Terms of service

1. What Pentrail is

Pentrail (pentrail.towers.app) runs automated external security tests of websites and domains and writes reports about them. It runs on Towers (towers.app). In these terms “we” means Pentrail and “you” means the person using it or buying a report, and the organization they act for.

2. The free scan

Anyone may run the free scan on a public website. It makes only ordinary requests any visitor makes. Don’t use it to harass a site’s owner, to scan at a rate meant to disrupt, or to get around our limits.

3. Authorization for the deep test

You may order a deep test only of a domain you own or are authorized in writing to have tested. By verifying a domain you confirm that you have that authority, including over any subdomain the test covers, and that the test doesn’t breach an agreement you have with a hosting provider or other third party. You are responsible for the authorization you give. Our authorized testing policy is part of these terms.

4. What you buy

One report costs $20 (US dollars), paid once through Stripe, for one domain as verified. It includes the deep test, the report and its PDF, a letter of attestation and up to three retests within 30 days of payment. There is no subscription.

5. Refunds

You verify the domain before you pay, so a paid test always runs. If you’re not happy with the report, write to hello@pentrail.thetowers.ai within 30 days of payment and we will refund the full amount.

6. What the report is and isn’t

The report describes what an automated, non-destructive external test found at the time it ran. It isn’t a guarantee that your systems are secure, that no other weaknesses exist, or that an auditor, customer or regulator will accept it for any purpose. It doesn’t make you compliant with SOC 2 or any other standard. Testing behind a login, business logic, internal networks and social engineering are outside its scope.

7. The letter of attestation

The letter states the scope, method, dates and results of the test as they were. Don’t alter it or present it as covering anything it doesn’t. Anyone with its link can check its number, domain, date and result summary; the findings stay private.

8. Care in testing

We design the tests not to change data or disrupt service, and we pace them. Any test of a live system carries some risk. To the fullest extent the law allows, we aren’t liable for indirect or consequential losses arising from a test you authorized, and our total liability for a report is limited to what you paid for it.

9. Confidentiality

Your report is available only to whoever holds its private link. Keep the link private: anyone with it can read the report. We don’t publish or sell your findings. See our privacy policy.

10. Changes and contact

We may update these terms; the date above changes when we do. Questions: hello@pentrail.thetowers.ai.