Compliance-mapped reports, on every pentest.

Outcomes a compliance program can ship

• Compliance-mapped reports for ISO 27001, PCI DSS, HIPAA, and GDPR

  Every Pentrova engagement produces a compliance-mapped PDF report plus per-finding evidence exports (cURL, raw HTTP, Markdown and HAR). Each finding is tagged to the relevant PCI DSS v4.0.1, ISO 27001:2022, HIPAA Security Rule, and GDPR controls so audit packets land with the evidence already routed per control.

• Evidence that holds up in an audit

  Auditors want to see what was found and how. Every finding in your queue was confirmed by AI review of evidence captured from your target, and that evidence exports in a click (cURL, raw HTTP, Markdown, HAR) instead of needing a re-run against a shifted production state.

• Retention stated in the published policies

  Findings and reports are kept while your account is active, a closed account’s data is deleted 90 days after it closes, and backups are weekly copies kept for 35 days, plus point-in-time restore over the last 7 days; there are no monthly copies. The schedule is published in the platform privacy policy and the DPA, not negotiated per engagement, so you can plan documentation windows around it. Scheduled deletion is not automated yet; until it is, data is deleted on request.

Capabilities mapped to ISO 27001, PCI DSS, HIPAA, and GDPR

• ISO 27001 Annex A alignment

  Pentrova engagements map onto ISO 27001:2022 A.8.8 (technical vulnerability management), A.8.29 (security testing in development and acceptance), and A.5.36 (compliance with policies, rules, and standards) so surveillance audits can pull evidence per control.

  Open ISO 27001 Annex A alignment →

• PCI DSS Requirement 11.4 evidence

  Requirement 11.4 — penetration testing (PCI DSS v4.0.1). Continuous and scheduled pentests give your assessor penetration-testing evidence between annual assessments instead of only the week before.

  Open PCI DSS Requirement 11.4 evidence →

• HIPAA Security Rule §164.308(a)(8)

  The HIPAA Security Rule requires periodic technical evaluation. Pentrova produces evaluation evidence: confirmed findings and attack chains against PHI-handling endpoints, with the evidence captured from your target, kept for the periods set out in the platform privacy policy.

  Open HIPAA Security Rule §164.308(a)(8) →

• GDPR Article 32 testing evidence

  Recurring pentests, with every finding confirmed on evidence captured from your target, give you a record that technical measures around personal data are "tested, assessed, and evaluated on a regular basis" (GDPR Article 32(1)(d)).

  Open GDPR Article 32 testing evidence →

• Attack chains as risk documentation

  A curated escalation catalog plus dynamic LLM-built chains produce named, citable impact paths, each built from confirmed findings and their captured evidence.

  Open Attack chains as risk documentation →

• Sandbox PoCs for audit packets

  Audit packets can include real exploit evidence. Pentrova masks the secrets it recognises, but it does not remove personal or cardholder data from scan output, so share packets as sensitive documents.

  Open Sandbox PoCs for audit packets →

• Notification + CI gating that match your workflow

  Findings flow into Slack, Microsoft Teams, Discord, email, and custom webhooks. CI templates ship for GitHub Actions, GitLab CI, Jenkins, CircleCI, Azure Pipelines, and Bitbucket so control owners receive evidence where they work.

  Open Notification + CI gating that match your workflow →

Export the audit pack.

Run a pentest against your application and export the control-mapped PDF report. The report aligns findings with ISO 27001, PCI DSS, HIPAA, and GDPR controls — no manual mapping required.