How PentestAI Handles Your Account and Project Data
Learn what PentestAI stores for accounts, project drafts, billing, security activity, and optional analytics, including current service limitations.
Account and project data we store
The application stores an internal account ID, verified email, optional display name, and account timestamps. Google identifiers are stored when that sign-in method is used. OAuth access tokens are not stored.
Private projects contain a name and scope preparation notes. Do not enter credentials, tokens, or assessment evidence in those fields.
Billing data and security audit records
Stripe handles hosted payment details. The application stores customer references, expected orders, payment and subscription references, credit ledger changes, and relevant financial status. It does not store card numbers.
Security audit records track actions and resource IDs without copying project notes or payment card details. Audit history is append only in the application.
Optional analytics, preferences, and retention
You can decline optional analytics or change the preference using the footer control. Approved page and button events use constrained properties and route templates. Full target URLs, query strings, email addresses, scope notes, credentials, and evidence are excluded.
Optional first-party analytics have a 90-day cleanup operation. Security and financial records are separate from marketing preferences. Operator retention and account-data request procedures must be finalized before public production launch.
Service providers and current launch status
The deployment is designed for Cloudflare Workers and D1, with Auth.js session handling, an optional email delivery provider, optional Google sign-in, and Stripe billing. Google Analytics or Tag Manager remain disabled unless the operator configures its own identifier and the visitor consents.
The production operator identity, contact route, jurisdiction, retention schedule, and account deletion procedure must be completed before accepting public customer data. This implementation document should be reviewed and finalized for that launch.