Last updated: July 15, 2026

1. Introduction

Pentone Systems Inc. ("Pentone," "we," "our," or "us") operates the Pentone platform - a workspace for security teams to manage knowledge, conduct vulnerability assessment and penetration testing (VAPT) engagements, and generate templated reports. This Privacy Policy explains how we collect, use, store, and protect your personal data when you use our service.

By using Pentone, you agree to the data practices described in this policy. If you do not agree, please do not use the service.

2. Data We Collect

2.1 Account Data

When you register for Pentone, we collect:

Email address - used as your primary identifier and for account communications
Full name - for profile display and team collaboration
Password - hashed with bcrypt (12 rounds); we never store plaintext passwords
Avatar image - optional profile picture
Preferences - timezone, language, date format, notification settings

2.2 Session & Device Data

When you log in, we record:

IP address - for session security and audit logging
User agent and device information - to identify active sessions
JWT tokens - access tokens (8-hour expiry) and refresh tokens (7-day expiry) for authentication

2.3 Workspace & Engagement Data

As you use Pentone, you create and store:

Workspace information - organization name, members, settings
Project data - client engagement details, project names, descriptions
Vulnerability findings - titles, descriptions, CVSS scores, proof-of-concept steps, evidence files (screenshots, logs), remediation guidance
Report templates - DOCX, HTML, or Markdown templates you upload
Generated reports - completed deliverables with immutable vulnerability snapshots
Knowledge documents - documentation, methodologies, notes
Messages and comments - team collaboration content within projects

2.4 OAuth Data

If you sign in via Google OAuth, we collect your Google profile information (name, email, avatar) and your Google ID. Your email is considered pre-verified. We do not access your Google contacts, drive, or any other Google services.

2.5 Billing Data

When you subscribe to a paid plan, we process payment through Stripe. We store your Stripe customer ID and subscription ID but do not store full payment card details on our servers. Payment processing is handled entirely by Stripe, a PCI DSS-compliant payment processor.

3. How We Use Your Data

We use your data solely to provide and improve the Pentone service:

To authenticate you and manage your account
To enable team collaboration within workspaces
To generate VAPT reports from your templates and findings
To provide AI-assisted vulnerability drafting (see Section 7)
To enforce access controls and data isolation between tenants
To send service-related communications (password resets, email verification, workspace invitations)
To calculate usage metrics and plan limits
To investigate security incidents and maintain audit logs

We do not sell your personal data to third parties. We do not use your data for advertising or profiling.

4. Data Storage & Security

4.1 Storage Infrastructure

MongoDB - primary database for all structured data (users, workspaces, projects, vulnerabilities, templates, messages)
Redis - session cache, token blacklist, rate limiting, pub/sub event bus
File storage - evidence files and report exports stored on local filesystem or S3-compatible storage (AWS S3 / Cloudflare R2)

4.2 Encryption

In transit: All traffic is encrypted via TLS 1.3. Internal service-to-service communication occurs within a private Docker network.
At rest: Passwords are hashed with bcrypt (12 rounds). Password history and MFA secrets are encrypted with Fernet (AES-128-CBC). Database-level encryption is available via MongoDB Atlas encryption at rest.
File access: File downloads are protected by HMAC-SHA256 signed URLs with 60-minute expiration.

4.3 Data Isolation

Pentone is a multi-tenant platform. All data is isolated by tenant ID at the database query level. File paths enforce tenant prefixes. Enterprise customers can use Bring Your Own Database (BYODB) for complete database-level isolation.

5. Data Retention & Deletion

5.1 Retention Periods

Soft-deleted vulnerabilities and files: 30-day recovery window before permanent deletion
Audit logs: 90-day retention for security and activity logs
Active account data: Retained for the duration of your subscription
Session tokens: Access tokens expire after 8 hours; refresh tokens after 7 days
Password reset tokens: 1-hour expiry

5.2 Account Deletion

You can delete your account at any time through your account settings. Account deletion triggers a cascading cleanup of your personal data across all services. Soft-deleted data is permanently removed after 30 days.

6. Third-Party Services

Pentone integrates with the following third-party services:

Google OAuth - for SSO login (scopes: openid, email, profile)
AI providers - OpenAI, Anthropic, Groq, Google Gemini, and NVIDIA (DeepSeek/Gemma) for vulnerability content generation (see Section 7)
Email delivery - Brevo (Sendinblue) and ZeptoMail for transactional emails (verification, password reset, invitations)
Stripe - payment processing for paid subscriptions
MongoDB Atlas - database hosting
Redis - caching and session management
Umami - self-hosted, cookieless website analytics on our marketing site (pentone.io) - no personal data, no cookies, aggregate page views only
PostHog - product analytics inside the app (feature usage, not screen recording or session replay), only active if you accept analytics in the cookie banner below

Each third-party service has its own privacy policy governing how it handles data. We only share the minimum data necessary for each service to function.

6.1 Cookies & Local Storage

This section explains, plainly, everything that gets set in your browser when you use Pentone - what it is, why it exists, and which parts you can turn off.

Strictly necessary - always on

These aren't optional because the app can't function without them - there's no tracking purpose here, just keeping you logged in and your session secure.

Access & refresh tokens - keep you signed in (8-hour and 7-day expiry)
oauth_nonce - a short-lived (10-minute), HttpOnly cookie used only during Google sign-in to prevent CSRF attacks. Deleted automatically once login completes.
Theme preference - remembers light/dark mode (stored in localStorage, not a cookie)

Analytics on our marketing site - no consent needed, no cookies

pentone.io runs Umami, which doesn't use cookies at all and doesn't collect anything that identifies you personally - just aggregate counts of page views and referrers. There is nothing here to opt out of because there is nothing tracking you individually.

Product analytics inside the app - opt-in, off until you say yes

When you're logged into the app, we'd like to know which features actually get used - things like a report being generated, a template uploaded, a workspace created - so we know what to improve. This runs through PostHog, but only after you explicitly accept it in the banner shown on your first visit. If you decline, or haven't answered yet, absolutely nothing is sent.

What this is not, by design:

No session recording or screen replay - our integration doesn't load the tooling that makes this possible in the first place, it isn't just switched off
No automatic capture of clicks, form fields, or page content - only specific, named events we've deliberately chosen to track (e.g. "report generated"), each with a fixed, minimal set of properties
Given the nature of what Pentone stores - client vulnerability data - we do not want, and have not built, anything that could incidentally capture that content

You can change your mind at any time by clearing your browser's local storage for this site, which resets the banner.

Lastly, if you use "Sign in with Google," Google sets its own cookies during that flow, governed by Google's own privacy policy - we don't control those.

7. AI Features & BYOK

Pentone offers optional AI-assisted vulnerability drafting. Key privacy considerations:

Bring Your Own Key (BYOK): You can configure your own API keys for AI providers. When you use your own key, data is sent directly to the provider under your existing agreement with them.
What is sent: Only template field schemas, vulnerability descriptions you provide, optional CVE/CWE references, and context from the current form. No passwords, session tokens, billing information, or other users' data is ever sent to AI providers.
When no key is set: If you do not configure your own key, no AI features are available. The system uses your API key exclusively - we never use a shared key for generation.
Prompt caching: Recent generation contexts are cached to reduce costs. Cached data is not shared across tenants.
Opt-out: AI drafting is entirely optional. You can use Pentone without ever enabling AI features.

8. Your Rights

Depending on your jurisdiction, you may have the following rights:

Right to access: Request a copy of the personal data we hold about you
Right to rectification: Correct inaccurate or incomplete data
Right to erasure: Request deletion of your data (subject to legal retention requirements)
Right to data portability: Export your data in a machine-readable format
Right to object: Object to processing of your data for specific purposes

To exercise any of these rights, contact us at [email protected]. We will respond within 30 days.

9. Children's Privacy

Pentone is not intended for users under the age of 16. We do not knowingly collect data from children. If you believe a child has provided us with personal data, please contact us to have it removed.

10. Changes to This Policy

We may update this Privacy Policy from time to time. Material changes will be communicated via email or through the platform. Continued use of Pentone after changes constitutes acceptance of the updated policy.

11. Contact

For privacy-related inquiries, contact us at:
Email: [email protected]
Pentone Systems Inc.