Three plans,
no surprises

Yes — PenScan enforces ownership verification via DNS TXT records before any scan begins. You can only scan domains you demonstrably control. Additionally, users must accept a legal disclaimer confirming they have authorization to test the target. This makes PenScan both legally sound and ethically responsible.

A full combined scan typically completes in 15–30 minutes, depending on the size and complexity of your target. All seven scanners run concurrently — ZAP accounts for 35% of the scan weight and usually takes the longest. You'll receive a notification when results are ready.

One credit is worth $1 and powers approximately one full combined scan of a single target. A "full scan" runs all seven scanners simultaneously. Passive asset discovery (subdomain enumeration) on target creation is free and doesn't consume credits.

No. Credits never expire. Buy what you need now and use them at your own pace — whether that's tomorrow or six months from now.

Yes. PenScan supports team collaboration with role-based access control. Invite team members as Owners (full access), Analysts (can run and review scans), or Viewers (read-only access to reports). All roles operate within your organization's isolated workspace.

PenScan orchestrates seven industry-standard tools: OWASP ZAP (web app scanning), Nuclei (CVE & misconfiguration templates), Wapiti (SQLi, XSS, CSRF), Nikto (web server fingerprinting), SSLyze (TLS/SSL analysis), Nmap (port & service discovery), and Dalfox (advanced XSS fuzzing). Results from all tools are merged and deduplicated into a single report.

Absolutely. Each organization's data is isolated in a multi-tenant architecture — no other user or organization can access your targets, scans, or vulnerability reports. Data is encrypted in transit (TLS 1.3) and at rest.