Plans and limits
Pentestas offers three plan tiers plus custom arrangements. This page enumerates the caps; pricing is at pentestas.com/pricing.
Quick matrix
| Feature | Free | Pro | Enterprise |
|---|---|---|---|
| Scans / month | 10 | 200 | Unlimited (SLA'd) |
| Concurrent scans | 1 | 5 | Negotiated (typical 25–100) |
| Verified domains | 1 | 10 | Unlimited |
| Max scan depth | 3 | 6 | Unlimited |
| Finding retention | 365 days | 3 years | Unlimited |
| AI analysis (Claude) | — | ✓ | ✓ |
| Attack chain synthesis | — | ✓ | ✓ |
| Agents | — | 3 | Unlimited |
| Browser capture | — | ✓ | ✓ |
| Authenticated scans | ✓ | ✓ | ✓ |
| Scheduled scans | — | ✓ | ✓ |
| Webhooks | — | ✓ | ✓ |
| Slack integration | — | ✓ | ✓ |
| Custom report branding | — | ✓ | ✓ |
| SSO (SAML / OIDC) | — | — | ✓ |
| BYOK encryption | — | — | ✓ |
| SLA | — | 99.5% | 99.9% |
| Support | Community | Email (24h) | Slack + dedicated CSM |
Rate limits (all plans)
| Scope | Limit |
|---|---|
| Auth endpoints (login, signup) | 5 / min per IP |
| API read endpoints | 30 / s per IP (burst 60) |
| Public / anonymous endpoints | 10–30 / hour per IP |
| Scan creation | 30 / min per tenant |
| Failed agent connects | 5 / hour per IP (then blocklist) |
Scan timeouts
| Scan type | Default timeout |
|---|---|
| Web / API | 3 hours |
| Network | 1 hour per /24 |
| Cloud storage | 30 minutes |
| Subdomain enumeration | 15 minutes |
| Azure / GWS audit | 30 minutes |
Pro+ can raise timeouts per scan. Enterprise gets arbitrary bounds negotiated in contract.
What happens at the cap
- Concurrent scans exceeded →
409 ConflictonPOST /api/scans. Wait for a running scan to finish. - Monthly scan quota exhausted →
403 Forbidden. Upgrade or wait for the month boundary (1st of calendar month, tenant-local timezone). - Retention window past → scan + findings auto-purged. Exports must be generated before this.
- Agent cap exceeded →
403onPOST /api/agents. Remove an agent or upgrade.
Custom plans
For regulated industries, multi-team orgs, or consultancies running scans on client infrastructure:
- Child tenants / sub-workspaces — one billing relationship, many isolated workspaces. One per client engagement.
- On-prem deployment — full Pentestas stack behind your firewall. Quarterly release updates.
- Air-gapped deployment — Pentestas + Exploit-DB mirror + Claude Sonnet model (if applicable) running entirely inside your network.
Get in touch at sales@pentestas.com.