Privacy Policy
This policy explains what personal data we collect when you visit this website, book a demo, or use the PenTest Project platform, why we collect it, and the rights you have over it.
1. Who we are
PenTest Project is operated by PTH Security S.R.L., trading as PenTest Hub. For the purposes of the General Data Protection Regulation (GDPR), PenTest Hub is the controller of the personal data described in sections 3, 4 and 5, and the processor of the data described in section 6.
2. What this policy covers
This policy covers three situations:
- Visiting pentestproject.com, including the product page you came from.
- Contacting us, for example by booking a demo or emailing us.
- Using the platform as a customer, as a user on a customer's team, or as a client invited to scope an engagement, sign a statement of work or use a customer's client portal.
It does not cover the websites of other companies we link to, or penetration testing services PenTest Hub delivers under a separate engagement contract. Those have their own terms.
3. Visiting this website
When you open a page on pentestproject.com, our web server receives the technical data every browser sends: your IP address, the page requested, the time, the referring page if any, and the browser and operating system identification. We use this data to deliver the page, keep the site secure and understand which pages are read. Server logs are kept for 30 days and then deleted, unless an entry is needed to investigate an attack or a fault.
The legal basis is our legitimate interest in running and protecting the site (Article 6(1)(f) GDPR).
We do not run advertising, we do not use analytics that follow you across other websites, and we do not sell or rent data about visitors.
To count which pages are read, the site uses a privacy-first analytics service. It sets no cookies, stores nothing in your browser and does not follow you across websites. It records the page you open, the referring page, your country, your browser type and how quickly the page loaded, and it does not use your IP address to identify you. The legal basis is the same legitimate interest in running the site (Article 6(1)(f) GDPR).
4. Booking a demo or contacting us
If you book a demo or write to us, we collect what you give us: your name, work email address, company, and anything you tell us about your team and your needs. We use it to answer you, to prepare and hold the demo, and, if you ask, to send you an offer.
Demos are booked through a scheduling service; this website itself has no form and collects nothing before you open the booking window. When you open it, or follow a booking link, the scheduling service loads its booking tool, and the name, email address and time slot you enter there are processed by that service on our behalf to create the appointment and send the calendar invitation. The service's own privacy policy applies to that tool; our agreement with it limits what it may do with your data to providing the booking.
The legal basis is taking steps at your request before entering into a contract (Article 6(1)(b) GDPR). We keep the correspondence for 12 months after the last contact. If a contract follows, it is kept with the contract records described in section 5.
We do not add you to a newsletter because you booked a demo. If we ever run one, you will be asked separately and can leave it at any time.
5. Customers of the platform
When your company licenses PenTest Project, we process the data needed to run the contract: the names and work contact details of your signatory, your administrators and your billing contact; the products, edition, number of users, version and term you chose; invoices and payment records; and support correspondence.
The legal basis is the performance of the contract (Article 6(1)(b) GDPR) and, for invoices and accounting records, our legal obligations (Article 6(1)(c) GDPR). Contract and billing records are kept for the retention period required by tax and commercial law, which is five years after the end of the financial year in which the contract ended, as accounting law requires.
To run the service we also keep a technical log of administrative events on your instance, such as provisioning, updates and backups. These logs identify your instance, not individual users of it.
6. Data inside your instance
Everything your team and your clients put into the platform, including engagements, findings, evidence, reports, attestation letters, the names and email addresses of your users and of your clients' portal users, and the activity and access logs the platform keeps, is your data. Your company is the controller of it. PenTest Hub processes it only as your processor, under the data processing agreement that forms part of your licence.
- On the Cloud version, your data lives on a dedicated instance that no other customer shares, hosted in the region you choose: the European Union by default, or the United States, Canada, Australia and other regions on request. We access it only to run, back up, monitor and update the service, or when you grant access for support.
- On the Server version, your data never leaves your environment. We have no access to it unless you grant it for support.
We do not read, analyse or use your engagement data for any purpose of our own, and we do not use it to train AI models. If you enable AI Assist, the platform sends the text you choose to the AI provider you configured with your own key, under that provider's terms, and we are not a party to that transfer.
When your contract ends, we export your data to you on request and delete it from our systems within 30 days of the end of the term, except where law requires us to keep a copy. Backups are overwritten on their normal cycle, at most 90 days later.
7. Cookies and browser storage
This website sets no cookies of its own. The booking window, once you open it, is a frame served by the scheduling service and may set cookies that belong to that service and are needed for the booking. The site uses your browser's local storage for three conveniences that never leave your device: the theme you chose (white or dark), the tabs you last opened in the Flint and Slate walkthroughs, and the billing period you selected on the pricing table. You can clear them at any time by clearing site data in your browser, and the site works without them.
The platform itself uses strictly necessary cookies to keep you signed in and to protect forms against cross-site request forgery. These require no consent because the service cannot work without them. Public sign-in and request forms are protected by a bot-protection service, which checks that a request comes from a browser rather than a script; it processes your IP address and browser characteristics for that purpose only.
8. How long we keep data
| Data | Kept for |
|---|---|
| Web server logs | 30 days |
| Demo and contact correspondence | 12 months after the last contact |
| Contract and billing records | Five years after the end of the financial year, as accounting law requires |
| Your data inside your instance | For the term of the contract, then deleted within 30 days (backups within 90 days) |
| Support correspondence | 24 months after the ticket is closed |
9. Where data is stored
Our own systems are hosted in the European Union. A Cloud version instance is hosted in the region its customer chooses: the European Union by default, or another region such as the United States, Canada or Australia at the customer's request, in which case the customer, as controller, decides on that location. Where we or a service provider we use process personal data outside the European Economic Area, we rely on an adequacy decision of the European Commission or on the Standard Contractual Clauses, and we can give you a copy of the relevant safeguard on request.
10. Security
The platform encrypts data in transit, stores secrets encrypted at rest, locks accounts after repeated failed sign-ins, asks for the password again before anything is deleted, and keeps activity, document-access, email-delivery and fault logs so that you can see who did what and when. Every release passes an automated test suite that walks every endpoint for authorisation gaps. The Cloud version is backed up daily. Our own staff reach customer instances only through named, audited accounts.
No system is perfectly secure. If we learn of a breach affecting your data, we will tell you without undue delay and, where the GDPR requires it, notify the supervisory authority within 72 hours.
11. Your rights
Under the GDPR you may ask us to:
- access the personal data we hold about you and receive a copy;
- correct data that is inaccurate or incomplete;
- delete data we no longer have a reason to keep;
- restrict or object to processing that rests on our legitimate interests;
- receive data you gave us in a machine-readable form, where processing rests on consent or contract;
- withdraw consent at any time, where processing rests on consent, without affecting what was done before.
Contact us. We answer within one month. If you are a user of a customer's instance or a client invited by a customer to scope, sign or use its client portal, your request about data inside that instance goes to that company, which controls it; we will help them answer it.
You also have the right to lodge a complaint with a data protection supervisory authority, in particular in the member state where you live or work, or where we are established.
12. Changes to this policy
We will update this policy when the service or the law changes. The date at the top tells you when. For changes that affect how we use customers' data we will also tell administrators by email before the change takes effect.