Terms of Service

These terms govern your use of pentestproject.com and, once your company signs a licence agreement, your use of the PenTest Project platform. The licence agreement repeats the commercial points below and adds the specifics of your order: products, edition, users, version and term. Where the two differ, the signed agreement prevails.

1. Who these terms are between

"We", "us" and "PenTest Hub" mean PTH Security S.R.L., trading as PenTest Hub and operating PenTest Project. "You" means the person reading this website or, under a licence agreement, the company named as the customer and everyone it allows to use its instance.

PenTest Project is a set of products for penetration testing companies and in-house security teams. It is offered to businesses, not to consumers.

2. Using this website

You may read this website and use its booking link to contact us. The content, screenshots, text and design are ours or used with permission, and may not be copied for commercial purposes without our written consent. The screenshots show an example client; the figures in them are illustrative. Prices shown are in euro, excluding VAT, and are an invitation to make an offer, not an offer in themselves.

3. The licence

Under a signed licence agreement we grant you a non-exclusive, non-transferable right to use the PenTest Project platform, for the edition, number of users, version and term stated in your order, for delivering security assessments to your clients or within your own organisation.

The licence does not permit you to sell, rent, sublicense or otherwise make the platform available to third parties as a product of its own, to remove or alter our notices, or to reverse engineer, decompile or attempt to derive the source code, except to the extent the law allows it despite this clause. White-label rights, where included in your edition, let you present the platform under your own brand to your clients; they do not let you resell it to other companies.

The platform is made up of products that are licensed separately: Flint, for scoping and project management, and Slate, for running engagements and reporting. Your order states which products you license and the number of users for each. Used together they share records; each also works on its own.

The platform is licensed, not sold. PenTest Hub keeps all right, title and interest in it.

4. Users

A licensed user is anyone on your team with a login: testers who write findings and reports, project managers who assign and review work and, in Flint, the logins of every Partner. Each product counts its own users. Your clients' users are free and unlimited and are never counted: neither their portal users in Slate nor the people who answer a questionnaire or sign a statement of work in Flint.

You may add users at any time; the fee is pro-rated to your renewal date. The licensed number of users is a limit: creating a login, or enabling one again, beyond it requires additional users on your licence. Logins that already exist are never disabled because of the licence. Each login is for one named person; sharing a login counts as a breach of these terms.

Any minimum number of users for an edition is the one shown on the pricing page at the time of your order.

5. Editions and versions

The platform comes in editions as described on the pricing page at the time of your order; what each edition includes may change for new orders, never for an order already placed. Two versions exist:

• Cloud version (we host): a dedicated instance, shared with no other customer, hosted in the region you choose: the European Union by default, or the United States, Canada, Australia and other regions on request, and run, backed up, monitored and updated by us. Available on every edition.
• Server version (you host): a release that carries every image it needs, an installer and a single-use activation key, installed inside your own environment by your team or by us. Available on the Enterprise edition only.

The Server version is installed with an activation key that activates one server. The licence it produces is bound to that server and carries your edition, products, number of users, term and the period during which you receive updates. Moving to another server is a transfer that we carry out on request.

The licence never deletes your data or holds it back. When the term ends without renewal, a grace period follows; after it the instance becomes read-only: everything can still be read and exported, but nothing can be changed until the licence is renewed.

6. Fees, billing and price changes

Fees are those shown on the pricing page at the time of your order, or those stated in your order where it differs, quoted per user per month, in euro, excluding VAT. The prices on the pricing page may change at any time; a change never affects an order already placed. The monthly plan is billed each month. Yearly and three-year plans are billed once a year in advance. Invoices are due within 30 days. If an invoice is unpaid 30 days after its due date we may suspend the service after giving you 14 days' written notice.

Your price stays fixed for the first two years. After that it may rise at renewal, by no more than 5% a year. We tell you about any change at least 60 days before your renewal date.

Onboarding, custom development, source-code escrow and any other service are priced in your order or in the price list current at the time you request them. Custom development is charged per day against an agreed scope. Source-code escrow with an independent agent is available on every edition at cost. A perpetual licence for the Server version is available under a separate agreement.

7. Term, renewal and ending the contract

The monthly plan has no minimum term and ends with one month's notice from either side. Yearly and three-year plans run for the term stated in the order and renew for the same term unless either side gives notice at least 60 days before the term ends.

Either side may end the contract immediately if the other commits a material breach and does not cure it within 30 days of written notice, or becomes insolvent.

When the contract ends, your access stops at the end of the paid period. We export your data to you on request in the platform's standard formats and delete it as described in the Privacy Policy. On the Server version your instance becomes read-only once the licence and its grace period have ended; your data stays in your environment.

8. Support, updates and services

Every edition includes updates and security patches, delivered as versioned releases. On the Cloud version we apply them, outside your business hours where we can, with notice for anything that changes how the platform works. On the Server version we publish signed releases; Flint and Slate can each check for them, and your administrator downloads and applies them. A release can be downloaded while your licence's update period covers it; on a subscription that period runs with your term. We support the current release and the one before it.

Support response targets are those listed for your edition on the pricing page at the time of your order; as of this version: Essential, email within two business days; Professional, priority support within the next business day; Enterprise, a named contact, phone support and a quarterly product review, plus development days as stated. Business days are Monday to Friday, excluding public holidays at our registered office. Targets are response times, not resolution times.

The Cloud version is designed to be available 99.5% of each calendar month, excluding announced maintenance. If we miss that in a month, you may claim a credit of 5% of that month's fee for every full percentage point below it, up to 25%, by writing to us within 30 days. Credits are your sole remedy for availability.

9. Your data and your clients' data

Everything you and your clients put into your instance is your data. You own it and you are its controller under data protection law. We process it only as your processor, under the data processing agreement attached to the licence agreement, and only to provide the service. We do not use it for any purpose of our own and we do not use it to train AI models.

You are responsible for having the right to put data into the platform, including evidence collected during engagements and the personal data of your users and your clients' users, and for the authorisation under which any testing you record was carried out.

10. Intellectual property

The platform, its code, its design, its report templates and its testing guides and catalogues are ours. The source code is not delivered under any edition. Where a client's policy requires assurance, we offer a supervised code review under NDA, or source-code escrow with an independent agent at cost, released only if we stop supporting the product.

Reports, letters and other documents you produce with the platform are yours. Your brand assets stay yours; you grant us the right to use them only to render your white-label instance.

If we build a feature for you under custom development, the feature belongs to PenTest Hub and becomes part of the product. In return you receive twelve months of exclusivity from its delivery, during which we do not offer that feature to other customers, unless we agree otherwise in writing.

If you give us feedback or suggestions, we may use them without obligation to you.

11. AI Assist

AI Assist drafts write-ups and summaries using an AI provider that you configure with your own account and key (for example Anthropic, OpenAI, Azure or a model you host). We sell the feature, not tokens. The provider's terms govern what you send to it; we are not a party to that relationship and we do not see the content exchanged. Drafts produced by AI Assist are suggestions: a person on your team remains responsible for every finding and every report that leaves the platform.

12. Acceptable use

You must not use the platform to store or distribute material that is unlawful, to attack or probe systems you are not authorised to test, to interfere with the service or other customers' instances, or to circumvent user limits or licence keys. You keep your users' credentials confidential and tell us promptly about any unauthorised use. We may suspend an instance that is being used to attack others, after telling you where we can.

13. Warranties and liability

We warrant that the platform will perform materially as described in its documentation and that we have the right to license it. We do not warrant that it is error-free or that it will find every vulnerability in a system under test: the platform records and reports testing; it does not replace the judgement of the people who do it.

To the extent the law allows, neither side is liable to the other for indirect or consequential loss, loss of profit, or loss of data that the other side could have prevented by the backups it is responsible for. Each side's total liability under the contract in any contract year is limited to the fees paid for that year, except for liability that cannot be limited by law, for breach of confidentiality, for infringement of the other side's intellectual property, and for the data processing agreement, which carries its own terms.

14. Confidentiality

Each side keeps the other's confidential information confidential, uses it only for the contract, and discloses it only to people who need it and are bound to keep it confidential. This duty lasts for five years after the contract ends, and indefinitely for your data inside the platform. It does not apply to information that is public, already known, independently developed, or required to be disclosed by law.

15. General

These terms and the licence agreement are the whole agreement between us about the platform. Changes must be in writing. Neither side may assign the contract without the other's consent, except to a successor of its whole business. If a clause is found invalid, the rest stand. Neither side is liable for delay caused by events beyond its reasonable control.

Governing law and the competent court are set out in the licence agreement.

We may update these website terms by publishing a new version here with a new date. The terms that apply to your licence are the ones in force on the date of your order, until renewal.