Pay for targets, not for noise.

Frequently asked questions

• How does Pentrova pricing work?

  Every plan is priced per target, meaning one application. Start with a free pentest of your own app. Buy a one-off Pentest (₹34,999 + GST launch price, or $990) when you need a report for an audit, a client or a release. Choose Continuous (₹1,19,999 + GST or $2,999 a year) to test all year. Enterprise starts at 5 targets.
• Can I try Pentrova without talking to sales?

  Yes. Verify your domain and run one free pentest — one per verified domain each year, and one per workspace, no card needed. You see every finding, with the evidence it was confirmed on, in the app for 30 days. The PDF report, evidence exports and retest come with a Pentest, which you can buy for that same scan in one click.
• What counts as a target?

  One web application with one main hostname, the APIs it calls under the same login, one staging copy on a domain you have verified, and up to 3 user roles. A separate hostname with its own login is a separate target. The full definition is in the Terms.
• Can a consultancy test a client's application?

  Yes, with the client's consent. The client verifies their domain through an invite link and signs our authorisation letter. If they can't add a DNS record or a file, send us the signed letter and a short business reason, and we decide within one working day.
• What is fair use on Continuous?

  Each target includes up to 1 full pentest and 20 CI checks a month, plus retests of fixed findings. If you need more, we talk to you first. We never charge extra without your written agreement.
• What happens if I need to cancel?

  A yearly plan renews only if you tick renewal at checkout. We remind you 30 and 7 days before each renewal, and you can turn renewal off in one click. Refunds are explained in the Cancellation and Refund Policy.
• Can I pay monthly?

  Not at launch: Continuous is paid yearly. If you need testing for one month, buy a Pentest; move to Continuous for the same target within 30 days and its full price counts toward the year. A Pentest's price comes off a later plan only once. If paying for a year at once is hard, talk to us.
• How does Pentrova handle my data?

  Hosting, storage and AI inference run in AWS Mumbai (ap-south-1). A few sub-processors work outside India: Cloudflare's edge, CapSolver when a scan meets a CAPTCHA (you can turn this off), and Google or Microsoft if you sign in with them. Scan output can contain working credentials from your systems, so treat reports as sensitive. Retention and deletion follow the privacy policy and the DPA. A countersigned DPA is available on every plan.
• We already have a scanner — why add another tool?

  Most scanners score findings probabilistically, which is why AppSec queues grow faster than they shrink. Pentrova puts a finding in your queue only once AI review of the evidence captured from your target confirms it, so you are not adding a second queue — you are retiring the unconfirmed half of the first one. The product is engineered so backlog should shrink as Pentrova lands, not expand.
• Aren't you too expensive compared to free open-source tools?

  Free scanners are excellent at what they do. Pentrova replaces the human hours teams spend triaging and reproducing probabilistic findings, not the scanners themselves. The pricing is set so a confirmed finding costs less than the engineering time a queue of unconfirmed alerts would consume.
• We're a ten-person team — isn't Pentrova overkill?

  Small teams are the teams that benefit most from confirmed findings, because they cannot afford to read every probabilistic alert. You can start with a single application and no procurement review, and the pricing page lists exactly what each plan includes.
• Our auditor requires a pentest report — can Pentrova satisfy that?

  Pentrova generates a compliance-mapped PDF report plus per-finding evidence exports, so audit teams have the evidence per control. Pentrova maps each finding to ISO 27001:2022, PCI DSS v4.0.1 Requirement 11.4, the HIPAA Security Rule and GDPR Article 32. The mapping is evidence for your auditor. It is not a certification, an attestation or legal advice, and acceptance is your auditor’s decision. Pentrova is not a CERT-In empanelled auditor.
• Integrating yet another tool costs us weeks — how painful is Pentrova?

  Notification routing (Slack, Microsoft Teams, Discord, email, custom webhook) is a tenant-admin form, not custom code. CI gating ships as drop-in templates for GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, and Bitbucket.
• Our stack is unusual — GraphQL, gRPC, WebSockets, Protobuf. Does Pentrova handle it?

  Pentrova parses OpenAPI, Postman, GraphQL, Protobuf, and WSDL natively, and authenticated sessions support bearer, API-key, basic, OAuth 2.0, custom script-driven schemes, and mTLS. Novel protocols drop in through the same schema the first-class integrations use, so an "unusual" stack is usually just a configuration file.
• We already run manual pentests — why automate?

  A manual pentest tests one scope in the window it is booked for. Pentrova runs a pentest every time you start one, on a schedule or from your CI pipeline: attack-chain analysis, cross-role authorization testing, and confirmed findings with the evidence captured from your target, which engineering can check any day of the quarter, and a compliance-mapped report your auditor can read.
• Will running Pentrova break production?

  Destructive payloads and methods are blocked by default, request rates are limited, and one test runs at a time on each target. Automated testing can still change data or trigger alerts, so test a staging copy where you can, and take backups before testing production.
• Do you sell or train on our data?

  No. Customer scan data is never used to train models, never sold, and never shared with third parties beyond the named subprocessors. It is encrypted at rest and in transit, and the DPA names the one internal hop that is not. Scan output can contain working credentials and personal data captured from your systems: Pentrova masks the secrets it recognises in exports and the live scan view, but does not remove personal data. Retention is set out in the platform privacy policy and the DPA.
• What happens to our evidence if Pentrova shuts down?

  Findings in a downloaded report carry the captured request and response where there is one, and your engineers can copy it as a cURL command and re-send it themselves. Re-sending it does not depend on Pentrova, so the evidence stays valid in whatever ticketing or audit system it already lives in — there is no lock-in on the evidence. Turn renewal off in one click and your plan keeps working until the end of the year you paid for. If a renewal payment is late, everything keeps working through a grace period; after that the plan pauses — your findings stay visible, and scans, CI checks, retests and downloads resume as soon as it is paid. When a plan ends, your findings and reports stay in your workspace while your account is open. If you close your account, its data is deleted 90 days after it closes.
• How fast will my team see real value?

  Setup is short: sign up, verify that you control the target’s domain, configure the target and start a pentest. Scans are queued and their length depends on the application, so there is no fixed time to results. Every finding in your queue was confirmed by AI review of evidence captured from your target and carries that evidence, so engineering can start fixing straight away.