Letters of Attestation

What is a Letter of Attestation?

A Letter of Attestation is a one-page, cryptographically-signed PDF that proves a specific application was penetration-tested by ModernPentest during a specific time period. It is designed for one purpose: sharing proof with people outside your organization, such as prospects, customers, auditors and partners.

It is intentionally short and prospect-friendly. For full compliance documentation, generate a SOC 2 report or ISO 27001 report instead.

When to use which artifact

Who can issue one

Eligibility is decided per pentest, from how that pentest was paid for, not from your plan tier.

A credit buys one point-in-time letter for that pentest. To issue a replacement for the same pentest, revoke the existing letter first.

Continuous letters count against your plan's monthly attestation cap (see Plan limits); renewals do not.

A free preview that was unlocked because it had two or fewer findings, or by an operator, is eligible only while your organization holds a plan or an available credit, and that entitlement decides the kind.

Validity kinds

Every letter issued after September 2026 carries a validity kind. The kind is printed on the PDF next to the expiry date, shown on the trust portal and returned by the verification page, and it is part of the hashed payload, so it cannot be changed after issue.

Point-in-time

A point-in-time letter attests one pentest. It expires 90 days after the test period ended, which covers the 30-day re-verification window sold with a pentest credit plus a margin for your buyer's procurement cycle. The expiry is anchored on the scan, not on the day you generated the letter, so waiting to generate does not extend it.

Continuous

A continuous letter is the plan letter. It expires 45 days after the scan it attests, and every completed scan of the same application renews it automatically, so it lapses only when scanning stops. Renewal never breaks a link: see Renewal.

Letters issued before validity kinds

Letters issued before September 2026 carry no kind and keep the one-year validity they were issued with. They verify exactly as before.

Compliance framework tagging

Attestations can optionally reference a compliance framework. This adds framework-specific evidence language and badge styling, so a customer reviewing your attestation sees the relationship to SOC 2 or ISO 27001 at a glance.

The framework tag is part of the cryptographically-hashed payload; changing the declared framework after issuance invalidates verification. If you need to switch frameworks, generate a new attestation.

How to generate one

1. Complete a pentest

Letters of Attestation can only be generated from pentests in a terminal state (completed or completed_with_errors) that you are entitled to attest. Locked free previews are not offered in the picker. If you have no eligible pentests, run a pentest first from the Pentests dashboard, or unlock your preview from its report page.

2. Create the attestation

From the Attestations dashboard, click "New Attestation" and select your completed pentest. The picker shows the letter kind each pentest would issue, and explains why a pentest cannot be attested right now (for example, a point-in-time letter already exists for it). You can also deep-link directly from the pentest detail page via the "Generate Attestation" button.

3. Choose a redaction profile

Three profiles control how much detail appears on the public version:

Minimal

• Organization name, application name, test period
• "No critical or high outstanding" statement (when true)
• Hidden: severity counts, methodology details, vulnerability types

Best for conservative sharing where you only need to prove testing occurred.

Standard (recommended default)

• Everything in Minimal
• Severity breakdown (open vs remediated, with hover explanations)
• Surfaces tested, agent methodology
• Scan duration, OWASP coverage

Best for most customer-facing sharing.

Detailed

• Everything in Standard
• Vulnerability types by category (CWE/OWASP)
• Remediation timeline summary (median time-to-fix)
• Validator verification stats

Best for security-conscious prospects or internal auditors.

4. Choose visibility

• Private: dashboard only. Download the PDF and share it manually.
• Unlisted: anyone with the link can view the public page. Not listed on your org's trust portal.
• Public: listed on /trust/[your-org-slug] as part of your org's trust portal.

Unlisted and public visibility are available for every letter issued from a pentest credit or a plan.

5. Generate and share

After submission, the PDF renders in the background (usually within seconds). From the attestation detail page you can:

• Copy link: one-click copy of the public URL
• Share via email: pre-composed email with link and explanation
• Download PDF: for attaching to RFPs or sharing manually
• Publish / Make private: toggle visibility
• Renew: replace the letter with one from a newer pentest without breaking any link
• Revoke: permanent revocation with optional reason
• Embed on your website: copy ready-to-paste badge or card snippets (full embedding guide)

Outstanding findings: should I wait?

ModernPentest lets you generate an attestation regardless of open findings. If your pentest has outstanding critical or high-severity issues, the generation flow will show a warning: most customers wait until remediation is complete before publishing.

The redaction profile controls what gets shown. If you generate an attestation with open criticals but use the minimal profile, the public page will not mention them; it will only show dates and a pentest-performed statement. This is honest (the pentest did happen) without misrepresenting the security posture.

Our recommendation: for public attestations, wait until you have zero critical/high outstanding so the "no critical or high outstanding" statement appears on the letter.

Reading the severity grid

When the public attestation is on the Standard or Detailed profile and there are findings to show, each severity row displays two numbers:

Critical    7 / 0
   High     2 / 1
 Medium     0 / 4
    Low     0 / 6
   Info     0 / 12

These are Open / Remediated, that is, open findings still outstanding at the time the attestation was issued, and findings remediated during the test period (found, fixed, and re-validated by ModernPentest).

Hover any severity row on the public attestation page for a tooltip with the same explanation.

Verification

Every attestation includes a SHA-256 content hash printed in the PDF footer. Anyone can verify authenticity at /trust/verify by pasting either:

• The Attestation ID (22 characters, printed on the PDF)
• The full content hash (starts with sha256:)

The hash is computed over a canonical JSON representation of exactly what is published. If a malicious party tampered with the PDF, the hash will not match and verification will fail.

What verification proves

A successful verification proves three things:

1. ModernPentest issued this attestation: we have the hash in our database
2. It has not been tampered with: the hash matches the canonical payload
3. It is still valid: not revoked, not expired

Verification answers for the specific letter you asked about. A letter that was renewed reports Renewed together with the ID of the current letter, so a PDF saved before the renewal still verifies as the letter it was.

What verification does not prove

• That the underlying application is still secure today
• That no new vulnerabilities have been introduced since the pentest
• That manual penetration testing (social engineering, physical security) was performed

Attestations expire (see Validity kinds) to enforce this distinction.

Renewal

Renewing a letter replaces it with a letter from a newer completed pentest under the same links.

• The previous letter stays live until the new PDF has rendered.
• The new letter then takes over: the trust portal, the badge, the card and the PDF link that pointed at the old ID all serve the new letter, with a "renewed on" note on the portal.
• The previous letter is marked Renewed (not revoked) in your dashboard, and its PDF still verifies as itself.
• Renewals of a continuous letter do not count against your monthly cap.

Continuous letters renew on their own: when a scan of the same application completes, ModernPentest issues the renewal automatically with the same redaction profile, framework and visibility. You can also renew any letter by hand from its detail page, for example after a fresh pentest paid with a credit.

Embedding on your website

Letters issued from a credit or a plan unlock embeddable widgets for putting verified-pentest signals on your marketing site, README, or trust page:

• Pill badge (220×48): a compact pill with the ModernPentest mark and a green check, intended for footers, hero sections, and trust strips
• Attestation card (360×240): a full card with org name, status pill, outcome banner, and severity grid (plans on Professional and above)
• Markdown badge: a static image variant suited for README files

Copy ready-to-paste snippets from the attestation detail page (Embed on your website section), or read the full integration guide:

Plan limits

Renewals never count against the monthly cap.

Revocation and expiry

Expiry

Point-in-time letters expire 90 days after the test period; continuous letters expire 45 days after their scan unless renewed. After expiry:

• The public portal page shows an "expired" notice
• The PDF remains downloadable (the document itself is still a historical record) but is marked as expired
• Embedded badges display "Last verified" instead of the green check
• Embedded cards show an amber "Expired" pill

You will receive email reminders 30 days, 7 days, and 1 day before expiry, for published and unlisted letters alike. An expired continuous letter is revived by the next completed scan.

Revocation

If you publish an attestation in error or need to invalidate a prior one (for example, you discovered a false negative), you can permanently revoke it from the detail page. After revocation:

• The public page shows a "revoked" notice with your reason (if provided)
• Any embedded badges immediately show "Revoked" with red styling
• The action is irreversible; generate a new attestation instead

A letter that has already been renewed cannot be revoked; revoke the current letter instead.

FAQ

Can I customize the PDF template?

Not yet. The template is standardized to make verification easier: a consistent format means prospects can recognize a genuine ModernPentest attestation at a glance. Custom logos and cover text are on the roadmap.

What if my pentest found vulnerabilities?

You can still generate an attestation. Use the minimal redaction profile to show only that a pentest was performed, without listing severity counts. Or wait until you have remediated the findings and generate a fresh attestation then.

What does "Renewed" mean on an old letter?

A newer letter has replaced it. Its share link, badge and card now show the newer letter, and its PDF still verifies as the letter it was. Nothing on your website needs to change.

Can multiple apps be on one attestation?

Not yet: one pentest per attestation in the current release. Multi-app and rolling-period (quarterly/annual) attestations are on the roadmap.

Does this replace a manual pentest?

No. Letters of Attestation from ModernPentest reflect automated penetration testing. They do not cover manual social engineering or physical security. The attestation itself includes this disclaimer so readers are not misled.

For compliance frameworks that require manual testing (for example PCI-DSS, some interpretations of SOC 2), this attestation is complementary; it does not replace a manual firm's letter.

Last updated: September 7, 2026