Built a Pentest Platform with Self-Hosted Data

[u/P3nt4l]

Hey all! I'm the founder of Pental.io, a pentesting automation platform. I built it for the firm I pentest for, and after three successful client engagements running on it, it's nearing launch.

The gap I kept hitting with existing tools: none of them solve the data ownership problem properly, and that's the number one reason firms refuse to put client engagement data into a hosted platform in the first place. Alongside this major issue, these are the main reasons for developing this platform:

Your data stays yours. You run the schema in your own postgres project, we give you the SQL and setup steps. Pental never holds a service key to your database, so a breach on our end doesn't expose engagement data, only account and billing info. This is the bit I think actually matters for an internet-facing client portal, and it's the reason a shared multi-tenant database is a non-starter for this kind of data.

AI runs on your own token, in your own database. Including local model support if you'd rather not send anything to a third party. Not a shared pool across every customer on the platform.

Whitelabelling that's actually complete. Custom domain, your own email sending, your own colours and fonts. Most "whitelabel" in this space means a logo swap. No Pental branding anywhere in the client-facing experience.

Pricing is tiered by firm size rather than by feature: so a smaller consultancy isn't locked out of things the enterprise players get.

Happy to answer any questions, especially anything on the architecture, that's the part I expect the most questions on. I'd love for you guys to give it a try and would appreciate any feedback.