Built to the standard you test against.
You’ll judge PenVanta the way you judge your clients’ systems. So here is exactly how it protects client data, with the limits stated plainly.
Identity
No passwords exist in PenVanta, for staff or clients.
Passkeys and one-time codes
Sign-in uses WebAuthn passkeys or an 8-character emailed code that expires in 5 minutes, allows 5 attempts and is stored only as a keyed digest.
Revocable sessions
Sessions are server-side with idle and absolute expiry. People can see and end their own sessions.
Recent sign-in for sensitive actions
Revealing credentials and changing sign-in methods need a sign-in within the last 10 minutes.
Invitation only
There is no public sign-up. Invitations are single-use and never sign anyone in by themselves.
One server per Dedicated customer
Each PenVanta Dedicated customer has its own private server and its own private file storage, with its own database, encryption keys and licence. Nothing is shared with another customer.
No direct internet access
A Dedicated server isn’t directly reachable from the internet. All access goes through a protected front door.
Restricted staff access
Only named PenVanta engineers can reach a Dedicated server. Each access needs them to re-authenticate and is logged.
Self-hosted, one published port
Only the web front end is exposed. The API, database, storage and report renderer sit on private container networks.
Air-gapped support
Licences activate offline, and signed update bundles install without internet access.
Isolated processing
Scanner files are parsed by a separate worker. Reports render in a sandbox with no network, no credentials and a read-only filesystem.
Encryption
Server-side encryption at rest, with keys kept apart.
AES-256-GCM
Testing credentials, project messages and rendered report files are encrypted before they are stored.
Bound to their context
Ciphertext is bound to its organisation, project and record, so it can’t be replayed elsewhere.
Keys outside the database
Encryption keys are separate files, never stored in the database or built into images. Missing keys fail closed.
Release integrity
Every released report records a SHA-256 hash of the exact files delivered.
Sensitive data
Designed so the worst data never has to be kept.
Audited credential reveal
Reveal writes an audit event before the value is returned, and masks again after 30 seconds or when the window loses focus.
Password audit without passwords
Recovered passwords and hashes are never stored: only statistics, pattern labels and keyed fingerprints for reuse.
Hostile input handling
Parsers treat every export as hostile: XML entities are refused and archives are bounded. Word imports reject macros.
Clean logs
Structured logs are allowlisted and never contain request bodies, credentials or secrets.
Access control
The server decides, every time.
Checked on every request
Permissions are enforced on the server and scoped to the organisation in the database itself.
Clients kept apart
Client roles can never be combined with internal ones. Clients see only what’s explicitly published.
History you can trust
Project history is append-only, enforced by the database. Security-relevant actions are audit events.
Optional AI, explicit consent
AI drafting is off by default, can run on your own Ollama, and shows the exact text before anything is sent.
Updates
A supply chain you can verify.
Signed releases
Release manifests are Ed25519-signed and every image is pinned by digest, verified independently by the app and the updater.
Safe to apply
Each update backs up the database, migrates, and must pass health checks, or it rolls back automatically.
Private distribution
Releases come from our private registry with short-lived, per-installation download passes.
Licensing traffic
Licence checks never contain findings, targets, credentials, client information or report content.
What PenVanta doesn’t do (yet).
Security buyers ask. Here are the straight answers.
Not available today
- Single sign-on (SAML or OIDC). Sign-in is passkeys and one-time email codes.
- End-to-end encryption. Data is encrypted at rest on the server, not end to end.
- High-availability clustering. Self-hosted PenVanta runs on a single host.
- Attack-path analysis. The attack surface map shows what is on the network, deliberately not how to chain it.
Found a vulnerability?
Please report it to us privately and give us a reasonable chance to fix it before any public disclosure. Don’t include live keys, credentials or customer data.
See your own engagement in PenVanta.
Bring a sanitised report or a recent scan. We’ll walk through how the same test runs in PenVanta, from import to the portal your client sees.
- PenVanta Dedicated or self-hosted, even air-gapped
- PDF and native, editable Word from one template
- No passwords to steal, anywhere in the product