PentestAI Security: Your Data and Testing Boundaries
Understand how PentestAI protects account access, separates private data from marketing analytics, verifies payments, and approaches safe-mode testing.
Set the boundaries before the assessment
You decide the assets you are authorized to assess, the questions you need answered, and the operations to exclude. The default safe-mode testing policy excludes destructive operations.
A clear brief helps align security work with your application and business priorities. Authorization and appropriate operating conditions remain essential for a live engagement.
Keep private account records with their owner
Email login codes expire, are stored as hashes, and can be used only once. Rate limits help control repeated requests. Google sign-in, when enabled, requires a verified authoritative email.
Account identity is checked on the server when accessing projects, activity, settings, and billing. Requests cannot choose a different account owner to retrieve private records.
Keep assessment material out of marketing analytics
Optional analytics exclude target addresses, project scope, credentials, request bodies, responses, and findings. Third-party marketing tags remain outside the private workspace.
Use draft notes for assessment preparation. Keep passwords, session tokens, and real assessment evidence out of those notes.
Confirm payments before changing a balance
The server records the expected order before checkout and verifies the payment provider’s signed event before monthly credits are released. Annual subscriptions release 10,000 credits in each of 12 monthly installments; the full annual allowance is not available upfront. Duplicate payment events cannot add the same credits twice.
Credit changes, refunds, and their corresponding account activity records are recorded together, giving you a clearer financial history.
Review the experience before live testing
Create a private workspace and explore the fictional report sample without providing target access. You can review the evidence structure before choosing a live assessment.
Review the current verification, authorization, credit reservation, and runtime limits in your company workspace before starting an assessment. Saving a preparation draft starts no scan.