Where to find policies

​

Legal documents

​

Security certification

Pentest-Tools.com is ISO 27001 certified. The certification covers the information security management system for the platform and its underlying infrastructure.

​

Data processing

​

Data retention

Personal account data is retained for as long as your account is active, and for up to 24 months after it closes. Financial records are kept for 10 years as required by law. For full details, see our privacy policy.

​

Data deletion

To request deletion of your personal data, contact data.privacy@pentest-tools.com. You can also export your scan data for up to 30 days after account termination.

​

AI data policy

Our platform includes AI-powered features: the ML Classifier, Flowmapper, AI-enhanced authentication, and AI Pentests.

​

Our AI infrastructure

Different AI features use different model providers:

• The ML Classifier uses proprietary classification models on infrastructure we control in Europe. It receives the HTTP response from the scanned URL and returns a classification result. See ML Classifier for exactly what it receives.
• AI-enhanced authentication uses OpenAI models hosted in our own Azure environment in the United States.
• Flowmapper and AI Pentests use frontier third-party models from US providers, reached through OpenRouter. Which models they use changes as we tune them.

Each of these runs in one fixed location for every account, whichever data region you are in. Depending on your region, that may be outside it. We require our third-party AI providers to process your data only to run the feature, not to train their models on it. For Flowmapper and AI Pentests we also turn off prompt and completion logging, deny provider training, and enforce zero data retention at the account level.

​

Model training

The ML Classifier is our own model. It was trained on public data and de-identified scan results, and we are not currently training new classifier models on your scan data. Flowmapper, AI Pentests, and AI-enhanced authentication use third-party foundation models. Your data is sent to them for inference only, not for model training. If we introduce AI features that use your data for training in the future, we will document that clearly and provide an opt-out path.

​

Data handling

We send your AI request data only to the infrastructure needed to run the feature you selected, and we don’t keep it as part of your account record once the feature finishes. Some of these services write operational logs that can include the request they processed. If you need the log retention period for a specific feature, contact data.privacy@pentest-tools.com.

​

About AI accuracy

The ML Classifier, Flowmapper, and AI-enhanced authentication don’t generate vulnerability findings. The AI handles scoping: is this a soft 404, where are the endpoints, which element is the login button? The actual findings come from the same testing pipeline regardless. If an AI step fails or gets it wrong, the scan falls back to traditional methods or skips that step. AI Pentests work differently. There, the AI drives the testing itself and drafts the findings and the report. See AI Pentests for how that works and what to check in the output.

​

Responsible disclosure

If you find a security vulnerability in our platform, email security@pentest-tools.com. Include a description of the issue and steps to reproduce it. We follow responsible disclosure practices and will keep you updated on the fix.

​

Privacy and data requests

For GDPR requests, data deletion, or any other privacy concerns, contact data.privacy@pentest-tools.com.

​

Related topics

• Account security
• Data regions: where your data is stored and what gets processed elsewhere