The plans differ by capacity and nothing else. There is no feature behind a higher tier, no add-on, and no module you have to buy back. Upgrading changes a number, so the product one tester tries in week one is the product a fifty-seat consultancy is still using.
Six rungs, from one tester to fifty seats and a thousand clients, with twenty client records per seat on every one. Move up or down any time, pro-rated, from your own dashboard. The database stays yours whichever plan you are on, and whether you are on one at all.
The whole platform for a person working alone. Your own database, your own brand, your own reports.
The whole platform for a firm of two or three, on your own database.
Room for the testers, a reviewer and whoever runs the sales side.
Twenty-five seats and five hundred client records, with every engagement, review and retest on one system.
Fifty seats and a thousand client records. The same platform the Solo plan runs on, with more room.
The same platform with the limits removed, and we set it up with you: branding, domain, email, templates and methodology.
Prices include tax. Billed monthly. Cancel any time. Your database is yours either way.
Two numbers, and the onboarding. Everything below this is identical on all six, which is why the feature table that follows has one column.
| Capacity | Solo | Starter | Team | Professional | Premium | Enterprise |
|---|---|---|---|---|---|---|
| Internal usersTesters, reviewers, sales and management. Client accounts are not internal users and never count against this. | 1 | 3 | 10 | 25 | 50 | Unlimited |
| ClientsOrganisations you hold records for. Their own people sign in against the client, not against your seat count. | 20 | 60 | 200 | 500 | 1,000 | Unlimited |
| AssessmentsEngagements, phases and retests. There is no per-project charge on any plan. | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
| Findings and evidenceIncluding screenshots and attachments, because they are stored in your own database rather than ours. | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited | Unlimited |
| File storageNo storage tier to outgrow. What it costs is what your own hosting charges you for the space. | Your database | Your database | Your database | Your database | Your database | Your database |
| OnboardingEvery plan gets the guided setup in your Pental account. Enterprise gets a team that builds your instance with you. | Guided setup | Guided setup | Guided setup | Guided setup | Guided setup | Done with you |
Evidence, screenshots, files and generated documents live in the Postgres database you created, so there is no storage tier for us to sell you. A firm with ten years of engagements and a firm in its first month are on the same terms here.
All 48 of them, grouped the way the platform is. One column, because every plan has every one of them: that is the argument this page exists to make.
| Feature | All six plans |
|---|---|
| Engagements | |
| Structured scopingClients answer a scoping form in their own portal, and the answers land attached to the engagement. | |
| Phased engagementsExternal, internal, web, retest, or whatever shape the work takes, each with its own dates, testers and checklists. | |
| Assignment and schedulingTesters assigned per phase, with assessments able to start and complete on their scheduled dates. | |
| Client credentials, collected safelyAccess credentials arrive encrypted and one-time view, attached to the engagement rather than an email thread. | |
| Your password managerTesters send what a client shared to 1Password, Bitwarden, Passbolt and Keeper in one click from your own gateway, or into their own KeePass file or HashiCorp Vault. | |
| Testing source addressesYour public testing IPs carried onto your reports automatically for whitelisting. | |
| Checklists and runbooksMethodology written once in settings, attached per phase, with tick progress on the phase itself. | |
| Engagement timelineScope answered, phase started, finding written, review signed off, report released, retest requested, all on one record. | |
| Findings and AI | |
| Generate all from evidenceOne action drafts title, description, remediation, CVSS, CWE, category, assets, custom fields and references, several at once in the order each needs, and captions the screenshots. One undo puts it all back. | |
| Per-field generationEvery field has its own generate button, so one thing can be redone without touching the rest. | |
| Your own provider keyOpenAI, Anthropic or Groq on your account, under your terms, encrypted inside your own database. | |
| Local and self-hosted modelsOllama on your own hardware, or any compatible endpoint you host, so nothing leaves your network. | |
| Editable prompts, no hidden onesEvery generated field and section uses a prompt you can read and rewrite, with a reset to the shipped default. | |
| CVSS scoringThe vector is derived as you toggle metrics, so the score and the string cannot disagree. | |
| Custom finding fieldsAdd the fields your methodology carries, each with its own control type and its own AI prompt. | |
| Findings librarySave a write-up once and reuse it, with scoring and remediation intact, improving every time someone edits it. | |
| Rich evidence editingEvidence blocks, images, tables and code, with clean paste from Word that keeps your formatting. | |
| RetestsEvery finding tracked as fixed, still open or newly introduced, as a delta rather than a rewrite. | |
| Documents | |
| Built-in PDFEditable from your branding: fonts, logo, colours and layout, with nothing to upload and no Word skills needed. | |
| Custom Word templatesYour own DOCX with your cover page, headers, fonts, tables and appendices. The platform fills your document. | |
| The report builderUpload a document, click to place what goes where, say what repeats, and build the template visually. | |
| Deterministic renderingThe same engagement produces the same file, byte for byte, so this quarter sits next to last quarter cleanly. | |
| Edit in Word, read it backUpload the edited document and the assessment updates to match, item by item, only where you tick. | |
| Executive and retest summariesDrafted from the findings actually present in the assessment, then edited by a human. | |
| Your own document typesThe report and the attestation letter, each with its own template and defaults. | |
| Your file namingGenerated files follow your own naming convention, so what reaches a client matches your archive. | |
| Client portal | |
| Standing client accountsClients keep every report, finding, retest outcome and attestation letter, between engagements as well as during them. | |
| Release controlFindings reach a client when you release them, not when you save them. | |
| Comments in contextQuestions are raised against the finding they concern rather than arriving as a separate thread. | |
| Retest requestsA client can ask for the retest from the report they are reading, and it becomes a scoped phase on your side. | |
| Attestation lettersThe letter a client’s auditor asks for, generated rather than written from scratch. | |
| Structured feedbackEnd-of-engagement feedback, with a nudge towards a public review when it is glowing. | |
| Your brand | |
| Your own domainportal.yourfirm.com, with TLS issued and renewed automatically. | |
| Your sign-in pageYour logo, your colours, your wording. A client never sees a Pental login. | |
| Both themes, your paletteLight and dark, your colours and fonts, applied everywhere including the documents. | |
| Email from your addressYour own SMTP relay, or Google or Microsoft OAuth, with a test send before you commit to it. | |
| No trace of usNo badge, no footer credit, no powered-by, anywhere a client or your own team can look. | |
| Security and access | |
| Your own databaseOne Postgres database per firm, in your own cloud, on a server of yours or on Supabase Cloud, each with a full setup guide, and a move between them whenever you like. | |
| Row-level security115 policies, with row-level security on 97 tables, evaluated by Postgres on every query. | |
| Freshness-gated MFAEvery data-access policy also demands a recent second factor, required by 105 policies in all. | |
| Passkeys and authenticator appsMandatory second factor, an any or all policy across two methods, with sessions listable and revocable. | |
| Google and Microsoft SSOOr emailed one-time codes if you would rather run passwordless. | |
| Roles by seniorityAdmin, senior, standard, sales and marketing internally, and client accounts locked to their own organisation. | |
| Secrets encrypted at restNine secret columns encrypted on write inside your own database, with a key generated in that same database. | |
| Running the firm | |
| Issue trackersPush findings into a client’s own Jira, ServiceNow or GitHub and read the state back, the calls made from your own database rather than Pental’s servers. | |
| Dashboards and notificationsPer-role dashboards and per-event switches, including Slack and Teams. | |
| Modules you can switch offThe library, the testing calendar, feedback and the dashboards each leave the interface entirely when off. | |
| Full backup and restoreExport the whole portal as one archive, files included, and restore it into a fresh project. | |
Seven days, the whole product, no card. The database you create stays yours either way.
Enterprise removes the limits and adds people rather than features. The price is agreed per firm, because what it includes is work rather than a licence tier, and that work is different every time.
Yes. Every self-serve plan starts with a seven-day free trial and no card is needed. The trial includes every feature, because every feature is on every plan, so what you try is exactly what you would go on to pay for.
Only by capacity. There are six self-serve plans, from a solo tester upwards, and they differ by the number of internal users and clients your firm can have. Every feature is on every plan, and Enterprise sits above them for firms that need more.
Yes. The smallest self-serve plan is for one tester, and it carries every feature the largest plan has, including the white-labelled client portal, AI on your own key and checklists. Moving up a plan adds internal users and clients rather than features.
Yes. Every portal runs on a database your firm owns: PostgreSQL in your own cloud, self-hosted Supabase or Supabase Cloud. You can start on one and move to another later with everything in it, so the first choice does not lock you in.
Seven days free on whichever plan fits, no card, and every feature in the table above from the first minute. A growing firm moves up one rung at a time, pro-rated. If the shape of your firm needs a conversation instead, book a demo and we will walk through it.