Skip to main content
Pentest-Tools.com runs in two data regions: Europe and the United States. You pick one when you create your account, and it decides where your targets, scan results, findings, and reports are stored. Data residency here covers the account data listed under what is stored in your region. A few shared services run in one fixed location and serve both regions, so they fall outside it. Those are listed too.

​
Available regions

“Europe” here covers the UK, EU, and EEA. It is not a guarantee that your data stays inside the European Union specifically.

​
Picking your region

You choose a region on the signup form. The choice applies to the whole account: every workspace, team member, and API key under it.
You cannot change your region after signup. Moving an existing account between regions is not available yet. If you picked the wrong region, contact support before you add data you care about.

​
Signing in

Each region has its own sign-in URL, and your credentials only work on the region where your account lives. If you get an invalid credentials error on a password you know is correct, you are probably on the wrong region. Use the Region selector on the sign-in page to switch, or go straight to your region’s URL. Signing up again on the other region will not create a second account. An email address can only be registered in one region, and signup tells you which region already holds it.

​
What is stored in your region

Your account lives in the region you picked, and this is where each of the following is stored and served from:
  • Your account profile: name, company, address, email address, time zone, and avatar
  • Team members, their roles, and what you have shared with them
  • API keys and two-factor authentication settings
  • Assets and targets
  • Scans, including their configuration, status, and history
  • Findings and the evidence behind them
  • Reports you generate
  • Screenshots and other files produced during a scan
  • Database backups
Database backups stay in the same region as the database they came from. A US database is backed up in the US, a European database in Europe.
This describes where your account data is held, not a guarantee that no copy of it ever leaves. Several of the shared services below receive parts of it while a scan runs, and some of them keep what they receive. Read the next section alongside this one.

​
What gets processed outside your region

A few services run in one fixed location and serve both regions, so depending on which region you picked, these sit outside it. Every row below applies to both regions. What that means in practice:
  • Logs written by the tools while they run are shipped to logging infrastructure in Europe, including logs from US scanners. These logs can contain technical details about your targets.
  • The OpenVAS engine in Network Scanner runs on shared infrastructure in Europe. It receives the target, the ports and protocols you selected, and the vulnerability tests to run. Because it reaches your target directly, it also affects what you allowlist. See scan traffic and source IP addresses below.
  • Looking up known vulnerabilities for software found on your target sends the vendor, product, and version to shared services in Europe.
  • The subdomain cache behind Subdomain Finder is shared across both regions. Domains, subdomains, and IP addresses discovered by your scans get written to it.
  • The ML Classifier runs in Europe for both regions. It receives the HTTP response from the scanned URL, which covers the URL, the response headers, and the page content.
  • AI-enhanced authentication sends page and authentication context to a model hosted in the United States, whichever region you are in.
  • AI Pentests and Flowmapper send data to frontier large language models from US providers. Which models they use changes as we tune them. This is the case whichever region you are in.
  • Billing events from our payment provider arrive in the United States and get routed to your region. Your email address and billing provider ID are held there to make that routing work.
Requests also pass through a global content delivery network before they reach your region. For a full subprocessor list, or a data processing agreement covering these services, contact data.privacy@pentest-tools.com.

​
Scan traffic and source IP addresses

Scans for a US account start on US infrastructure and reach your target from a US source IP. Because some checks run on shared infrastructure in Europe, a US account can see scan traffic arriving from both US and European addresses. If you allowlist scanner IPs, allow the full published range for your region rather than individual addresses. See source IP addresses.

​
API and MCP access

The API base URL is the same in both regions:
Your API key carries a prefix identifying its region, and requests are routed on that prefix. There is no region-specific hostname to configure and nothing to change in your scripts when your account is in the US region. A key only ever reaches the region that issued it, so you cannot accidentally send a key to the wrong region through this URL. The MCP server at https://mcp.pentest-tools.com/mcp calls the same API, so the same key and the same routing apply.

​
Feature availability

The US region runs the platform with one exception: Apart from VPN profiles and internal network scanning, the platform’s capabilities are available in both regions: all scanners, reports, integrations, Pentest Robots, and the API. Where a capability relies on a shared service, it behaves as described above regardless of your region.