Last updated: July 15, 2026

Pentone is built from the ground up as a security-first platform for VAPT teams. This page describes our security architecture, practices, and compliance measures.

1. Architecture Overview

Pentone uses a microservices architecture with strict service boundaries. Each service owns its data and communicates via defined APIs through an API gateway. Key components:

Auth Service - Authentication, user management, MFA, RBAC, session management
VAPT Service - Vulnerability management, CVSS scoring, report generation, AI drafting
Project Service - Workspace, project, and team management
BFF Service - Backend-for-frontend composition and data enrichment
API Gateway - Request routing, rate limiting, CORS enforcement

2. Encryption

2.1 Data in Transit

All external traffic is encrypted using TLS 1.3
Internal service-to-service communication uses HTTP within a private Docker network
Service-to-service calls are authenticated via internal service tokens

2.2 Data at Rest

Passwords: Hashed with bcrypt (12 rounds) - never stored in plaintext
Password history: Encrypted with Fernet symmetric encryption (AES-128-CBC)
MFA secrets: Encrypted with Fernet
API keys: Stored as encrypted environment variables
Database: MongoDB Atlas encryption at rest available
File storage: S3 server-side encryption available when using S3-compatible storage

3. Authentication & Access Control

3.1 Authentication Methods

Email/password with bcrypt hashing
Google OAuth 2.0 (scopes: openid, email, profile)
JWT-based stateless authentication (HS256)
Access tokens: 8-hour expiry with refresh token rotation (7-day expiry)
Token blacklisting via Redis for immediate revocation

3.2 Multi-Factor Authentication (MFA)

TOTP-based MFA compatible with Google Authenticator, Authy, and similar apps
10 backup codes generated per user for account recovery
MFA status checked during login flow

3.3 Role-Based Access Control (RBAC)

Pentone uses a hierarchical role system with granular permissions:

Workspace roles: Owner, Collaborator, Member, Guest
Project roles: Owner, Collaborator, Member, Guest
Permission categories: workspace, project, vulnerability, report, task, asset, knowledge_base, template, member, security
Roles define permissions at runtime - permissions are never stored per-user

3.4 Password Policy

Minimum 8 characters with uppercase, lowercase, digits, and special characters required
Password history: Cannot reuse last 5 passwords
Password expiration: 90 days (configurable)
Account lockout: 10 failed attempts triggers 5-minute lockout

4. Multi-Tenant Data Isolation

Every document in every service carries a tenant_id field
All database queries filter by tenant ID to prevent cross-tenant access
File storage paths enforce tenant prefix isolation
Signed file URLs include tenant validation
Enterprise BYODB option provides complete database-level tenant isolation

5. Rate Limiting

Rate limits are enforced to protect against abuse:

Login: 10 requests per 60 seconds
Registration: 5 requests per 60 seconds
Password reset: 5 requests per 60 minutes
Token refresh: 10 requests per 60 seconds
MFA endpoints: 10 requests per 60 seconds
General API: Configurable per-endpoint limits

6. Audit Logging

Auth service: All security events logged (logins, password changes, account lockouts, role changes) with 90-day retention
VAPT service: Immutable audit trail for all vulnerability operations (create, update, delete) including old/new values, user ID, IP address, and timestamp
Audit logs include: tenant_id, workspace_id, user_id, timestamp, action type, and relevant context

7. Session Management

Active sessions tracked with device information, IP address, and user agent
Maximum 5 concurrent sessions per user (configurable)
24-hour inactivity timeout for automatic session expiry
Users can view and revoke active sessions from their security settings
Session revocation triggers immediate token blacklisting in Redis

8. File Security

File upload validation: Magic bytes checking, content-type verification, path traversal prevention
Allowed image types: .jpg, .jpeg, .png (max 10 MB)
Allowed template types: .docx, .html, .htm, .md, .txt (max 10 MB)
File downloads protected by HMAC-SHA256 signed URLs with 60-minute expiration
All file paths enforce tenant isolation

9. Infrastructure Security

HTTPS enforcement with HSTS (Strict-Transport-Security: max-age=31536000; includeSubDomains)
Security headers: X-Content-Type-Options: nosniff, X-Frame-Options: DENY, X-XSS-Protection
CORS configured with specific allowed origins in production
Docker container isolation for microservices
Input validation via Pydantic schemas on all endpoints
XSS prevention through comprehensive input sanitization

10. AI Security

Bring Your Own Key (BYOK): AI features use your API keys, not a shared key
Only vulnerability field schemas and descriptions are sent to AI providers - never passwords, tokens, or other users' data
Optional image attachment with allowlisted URL validation
Prompt caching is tenant-isolated
AI features are entirely optional and disabled by default

11. Vulnerability Disclosure

If you discover a security vulnerability in Pentone, please report it responsibly to [email protected]. We aim to acknowledge within 48 hours. This is not a paid bug bounty; validated findings may receive recognition and available merchandise. Full scope, rules of engagement, and reporting guidance are on our Vulnerability Disclosure Program page. We ask that you:

Do not publicly disclose the issue before we have addressed it
Do not access or modify data that does not belong to you
Do not perform tests that could degrade service availability
Provide sufficient details to reproduce the issue

12. Compliance

Pentone is designed with GDPR, SOC 2, and ISO 27001 principles in mind. Specific compliance certifications may be available for Enterprise customers. Contact [email protected] for compliance-related inquiries.

13. Contact

For security-related inquiries:
Email: [email protected]
Pentone Systems Inc.