security, training & outreach platform for...

Speed

Lighthouse mobile 58/100 with a brutal 9.4s LCP and 4.6s FCP; desktop is a healthy 86/100. The mobile gap is the story — a marketing site that takes nine seconds to paint on a phone is leaving signups on the table.

Screenshots

1 / 4

StartupKit

About this app

Kit is an applicant tracking system for startups, with security reporting and training in the same account. Hiring: one pipeline per role, GitHub code assignments, resume extraction, team votes, and interview self-scheduling with Google Meet and iCal. Candidates follow each step through one private link, no account needed. Security: RFC 9116 security.txt, a researcher portal, CVSS v3.1 intake, SLA-tracked triage, bounties with tax forms, and SOC 2 evidence exports. Training covers SOC 2, ISO 27001, GDPR and HIPAA with tamper-evident completion records and Vanta CSV export, no per-learner fees. Both are in the seat price. Work in the browser or from ChatGPT, Claude Code or Cursor via MCP tools and a REST API. Data lives on EU infrastructure with a DPA for every customer. The price is published per seat, with a 30-day trial and no sales call.

Key features

1All-in-one ATS + vulnerability disclosure + security training + outreach under one €6.99/seat/month price
2AI-agent access via MCP tools for Claude Code, ChatGPT, Cursor and GitHub Copilot with destructive-action confirmations
3Magic-link portals for candidates, security researchers and trainees — no accounts required on their side
4RFC 9116 security.txt, CVSS v3.1 intake, SLA-tracked triage, bounty payouts with tax forms, and SOC 2 evidence exports
5EU data hosting with a DPA for every customer; SAML SSO included without an enterprise tier
6Full product and docs localized into English, German, French, Spanish and Polish

Target customer profile

Drawn from the product itself, not from a survey.

Demographic

Early-stage startup founders

Pain points

Juggling multiple HR, security, and training tools; limited budget; lack of dedicated HR/IT staff.

Primary needs

Affordable, all-in-one solution; easy setup; scalability; compliance features for audits.

Demographic

HR managers at growing startups

Pain points

Managing recruitment pipelines; ensuring security awareness training; tracking candidate communication.

Primary needs

Streamlined hiring process; automated training reminders; centralized candidate data.

Demographic

Security and compliance officers

Pain points

Handling vulnerability reports; managing bug bounties; maintaining audit trails.

Primary needs

Efficient disclosure workflow; SLA tracking; integration with existing security tools.

Demographic

Sales and marketing teams

Pain points

Cold outreach inefficiency; lack of personalization; difficulty tracking responses.

Primary needs

AI-assisted prospect research; email drafting with approval; reply detection.

Scout Review

Written by AI from measured evidence, scored out of 100.

StartupKit is an ambitious all-in-one for early-stage startups: applicant tracking, vulnerability disclosure, security training, and outreach, all under one €6.99/seat/month price with a 30-day trial and no sales call. The design is sharp and the POV-tab landing page is one of the better product demos I've seen from a young company. Security posture is strong for the stage — security.txt, researcher portal, CVSS intake, SLA triage, SOC 2 evidence exports, EU hosting with DPA — even if the site itself is missing CSP and Permissions-Policy headers. Accessibility is a clean 100/100 on Lighthouse with five-language coverage. The real problem is mobile speed: a 9.4-second LCP on a marketing site is a conversion killer, and it's the single highest-leverage fix available. Growth is a judgement call — the bundle is differentiated but not defensible, and the 'four products, one bill' pitch will need a sharper wedge to beat focused incumbents. Worth a trial if you're a seed-stage team drowning in HR and security tools; skip it if you need best-in-class in any one area.

Measure by measure

Usability

30-day trial, no sales call, published €6.99/seat price, docs organized by outcome with per-module Quick Starts. Magic links for candidates/researchers/trainees remove the biggest onboarding friction. Solid for the stage.

Design

Sharp, opinionated landing page built around POV tabs (Operator/Candidate/Agent) with real MCP tool-call transcripts. Pricing and docs are clean and consistent. Branding reads modern and intentional, not template-y.

Speed

Security

Strong posture for the stage: HTTPS+HSTS, secure cookies, SPF/DMARC, plus a shipped security.txt, researcher portal, CVSS intake and SOC 2 evidence exports. Missing CSP and Permissions-Policy headers keeps it out of the top band.

Accessibility

Lighthouse a11y audit is a clean 100/100, and the product ships in EN/DE/FR/ES/PL across both app and docs. No public WCAG statement, but the automated baseline and multi-language coverage are strong for a product this young.

Growth

Real problem (startups juggling ATS + security + training), specific wedge (one seat price, EU hosting, no sales call), and a category with headroom. Differentiated but not yet defensible against a focused incumbent.

Improvement areas

Mobile performance: 9.4s LCP and 4.6s FCP on Lighthouse mobile (58/100) vs. 86/100 on desktop
Missing Content-Security-Policy and Permissions-Policy headers on the marketing site
No public WCAG conformance statement despite a 100/100 Lighthouse accessibility score
Positioning spans four buyer personas (founders, HR, security, sales) — needs a sharper primary wedge

Design & Usability

StartupKit's landing page is unusually confident for a product this young. Instead of stock screenshots it runs three POV tabs — Operator, Candidate, Agent — each showing a real-looking MCP tool call with token counts and a destructive-action warning. It's a smart way to sell the AI-agent angle without hand-waving. Pricing is a single plan at €6.99/seat/month with a currency switcher and net/VAT toggle, and the docs are organized by outcome ('If you need to… Start here') with per-module Quick Starts. Onboarding is genuinely low-friction: 30-day trial, no sales call, and candidates, researchers and trainees all get magic links so they never create an account. The main usability risk is scope — four products (hiring, security, training, outreach) under one billing page means the docs have to carry a lot of weight, and they mostly do.

Speed & Security

Speed is the weak spot. Lighthouse mobile performance lands at 58/100 with an LCP of 9.4 seconds and FCP of 4.6 seconds — that's a marketing site that will lose mobile signups before the hero even paints. Desktop is a much healthier 86/100, so the gap is clearly a mobile-specific optimization problem, not a fundamental architecture issue. Security is the opposite story: the HTTP probe shows HTTPS enforced, HSTS, frame protection, X-Content-Type-Options, Referrer-Policy, secure cookies, SPF and DMARC — 10 of 13 checklist points. The misses are CSP and Permissions-Policy, which is ironic for a company that sells a vulnerability disclosure workflow. On the product side, StartupKit ships RFC 9116 security.txt, a researcher portal, CVSS v3.1 intake, SLA-tracked triage, bounty payouts with tax forms, and SOC 2 evidence exports, all on EU infrastructure with a DPA. For an early-stage tool that's a serious security posture.

Accessibility & Growth

Accessibility is a genuine strength: Lighthouse's axe-core audit returns a perfect 100/100, and the product ships in English, German, French, Spanish and Polish across both the app and the docs. There's no public WCAG conformance statement yet, which is the obvious next step, but the automated baseline and multi-language coverage put it ahead of most peers at this stage. Growth is a more interesting question. The problem StartupKit names is real — early-stage startups with no HR or IT staff are genuinely juggling an ATS, a security disclosure tool, and a training platform, and paying three vendors for the privilege. The wedge is specific: one seat price, EU hosting, no sales call, and an AI-agent layer via MCP that the incumbents haven't shipped. Ashby and Greenhouse do hiring better; HackerOne does disclosure better. StartupKit's bet is that a seed-stage team would rather have one mediocre-but-integrated tool than three best-in-class ones. That's a defensible wedge for the segment it names, but it's not a moat — a focused incumbent could copy the bundle, and the 'we do four things' positioning makes it hard to be the obvious pick for any single buyer.

Conclusion

If you're a two-to-fifteen person startup with no HR or IT hire and you're currently paying for an ATS, a training platform, and something for vulnerability reports, StartupKit is worth the 30-day trial — the price alone makes the math easy. If you're a Series A with a real recruiting function, Ashby or Greenhouse will out-hire it, and HackerOne will out-disclose it. The product is honest about what it is: a bundle for teams that don't have the headcount to run four tools. The mobile performance is the one thing I'd want fixed before recommending it broadly, because a nine-second LCP on a phone is the kind of thing that quietly kills a funnel. Fix the headers, fix the LCP, and this becomes a much easier recommendation.

Suggestions for improvement

Fix mobile LCP (currently 9.4s) — the desktop score of 86 shows the architecture is fine, it's a mobile-specific optimization problem.
Add Content-Security-Policy and Permissions-Policy headers; ironic gap for a company selling a vulnerability disclosure workflow.
Publish a WCAG 2.2 conformance statement to back up the 100/100 Lighthouse score and five-language coverage.
Sharpen the positioning: pick one buyer (founder-operator vs. security officer) and lead with the wedge that matters most to them.

How we score

Alternatives comparison

Named competitors, point by point. Nobody paid to appear here or to be left out.

	StartupKit	Ashby	Greenhouse	HackerOne
Applicant tracking system (pipelines, scorecards, scheduling)	Yes — one pipeline per role, GitHub code assignments, resume extraction, team votes, self-scheduling with Google Meet and iCal	Yes — full ATS with scheduling, analytics and sourcing; deeper recruiting feature set	Yes — comprehensive hiring platform with structured interviewing and reporting	No — HackerOne is not an ATS
Vulnerability disclosure / bug bounty workflow	Yes — security.txt, researcher portal, CVSS v3.1 intake, SLA triage, bounties with tax forms, SOC 2 evidence exports	No — hiring only	No — hiring only	Yes — dedicated bug bounty and vulnerability coordination platform, deeper than Kit's
Security awareness training with completion evidence	Yes — SOC 2, ISO 27001, GDPR, HIPAA courses with tamper-evident records and Vanta CSV export, no per-learner fees	No	No	No
AI agent / MCP integration	Yes — MCP tools for Claude Code, ChatGPT, Cursor, GitHub Copilot; destructive actions require confirmation	Limited — AI features inside the product, no public MCP tool layer	Limited — AI features inside the product, no public MCP tool layer	Limited — AI triage features, no public MCP tool layer
Published per-seat pricing with free trial, no sales call	Yes — €6.99/seat/month, 30-day trial, no sales call, Outreach add-on at €17.99/account/month	Partial — pricing typically requires a demo; free tier exists for small teams	No — enterprise pricing, sales-led	Partial — published tiers for some plans, sales-led for enterprise
EU data hosting with DPA for every customer	Yes — EU infrastructure, DPA included with every subscription	Available on request — US-based with EU data options	Available on request — US-based with EU data options	Available on request — US-based with EU data options