🛡 Pentestas › help

Security

Pentestas is a security product, and the meta-product is our own security posture. This page summarises the model.

Tenant isolation

  • DB-level — every tenant-scoped table has tenant_id as a non-null foreign key. Row-Level Security policies in Postgres (enabled + FORCED) require every query to set app.current_tenant; queries that forget it see zero rows, not all rows.
  • App-level — every authenticated request sets the tenant context from the JWT / API key. There's no admin override for cross-tenant queries other than explicit superadmin actions, which are logged.
  • Backup-level — backups are per-tenant encrypted with the tenant's Fernet key. Restoring a tenant's backup in a different Pentestas instance requires its key material to decrypt.

Encryption

See Encryption for field-level specifics.

  • At rest — TDE via the storage provider + Fernet field encryption for sensitive columns.
  • In transit — TLS 1.3 on all public endpoints; internal Docker network between backend services; agent connections use TLS 1.2+ with strict cert pinning to *.pentestas.com.
  • At the agent — credentials DPAPI-encrypted (Windows) or chmod-0600 (Linux); never logged.

Authentication

  • Passwords — bcrypt (cost 12), known-breached-password check via the k-anonymity Pwned Passwords API.
  • MFA / 2FA — TOTP supported, FIDO2 roadmap (Enterprise).
  • SSO — SAML 2.0 + OIDC on Enterprise.
  • Session tokens — JWT signed with a 32-byte HS256 secret rotated annually; HttpOnly Secure SameSite=Lax cookies.

Audit logging

Every security-relevant action is logged:

  • Login / failed login (with IP + UA).
  • Role change / invitation / removal.
  • API key create / revoke.
  • Scan create / cancel / delete.
  • Agent create / disable / delete.
  • Setting changes.

Audit logs retention: 365 days Pro, unlimited Enterprise. Exportable via API or CSV.

Network posture

Pentestas backend runs behind nginx with strict CSP, HSTS, frame-ancestors=none, permissions-policy locking down camera / mic / geolocation. WebSocket endpoints require Origin checks. Rate limits per-IP on every public route.

No inbound ports exposed on customer-deployed agents.

Vulnerability management

  • Dependency scanning — weekly audit via Pentestas' own dependency scanner (meta, yes).
  • Third-party pentest — annual, report summary available under NDA to Enterprise prospects.
  • Responsible disclosure — Please email security@pentestas.com. We respond within 24h, maintain a 90-day disclosure window, and publish accepted reports in our security hall of fame.

Compliance

  • SOC 2 Type II (Pro+) — report available under NDA.
  • GDPR — data-processor on your behalf; DPA available.
  • CCPA — likewise.
  • HIPAA / FedRAMP — Enterprise only, custom agreement.

Incident response

If we suspect a breach affecting a tenant:

  1. We triage within 1 hour of detection.
  2. Notification to tenant admin within 4 hours if confirmed.
  3. Public disclosure within 7 days (with remediation status) unless law enforcement requests delay.
  4. Full post-mortem published within 30 days.

Reporting a concern

See also