Hosting and data

Two ways to run PenVanta. Always know where your data is.

Have us run a private PenVanta server for your organisation, or run it on your own infrastructure. Either way, your findings, evidence and reports are never shared with another customer, and you can tell your clients and auditors exactly where they are kept. It works the same for PenVanta Testing, PenVanta Remediation and PenVanta Complete.

Talk to us about hosting Sign in

Run by PenVanta

PenVanta Dedicated

Your organisation’s own private server and its own private file storage, run by us and sized for your team. Nothing is shared with any other customer: no shared database and no shared storage.

You choose where it runs. Choose the region at setup: UK and EU regions available. EU data residency available, with EU-only file storage on request.
Encrypted and backed up. Encrypted file storage, plus nightly encrypted backups kept for 14 days. Only PenVanta can restore them, with a key held offline.
Updated for you. We apply signed releases, take a backup first and roll back automatically if anything fails.
Not on the open internet. Your server isn’t directly reachable from the internet. All access goes through a protected front door.
Tightly controlled staff access. Only named PenVanta engineers can reach your server. Each access needs them to re-authenticate and is logged.
Simple sign-in. Your team signs in at app.penvanta.com with passkeys or emailed codes.
A private address. Each workspace has its own randomly generated web address, so your name and your clients’ names never appear in it.
Or your own address and email. On request, your team and clients use your own address, such as portal.yourcompany.com, and PenVanta’s emails come from your own domain.
Nothing to manage. There are no servers for you to look after.

Your infrastructure

Self-hosted

Run PenVanta on your own Linux server with Docker, in your data centre or your cloud account. All your data stays on your infrastructure.

Works fully offline. Run it on an air-gapped network, with offline licence files.
Only licensing and updates. Online installs contact PenVanta only to check the licence and fetch updates.
Your work stays yours. PenVanta never receives your findings, targets, credentials, client names, report contents or evidence.
Verified updates. Updates are signed and verified before they are applied, and your administrators decide when to apply them.
Your backups, your rules. You manage backups and retention, the same way as your other systems.

Side by side

Compare the two options.

Every feature of your product is in both. What changes is who runs PenVanta and where it runs.

PenVanta Dedicated and self-hosted PenVanta compared
	PenVanta Dedicated	Self-hosted
Who runs it	PenVanta	Your administrators
Where it runs	Your organisation’s own private server, in the region you choose at setup (UK or EU)	Your own Linux server with Docker, in your data centre or cloud account
Where findings, evidence and reports are stored	On your private server and in its own private file storage	On your infrastructure
Shared with other customers	Nothing: no shared database, no shared storage	Nothing: it’s your installation
EU data residency	Available: EU-only file storage on request	You decide where your servers are
Encryption at rest	Encrypted file storage. Credentials, messages and report files are also encrypted by PenVanta itself	Credentials, messages and report files are encrypted by PenVanta itself. Disk encryption is up to you
Backups	Nightly, encrypted, kept for 14 days. Only PenVanta can restore them, with a key held offline	Managed by you
Updates	Applied by PenVanta: signed releases, backup first, automatic rollback	Signed and verified before they are applied, by your administrators
Reachable from the internet	Not directly: all access goes through a protected front door	Your choice, including fully offline
PenVanta staff access	Named engineers only, with re-authentication each time and every access logged	None
What PenVanta receives	We host your data for you, as your data processor	Licence checks and update downloads only, or nothing at all with an offline licence file
Signing in	app.penvanta.com, with passkeys or emailed codes	Your own PenVanta address, with passkeys or emailed codes
Web address	Private and randomly generated, with no customer names in it	Whatever address you give it
Servers to manage	None	Yours
Products	Testing, Remediation or Complete	Testing, Remediation or Complete
Features	All of your product’s	All of your product’s

Where is my data?

Straight answers for your security review.

The questions your clients and auditors ask, answered plainly.

Where are our findings, evidence and reports stored?

PenVanta Dedicated: on your organisation’s own private server and in its own private file storage, in the region you chose at setup. No other customer’s data is stored with yours.

Self-hosted: on your own server, and wherever you keep its storage and backups. None of it is stored by PenVanta.

Can we choose the country our data is in?

Yes. For PenVanta Dedicated you choose the region at setup, and UK and EU regions are available. If your clients need their data kept in the EU, ask for EU data residency and we’ll keep your file storage in the EU only. Self-hosted PenVanta runs wherever your servers are.

Who at PenVanta can access our data, and when?

PenVanta Dedicated: only named PenVanta engineers can reach your server, and only to run it: setting it up, applying updates, fixing problems, restoring a backup or helping when you ask. Each access needs them to re-authenticate and is logged. Your server isn’t directly reachable from the internet at all.

Self-hosted: nobody at PenVanta. We have no access to your installation.

What does PenVanta itself hold about us?

Outside your PenVanta Dedicated server, we hold only business contact details and licensing and billing details: who your contacts are, what you bought, invoices and licence records. Never your engagement data: findings, targets, credentials, client names, report contents and evidence stay on your Dedicated server or your own infrastructure.

To send people to the right workspace from app.penvanta.com, we keep a one-way, keyed fingerprint of each user’s email address, never the address itself. Our privacy notice covers the rest.

What if something goes wrong with our Dedicated server?

Your server takes an encrypted backup every night, and each backup is kept for 14 days. Only PenVanta can restore a backup, using a key that is held offline, so a backup is no use to anyone who gets hold of it without that key.

Does self-hosted PenVanta send anything to PenVanta?

An online install contacts PenVanta only to check its licence and download updates. It never sends findings, targets, credentials, client names, report contents or evidence. With an offline licence file it never contacts us at all, which is how air-gapped installs work.

What happens to our data if we leave?

PenVanta Dedicated: before your subscription ends, an administrator downloads everything under Administration, Data export: one archive of every record and every stored file, decrypted. Then we delete your server and its file storage, and the remaining encrypted backups expire within 14 days. Section 9 of our terms sets out the details.

Self-hosted: your data is already on your own infrastructure, so it stays with you.

Who are your sub-processors?

We use a small number of carefully chosen providers to run PenVanta Dedicated. The list of sub-processors is available on request, and we tell you before adding a new one so that you can object. See section 10 of our terms, or ask us for the list.

Next step

Talk to us about hosting.

Tell us how big your team is and where your clients need their data kept. We’ll recommend the right setup and size it for you.

Talk to us about hosting Sign in

UK and EU regions, chosen at setup
No shared database or storage with other customers
Self-hosted works fully offline, even air-gapped