---
title: "SpectrAI documentation"
description: "SpectrAI guides, tutorials and reference: domain ownership proof, Guidance, internal relay, findings, reports, retests, orders and partner spaces."
url: https://docs.spectr-ai.eu/en
markdown: https://docs.spectr-ai.eu/en.md
language: en
alternate_fr: https://docs.spectr-ai.eu/
updated: 2026-11-04
index: https://docs.spectr-ai.eu/llms.txt
---

# SpectrAI documentation

> Everything you need to prepare, launch and use an external pentest or an internal scan: domain ownership proof, Guidance, the relay, findings, the report, retests, orders and partner spaces. Every page states what the product does today.

Every page also exists as Markdown: append `.md` to its address, or request it with the `Accept: text/markdown` header. The index of every page for assistants: https://docs.spectr-ai.eu/llms.txt

## [Getting started](https://docs.spectr-ai.eu/en/demarrer.md)

> What SpectrAI does, the notions to know, the first pentest end to end and the product vocabulary.

- [Introducing SpectrAI](https://docs.spectr-ai.eu/en/demarrer/presentation.md): An autonomous pentest of a named application, external or internal, with verified evidence, a frozen report and correction retests. What it is, who it is for, and its limits.
- [Key concepts](https://docs.spectr-ai.eu/en/demarrer/concepts.md): Target, ownership proof, Guidance, pentest, attempt, findings, evidence, attack paths, report, retests: how these objects fit together in SpectrAI.
- [Your first pentest](https://docs.spectr-ai.eu/en/demarrer/premier-pentest.md): From signup to the report: create the account, register the application, prove the domain, write the Guidance, launch the pentest, read the results and prepare the retests.
- [Glossary](https://docs.spectr-ai.eu/en/demarrer/glossaire.md): The terms used in the application, the reports and this documentation, with their short definition and a link to the page that details them.

## [External pentest](https://docs.spectr-ai.eu/en/pentest-externe.md)

> Test an application from the Internet: prove control of the domain, write the Guidance, prepare and launch the pentest, understand what happens during the test, follow its activity up to the report.

- [Verify the domain](https://docs.spectr-ai.eu/en/pentest-externe/verifier-le-domaine.md): Prove that you control an application's domain through an HTTPS file or a DNS TXT record, understand the time limits and resolve verification failures.
- [Write the Guidance](https://docs.spectr-ai.eu/en/pentest-externe/guidance.md): Give the agents the context of an application: attack surface, priorities, strategy and prohibited techniques, evidence requirements and stop conditions, OpenAPI or Postman documents and test accounts.
- [Launch a pentest](https://docs.spectr-ai.eu/en/pentest-externe/lancer-un-pentest.md): Prepare a pentest on a verified target: choose and order the authorised URLs, provide test accounts, set the guardrails, accept the five attestations, launch, and understand what is deducted.
- [During the test](https://docs.spectr-ai.eu/en/pentest-externe/pendant-le-test.md): What happens on your application during a SpectrAI pentest: real traffic, test data, alerts, firewalls and CDNs, the recommended environment, prohibited techniques and what the guardrails do or do not guarantee.
- [Follow the activity](https://docs.spectr-ai.eu/en/pentest-externe/suivre-l-activite.md): Read the page of a running pentest: the four phases, the duration and latest end time, the test plan, the surfaces tested, the last activity, cancelling and resuming.

## [Internal scans](https://docs.spectr-ai.eu/en/scans-internes.md)

> Test private applications from inside your network: the relay, its installation, the mandate that bounds the tests and the launch of an internal scan up to the automatic report.

- [The relay](https://docs.spectr-ai.eu/en/scans-internes/relais.md): How the internal scan relay works: an agent installed on your side, a signed image, a mandate enforced at the network level and destinations outside the mandate never tested.
- [Install the relay](https://docs.spectr-ai.eu/en/scans-internes/installer-le-relais.md): Declare a site, install the Docker agent on a machine of the network with the commands the application provides, see it appear ready, check reachability and keep it available during tests.
- [The testing mandate](https://docs.spectr-ai.eu/en/scans-internes/mandat-et-exclusions.md): Define the testing authorisation of an internal site: the application, subdomains, HTTPS ports and duration. How the mandate is enforced, what it does not allow, how to change or revoke it.
- [Launch an internal scan](https://docs.spectr-ai.eu/en/scans-internes/lancer-un-scan-interne.md): Create an internal application attached to a site whose agent is ready and whose mandate is current, prepare and launch the pentest, follow the scan, handle a relay disconnection and receive the report.

## [Results](https://docs.spectr-ai.eu/en/resultats.md)

> What a completed pentest produces: findings with their evidence, attack paths, a frozen report, two correction retest batches and a NIS2 evidence index.

- [Findings and evidence](https://docs.spectr-ai.eu/en/resultats/findings-et-preuves.md): Read a published finding: CVSS severity, CWE classification, description, impact, recommendation and redacted HTTP evidence. Track its fix in the application.
- [Attack paths](https://docs.spectr-ai.eu/en/resultats/chemins-d-attaque.md): How SpectrAI links proven findings into attack paths, what the provenance of each step means, and why a path adds no assumption to the evidence.
- [The report](https://docs.spectr-ai.eu/en/resultats/rapport.md): The final report of a pentest: automatic publication, content, frozen versions, PDF export, revocable share link, brand, and what it contains when no finding was proven.
- [Correction retests](https://docs.spectr-ai.eu/en/resultats/retests.md): Have your fixes verified with the two retest batches included within sixty days of each report: prepare a batch, launch it, read its verdict and understand its limits.
- [NIS2 index](https://docs.spectr-ai.eu/en/resultats/nis2.md): What the NIS2 evidence index of a SpectrAI report is, the article 21 controls it organises, and why it is neither an attestation nor a certification.

## [Offers and orders](https://docs.spectr-ai.eu/en/offres-et-commandes.md)

> The application catalogue (one-off pentest or annual programme), what each evaluation includes, how to order from the application page and how the annual programme works.

- [The catalogue](https://docs.spectr-ai.eu/en/offres-et-commandes/catalogue.md): One-off pentest or annual programme: what each evaluation includes, what distinguishes the two services, and what neither of them is.
- [Ordering an evaluation](https://docs.spectr-ai.eu/en/offres-et-commandes/commander.md): Order a one-off pentest or an annual programme from the application page, pay by card on the hosted page, resume or cancel a payment, follow the contract, find your invoices and replace your card.
- [The annual programme](https://docs.spectr-ai.eu/en/offres-et-commandes/programme-annuel.md): Two full evaluations of the same application over twelve months: when to launch the second one, how to adjust its agreed date, what happens at the end of the contract and how it differs from active monitoring.

## [Partners](https://docs.spectr-ai.eu/en/partenaires.md)

> For security firms, MSSPs, MSPs and managed service providers: the console, client spaces, roles, white label and orders placed for a client.

- [Console and client spaces](https://docs.spectr-ai.eu/en/partenaires/console.md): How a partner works in SpectrAI: the console, how to enter a client space and return to the console, the admin, analyst and viewer roles, and what each one sees.
- [Client spaces](https://docs.spectr-ai.eu/en/partenaires/espaces-clients.md): Create a client space, invite the client and its team, assign analysts, prepare the first target and follow what is blocking, from the partner's console.
- [White label](https://docs.spectr-ai.eu/en/partenaires/marque-blanche.md): Deliver SpectrAI under your brand: identity and logo, e-mails, preview, custom domain and e-mail sender. What is automatic and what requires activation.
- [Partner orders](https://docs.spectr-ai.eu/en/partenaires/commandes-partenaires.md): Order an evaluation for an identified client from the console, follow the evaluations available in the portfolio, understand invoicing between SpectrAI, the partner and the end customer.

## [Account and security](https://docs.spectr-ai.eu/en/compte-et-securite.md)

> Sign-in and second factor, team and roles of a client space, notifications in the application and by e-mail, and what SpectrAI does with your data.

- [Sign-in and second factor](https://docs.spectr-ai.eu/en/compte-et-securite/connexion-et-second-facteur.md): Sign in with your password then a second factor (authenticator app or e-mail code), enable or remove a factor, reset your password, and what is required depending on the role.
- [Team and roles](https://docs.spectr-ai.eu/en/compte-et-securite/equipe-et-roles.md): Invite people into a client space, choose their role (administrator, member, viewer), understand what each role allows and read the audit log.
- [Notifications](https://docs.spectr-ai.eu/en/compte-et-securite/notifications.md): SpectrAI notifications in the application and by e-mail, the reminders sent once per event, and how to set your preferences without losing the essential messages.
- [Data and privacy](https://docs.spectr-ai.eu/en/compte-et-securite/donnees-et-confidentialite.md): What SpectrAI keeps from a pentest, how test accounts and evidence are protected, what is purged, where inference runs, and what SpectrAI does not promise.

## [Reference](https://docs.spectr-ai.eu/en/reference.md)

> SpectrAI's limits and commitments, all deadlines and expirations in one table, troubleshooting of the common blockers, frequently asked questions and the product changelog.

- [Limits and commitments](https://docs.spectr-ai.eu/en/reference/limites.md): What SpectrAI does not do, does not promise or does not cover today: scope, confinement, retests, test accounts, models, compliance, invoicing. The list the product does not hide.
- [Deadlines and expirations](https://docs.spectr-ai.eu/en/reference/delais-et-expirations.md): All product deadlines in one table: verification code, ownership proof, check at launch, retest window, reminders, second factor code, invitations, share links, agent tokens.
- [Troubleshooting](https://docs.spectr-ai.eu/en/reference/depannage.md): The most common blockers and their solution, from symptom to action: ownership proof, Guidance, launch, paused pentest, relay, payment, second factor, invitations and share links.
- [Frequently asked questions](https://docs.spectr-ai.eu/en/reference/faq.md): Short answers to the most common questions about SpectrAI: scope, evidence, report, retests, relay, prices, partners, security and compliance.
- [Use the documentation with AI](https://docs.spectr-ai.eu/en/reference/agents.md): Give your assistant a Markdown page or the complete SpectrAI documentation, including source links, language and last updated dates.
- [Changelog](https://docs.spectr-ai.eu/en/reference/journal-des-modifications.md): The dated history of visible changes to SpectrAI, for clients and partners: offers, flows, relay, authentication, documentation.