Security & Responsible Testing
How Pentriarch keeps your infrastructure safe during validation - and what we commit to you as an organization.
How Testing Is Performed
Pentriarch performs external security validation - simulating attacker reconnaissance and exploitation techniques against systems you explicitly authorize. All testing is orchestrated by an AI engine that operates strictly within the scope you define and approve. No testing commences without confirmed, explicit customer authorization.
All testing is conducted from external Pentriarch infrastructure. No agents, scripts, persistent processes, or software are installed within your environment. Testing is entirely non-persistent - when a session ends, all activity ceases completely with no residual presence.
Safe Exploitation - What It Means
“Safe exploitation” means Pentriarch confirms whether a vulnerability is reachable and exploitable - far enough to demonstrate real, evidence-backed risk - without fully weaponizing it or causing harm. We go precisely as far as is needed to validate the attack path, not to cause damage, exfiltrate data, or expand access beyond what is necessary.
We confirm the issue exists, is reachable, and is genuinely exploitable.
We never retrieve, extract, or store your data under any circumstances.
Full chain from initial entry point to validated risk, with technical evidence.
We stop at the point of validation - exploitation beyond proof is never performed.
Findings documented in a form suitable for engineering teams and external auditors.
No denial-of-service, no downtime, no data modification or loss.
Legal Authorization Requirement
Pentriarch operates exclusively as an authorized testing agent of the customer. Security testing is lawful when the asset owner explicitly authorizes it. Pentriarch will never test systems without confirmed, written authorization from the party responsible for those systems.
Before testing begins, every customer confirms the following:
- They own or hold documented permission to test all specified target assets.
- Security testing has been approved by appropriate internal stakeholders, including legal and information security functions where required.
- The scope definition has been reviewed, understood, and formally accepted.
- Their hosting or cloud infrastructure provider has been notified where required under their terms of service.
Responsible Disclosure
All findings are disclosed exclusively to the customer who authorized the test. Pentriarch does not disclose findings to third parties, regulators, or the public without the explicit written consent of the authorizing customer, except where required by applicable law or a valid legal process.
If testing reveals issues that affect third parties - such as shared hosting environments, supply chain components, or SaaS dependencies - we inform the authorizing customer and recommend appropriate disclosure steps in line with industry responsible disclosure norms. Pentriarch does not unilaterally disclose to third parties or contact affected parties without customer instruction.
To report a vulnerability in Pentriarch itself, please contact: security@pentriarch.com
Data Handling During Testing
No sensitive production data stored
Pentriarch does not store sensitive data encountered during validation. Scan evidence is strictly limited to attack path proof - not payload content, extracted records, or personal data.
Findings encrypted at rest
All scan results and generated reports are encrypted in our database using industry-standard encryption. Access is restricted to authenticated users with appropriate role-based permissions.
Full audit logs retained
Scan activity logs are retained to provide complete, tamper-evident audit trails. Customers can export their logs at any time for compliance or incident investigation purposes.
Data deletion available on request
Customers may request deletion of their scan data at any time. Submit requests to privacy@pentriarch.com - we action deletion requests promptly and confirm completion.
How to Stop Testing Immediately
You can pause or stop all testing activity at any time, without prior notice or justification required:
From the platform console
Open the Pentriarch dashboard and use the Stop button on any active scan. Testing ceases immediately.
By email
Email security@pentriarch.comwith subject “STOP TESTING”. We acknowledge all suspension requests within 1 hour and halt all activity immediately upon confirmation.
Pentriarch Safety Principles
Satisfied with our security and responsible testing posture?
Apply for Early Security Validation Pilot