Frequently asked questions
Short answers to the most common questions about SpectrAI: scope, evidence, report, retests, relay, prices, partners, security and compliance.
Scope#
Can I test my whole domain or several applications with one order?#
No. An order names one application and its associated APIs, in an agreed environment. Another application is another target and another order.
Are subdomains included in an external pentest?#
Not by default. The external pentest tests the authorised HTTPS URLs under the verified domain, those you added in the target page, each as an exact URL. Nothing is added by discovery. For an internal scan, the mandate can include the application's subdomains.
Can I test an IP address or my code repository?#
No. Bare IP addresses, Git repositories, uploaded code and CI pipelines are not covered.
Evidence and report#
Why does a finding I suspect not appear?#
Only weaknesses demonstrated with evidence are published. A report without findings attests that no weakness was proven within the scope and time of the test, not that the application is secure.
Does someone review the report before its publication?#
No. Finding assessment and publication are fully autonomous, after automatic checks of evidence, scope and consistency.
Can a report be modified after publication?#
No. Each report is a frozen snapshot. A new pentest produces a new report.
Retests#
What does a retest verify?#
It reruns a targeted test on the original finding. If it does not find it again, the result is inconclusive: it does not prove that the fix is correct. If it finds it again, the finding is reopened.
How many retests are included?#
Two batches per report, within sixty days, with no cap on fixes per batch. They never consume the second evaluation of an annual programme.
Relay and internal scans#
What do I need to install for an internal scan?#
A Docker agent on a machine of the network to test, with the commands provided by the application and a single-use enrolment code. It opens no inbound port and must stay available during the test. Internal scans are enabled by SpectrAI on your space after agreement on the scope.
Can an internal scan go outside the mandate?#
No. The mandate is enforced as a network policy: a destination outside the mandate is never tested. If it is discovered during the scan, it becomes a suggestion to approve, never a test.
Prices and orders#
Where are the prices?#
They are not published on the site. They are displayed at the time of ordering, in the application.
Does the annual programme renew automatically?#
No. It is a twelve-month commitment, prepaid or in twelve fixed instalments, with no automatic renewal.
Can I get a refund?#
No refund is performed from the application. An evaluation is returned to the contract if the pentest is cancelled before it starts or fails for a platform cause without a report.
Partners#
Does my client see the partner rate?#
No. SpectrAI invoices the partner; the partner sets its resale price and invoices its client. The end customer sees neither the partner rate nor the supplier invoices.
Can I choose to validate reports before my clients see them?#
No. Publication is autonomous for all spaces; no validation policy exists.
Security and compliance#
Is the second factor mandatory?#
It is offered once to clients and administrators, never imposed; some actions require a verified session. Only platform operators must enable it.
Does SpectrAI attest NIS2 compliance or certify anything?#
No. The NIS2 index classifies the evidence of a report; it attests no compliance and replaces neither an audit, nor a qualification, nor a certification.
Where do the language models run?#
Through a gateway, with a provider imposed per profile and training prohibited. SpectrAI attests neither inference in the European Union, nor that the provider retains nothing.