Skip to content
PentAGI

Legal

Privacy Policy

Last updated: 11 October 2026

PentAGI is an ethical security testing tool designed exclusively for lawful use and requires explicit authorization from the system owner before any testing activities can commence.

Limitation of liability

  • PentAGI is provided “as is” without any warranties of any kind, either express or implied.
  • The creators and developers disclaim all liability for any unauthorized or unlawful use of the tool.
  • Using PentAGI for unauthorized access or attacks is strictly prohibited and may result in legal consequences.
  • Users assume full responsibility and liability for all actions performed using this tool.

Authorized use

PentAGI may only be used for:

  • Authorized security testing with explicit written permission.
  • Testing of your own infrastructure where you have full authority.
  • Educational purposes in controlled environments.
  • Ethical hacking activities with documented authorization from the system owner.

Data processing in PentAGI

  • Local processing: all core operations are executed within your infrastructure.
  • Data control: you maintain full control over all data and testing results.
  • Isolation: each test runs in an isolated container for enhanced security.
  • LLM integration: interactions with AI providers are configured and controlled by you.
  • Update checks: within two minutes of starting and then every three hours, the server reports its version, platform and a summary of its configuration and usage — provider types, feature switches and counts, no flow content — to update.pentagi.com, tagged with its installation ID and license key, if one is set. Set UPDATE_CHECK_INTERVAL=0 to turn this off. Each time the installer starts and after each action it runs, such as Apply Changes, Update, Start or Stop, it sends the installed images and the state of each stack, plus the same summary while PentAGI is running; UPDATE_CHECK_INTERVAL does not affect it.

AI service providers

PentAGI integrates with large language models through the providers you configure — cloud APIs, gateways or locally hosted models — and through an optional Langfuse integration for monitoring the data transmitted to LLM providers. You are responsible for complying with the terms of service and data handling policies of the providers you choose.

External services

PentAGI sends the agents' search queries to the web search engines it is set up to use. DuckDuckGo is enabled by default; DUCKDUCKGO_ENABLED=false turns it off. You must comply with the terms of service and privacy policies of the search engines you use. Data transmission to these services is configurable and controlled by you.

This website

  • Server logs. Our hosting provider may log standard request metadata (IP address, user agent, timestamp, URL requested) for security and operational purposes.
  • Embedded video. The product overview video is hosted on YouTube. It loads from youtube-nocookie.com only after you press play, and from then on YouTube's privacy policy applies.
  • Cookies. We use Google Analytics 4 to collect anonymous, aggregated usage statistics. Analytics cookies (_ga, _ga_*) are only set after you explicitly accept the consent banner. The Google tag itself is loaded only after you accept: until then, and after you reject, no analytics cookies are written and nothing is sent to Google. Your choice is stored locally under pentagi:cookie-consent in your browser. You can change your mind at any time via the Cookie preferences link in the site footer.
  • Language. When you pick a language or follow a language suggestion, your choice is stored for a year in a lang cookie on pentagi.com, which the PentAGI Console on console.pentagi.com can read, and under lang in local storage. Closing the suggestion is remembered under pentagi:language-hint-dismissed.

Ask AI

  • What is sent. When you ask a question, your browser sends it to the pentagi.com server together with up to seven earlier messages of the open chat — your questions and the answers — and the address of the page you are on.
  • Where it goes. pentagi.com is served through Cloudflare, so the request passes through Cloudflare's network on its way to our server. The server looks up matching passages in the documentation and sends the conversation, those passages and, on documentation and Enterprise pages, the page path to a model gateway operated by VXControl, which forwards them to Alibaba Cloud Model Studio in its international region (Singapore) to generate the answer. Alibaba Cloud processes the request under its own terms.
  • What is logged. For each question the pentagi.com server writes one log line with the time, the outcome, the number of messages and search steps, the token counts, the response time and a hash of your IP address that changes whenever the server restarts. The text of questions and answers is not logged. The web server also logs the request itself, as described under Server logs above. Log files are rotated by size and not archived. The gateway records usage per request to enforce spending limits.
  • In your browser. The questions and answers are kept in session storage under pentagi:ask-ai-conversation for the open tab: they stay when you move between pages, reload or change the language, and are removed when you clear the chat or close the tab. A question you have typed but not sent is kept in local storage under __ai_search_input until you send it or delete the text.
  • Do not paste secrets, credentials or confidential data into the chat.

Security

While PentAGI implements security measures and isolation mechanisms, users must ensure:

  • A secure runtime environment.
  • Proper access control and authentication.
  • Comprehensive activity monitoring.
  • Compliance with applicable laws and regulations.

Policy updates

We reserve the right to modify this policy at any time. Users will be notified of any changes through the project repository. Continued use of PentAGI constitutes acceptance of the updated policy.

Contact

For security concerns and compliance inquiries: [email protected]