Trust center

Security and data handling at PentestFlow.

PentestFlow is built around a simple principle: your engagement data should stay inside your network. Here is what that means in practice, and what we are honest about not yet having.

Self-hosted by default

PentestFlow ships as a Docker Compose stack you run inside your own network. There is no required SaaS tier, and core workflows do not need outbound internet access. You control where evidence and reports live.

Local-first AI

The Community edition uses local AI via Ollama. Cloud AI providers (Gemini, OpenAI, DeepSeek) are available on Pro and Enterprise, and they are explicitly opt-in. No prompts or evidence are sent to third parties unless you configure a provider.

Authentication and access

Pro and Enterprise editions ship with JWT-based authentication and bcrypt-hashed credentials. Enterprise adds full RBAC across projects, methodologies, and reports, plus SSO and SAML integrations with your IdP.

Execution policy and sandboxing

Command execution is governed by an allowlist, blocklist, or unrestricted policy that you set in Settings. The backend validates dangerous patterns and pins the working directory for each project to keep runs reproducible and contained.

Audit logging

Enterprise records every meaningful action with actor, target, and timestamp. Audit data is exportable as CSV and is retained according to your tenant configuration.

Rate limiting and abuse controls

API endpoints are rate-limited per route (for example, command execution and AI calls have lower per-minute caps than general API traffic) to reduce blast radius from misconfigured plugins or runaway scripts.

Honest disclosure

What we do and do not currently hold.

  • We do not currently hold SOC 2, ISO 27001, or PCI-DSS certifications as a vendor. PentestFlow includes compliance mapping features so your team can map findings and methodology steps to those frameworks for your audits.
  • Because PentestFlow is self-hosted by default, your tenancy is your environment. We do not operate a multi-tenant data plane for the product itself.
  • Pro and Enterprise commercial features (cloud AI, external intel) are explicitly opt-in. Disabling them keeps your runs fully local.

Optional subprocessors and dependencies

Because the product is self-hosted, the list below describes optional components you may run alongside PentestFlow. None are required for core functionality.

Responsible disclosure

Found a vulnerability? Email us at yabetsworkaferahu@gmail.com. We acknowledge reports within two business days and credit researchers in our advisories unless you prefer to remain anonymous.

Please do not test against systems you do not own or are not authorized to test.
Need a security questionnaire? Talk to sales