Provable authorization
Ownership challenges, signed scope, and a tamper-evident proof pack — the artifact that separates testing from trespass.
Loading…
Penetration testing you can prove.Reports you can defend.
- Ownership verified by record
- Signed authorization
- Complete audit trail
The record
One engagement, three steps, no gap between them.
Authorization, testing, and delivery live in the same record. If a control has not been connected, the screen says so rather than implying coverage.
- 01
Authorize
Prove control of the target with a DNS TXT or HTTP challenge, then capture scope, window, and sign-off as a single record.
- 02
Test
Run against that record. Time windows, scanner IP validation, and an emergency stop gate every action at the source.
- 03
Deliver
Findings carry CVSS, CWE, evidence, and compliance mapping into one exportable deliverable your client can defend.
Capabilities
Built for the work that has to survive review.
Safe-scan gate
Testing windows, source validation, and an emergency stop. Nothing runs outside the authorization you recorded.
Broad scan ingestion
Nuclei, Nessus, Tenable, Qualys, Rapid7, Burp, OpenVAS, Nmap, Acunetix, SARIF, and CSV normalize into one finding model.
Deduplicated findings
Cross-scanner dedup keys on asset, weakness, and severity so the same issue from three tools is one line in the report.
Compliance mapping
Map each finding to SOC 2, ISO 27001, and PCI DSS controls without re-labelling evidence by hand.
Audit-first by design
Every authorization, run, and export lands in the activity trail with actor and timestamp attached.
Where the evidence lives
A record, not a brochure.
Findings carry the tool they came from, the asset they hit, their CVSS and CWE identifiers, and the control they map to. Exports are reproducible from the same underlying data, not retyped for a deck.
Attached to every engagement
- Verified asset ownership
- Signed authorization scope
- Enforced testing window
- Normalized scanner findings
- Compliance control mapping
- Immutable activity trail
Who’s behind it
Built to be inspected, not just trusted.
PentSeal is an early-access product from a small security team. We don’t run stock customer logos to win a deal — we’d rather you check our posture, our uptime, and who is building this before you trust us with an engagement.
Free, no signup
Start with the paperwork, not a sales call.
The authorization record is the part of an engagement that is easiest to get wrong. Generate it and take a copy of the letter, without an account.
Free pentest scope generator
Fill in scope, signer, testing window and prohibited actions, then download a signed-ready scope and authorization document as .docx or .pdf. Built in your browser — nothing is uploaded.
Authorization letter template
The letter-format record of permission a tester relies on: who authorised what, against which assets, for how long, and how to stop it.