Privacy Policy

1. Information about people using the service

• IP address, for rate limiting. When you request an assessment we compute a salted, one-way hash of your IP address to enforce per-client limits. We store only the hash, never the raw address, and delete it after 24 hours.
• Payment details for paid assessments. From the x402 payment you send we record the network, amount, asset and your paying wallet address, to keep revenue and dispute records. Public reports show only that a scan was paid and on which network. Your wallet address is never shown on reports or returned by our API. On-chain transactions are, by nature, publicly visible on the blockchain.
• Infrastructure logs. Our hosting provider processes standard request metadata (such as IP address, user agent, URL and time) to deliver and secure the service, and we keep short-lived operational logs for debugging and abuse prevention.
• Analytics. We use Cloudflare Web Analytics, which is cookieless and does not track individuals across sites.
• Email. If you contact us, we keep your message and address to respond and to keep a record of opt-outs and disputes.

2. Information about assessed websites

Assessments collect publicly available technical information about a domain: HTTP responses and headers, cookie attributes, public DNS records, scripts the homepage loads, contract addresses referenced in that code, and the results of our checks. This becomes a public report, kept indefinitely as part of the domain's history, together with the requested domain, timestamps and an activity trace of the assessment. We do not record who requested a particular assessment in any public form.

Reports describe websites, not people. If a page we fetch happens to contain personal information, we do not extract it into reports. Cookie values are never stored: we record only cookie names and attributes.

3. Service providers

We share the minimum data needed with:

• Cloudflare: hosting, database, queues, DNS, analytics, and the AI models that write report summaries from the findings;
• DNS-over-HTTPS resolvers: the domain names being assessed;
• Sourcify: contract addresses found in the assessed page's code;
• x402 facilitators (PayAI for Base and Solana, MeshGateway for Robinhood Chain): your signed payment, which they verify and settle.

We don't sell personal information or share it for advertising.

4. Cookies

Pentest Agent does not set cookies for tracking or advertising. Our infrastructure provider may set strictly necessary security cookies to protect the service from abuse.

5. Retention

• Hashed IP addresses: 24 hours.
• Payment records: as long as needed for accounting, tax and dispute purposes.
• Public reports: indefinitely, unless the domain owner opts out, in which case they are hidden from the service.
• Emails: as long as needed to handle your request and keep a record of it.

6. Your choices and rights

Depending on where you live, you may have rights to access, correct, delete or object to processing of your personal information. Because we don't run accounts, the personal data we hold is limited to the items above. To make a request, or to opt a domain out of assessments, email security@pentestagent.dev. Information recorded on public blockchains can't be changed or deleted by us or anyone else.

7. Security

We apply the practices we assess others on: HTTPS everywhere with HSTS, a strict nonce-based Content Security Policy, DNSSEC, and minimal data collection. Secrets are stored as encrypted platform secrets, and the assessment engine refuses private or internal network targets.

8. Children

The service is not directed to children under 16, and we don't knowingly collect their personal information.

9. Changes

We'll update this page when our practices change and revise the effective date above.

10. Contact

Privacy questions: security@pentestagent.dev.