Pentrox B.V.

Trust & Procurement

This page is written for the CISO, procurement lead, DPO, and information security officer conducting a vendor assessment of Pentrox B.V. It collects the facts most often requested on a supplier-risk questionnaire: legal identity, certifications, insurance, data handling, incident notification, and code of ethics. Every statement on this page is factual at the date of publication and is updated when the underlying facts change.

Pentrox B.V. is a Dutch offensive security consultancy incorporated in 2026. Honesty about company stage is part of the assessment posture. Items that would be misleading to claim at this stage are marked as in progress or are shared on request under a non-disclosure agreement.

Company stage and team

Honest statement about where Pentrox is today.

Pentrox B.V. is a new Dutch offensive security consultancy, founded in 2026. The company is transparent about its current growth stage and does not present claims that cannot yet be substantiated as facts. No client names are used in any marketing material, and client references are shared only with prior written consent.

Senior ethical hackers lead every assessment. Assessment methodology, tooling, and quality review processes are documented in the capabilities pack available during scoping. A summary of team qualifications, certifications, and background checks is published per request.

Detailed profiles, identities, and individual certification records are shared with prospective clients under a mutual non-disclosure agreement during vendor evaluation.

Scope of operations

Where Pentrox assesses, in which languages, and under what working model.

Pentrox assesses targets located in the Benelux region: the Netherlands, Belgium, and Luxembourg. Assessments outside the Benelux are considered case by case, subject to local legal review and the terms of the applicable contract. Pentrox does not carry out offensive security work in jurisdictions where the activity would breach local law.

Project communication is available in English and Dutch. Reports are delivered in English by default. A Dutch executive summary can be requested during scoping at no additional cost.

The working model is remote-first. Assessments are conducted from the Netherlands over authorised remote access. On-site activity, including physical security assessments such as mystery guest and on-premises hardware testing, is available throughout the Benelux region.

Travel costs for on-site activity are quoted transparently in the proposal and billed at cost.

Certifications and independent assurance

What Pentrox claims today, and where each item stands.

Procurement buyers should read this section before filling in the certifications column of a vendor questionnaire. The list is structured so that every item is either held or in progress. No aspirational claim is presented as a current fact.

Currently held by Pentrox B.V.

No organisational certificate has been issued yet; Pentrox B.V. was incorporated recently. Its way of working is fully aligned with the requirements of the CCV Keurmerk Pentesten, and that certification is in progress (see below).

In progress

The CCV Keurmerk Pentesten, issued by the Centrum voor Criminaliteitspreventie en Veiligheid (CCV), is the Dutch quality mark that matters most for penetration testing in the Netherlands. Pentrox B.V. has assessed its way of working against every requirement of the scheme and meets all of them; screened testers with industry-standard certifications, a documented methodology, a controlled scoping, execution and reporting process, confidentiality obligations and professional indemnity insurance.

Team certifications

Individual team members hold one or more industry-standard offensive security certifications such as OSCP (Offensive Security Certified Professional), OSCE (Offensive Security Certified Expert), OSWE (Offensive Security Web Expert), eWPTX (eLearnSecurity Web Application Penetration Tester eXtreme), eMAPT (eLearnSecurity Mobile Application Penetration Tester), CPTS (Hack The Box Certified Penetration Testing Specialist), CWES (Hack The Box Certified Web Exploitation Specialist) and BSCP (PortSwigger Burp Suite Certified Practitioner). These are personal certifications and are not a substitute for an organisational certification of Pentrox B.V. A summary of the certifications currently held by team members is published on the Team & Expertise page. Expired or in-progress certifications are not presented as currently held. Individual records are shared under non-disclosure agreement during vendor evaluation.

Methodology alignment

Assessments are aligned with OWASP Top 10 and OWASP ASVS for application testing, PTES (Penetration Testing Execution Standard) for structured test execution, NIST SP 800-115 for technical assessment methodology, and MITRE ATT&CK for adversary emulation. Compliance-scoped assessments follow the controls of the applicable standard, such as ISO/IEC 27001 Annex A, PCI-DSS v4, NIS2 Article 21, or the DigiD assurance framework.

Methodology alignment is not the same as an independent audit. Pentrox states this explicitly so that procurement buyers do not confuse the two.

Insurance and liability

Insurance cover and standard contract liability cap.

Pentrox B.V. maintains professional indemnity and public liability insurance appropriate to the delivery of offensive security assessments. Cover is placed with a Dutch or EU-based carrier and is renewed annually.

Carrier Available on request - email info@pentrox.nl
Professional indemnity limit Available on request - email info@pentrox.nl
Standard contractual liability cap Available on request - email info@pentrox.nl
Certificate of insurance Available on request during scoping, under the terms of the mutual non-disclosure agreement.

The liability cap stated in the framework contract and in each assessment statement of work applies to the specific assessment. Higher project-specific caps are negotiable during scoping for assessments that justify them, such as red team exercises with a critical-infrastructure objective or PCI-DSS-scoped testing with a large cardholder data environment.

Certificates of insurance and the liability language of the framework contract are provided to prospective clients during the vendor evaluation phase, after a mutual non-disclosure agreement is in place.

Data handling, residency, and retention

Where assessment data lives, how long it is kept, and which GDPR role applies.

Assessment data includes scope documents, test credentials, finding evidence, draft and final reports, retest evidence, and communication between Pentrox and the client. The items below describe how each class of data is handled.

Primary storage Assessment artefacts are stored and delivered through the Pentrox Portal at portal.pentrox.nl. Scope documents, findings, evidence files, and reports are accessible to authorised client users through the Portal for the lifetime of the client account.
Portal hosting location Portal infrastructure is hosted in a datacenter in the European Union on a dedicated virtual private server. Shared hosting is not used. Assessment data is stored only within the European Economic Area (EEA).
International transfers Assessment data is stored only within the European Economic Area (EEA) and assessment work is not offshored. One third-country sub-processor is involved; Cloudflare, Inc. (United States) operates the network in front of the Portal, so Portal traffic passes through it encrypted in transit and is not stored there. That transfer is covered by the EU-U.S. Data Privacy Framework (adequacy decision (EU) 2023/1795) with Standard Contractual Clauses as fallback, as set out in the privacy statement.
GDPR role For assessment data that contains personal data of client employees or end users, Pentrox B.V. acts as a data processor on behalf of the client, who is the data controller. For account data of Pentrox Portal users, Pentrox B.V. acts as a joint controller together with the client organisation. The exact division is documented in the Data Processing Agreement executed at the start of the assessment.
Data Processing Agreement (DPA) A Pentrox standard Data Processing Agreement is available on request during scoping. Client-template DPAs are reviewed on request. The Pentrox template is not published for public download.
Data subject rights Requests from data subjects are forwarded to the client as data controller. Pentrox supports the client in responding to access, rectification, and erasure requests in line with Articles 15 to 22 of the General Data Protection Regulation.
Sub-processors A current sub-processor list is maintained internally and is shared with prospective clients during scoping under non-disclosure agreement. The list is not published on this website.
Retention Assessment data remains available to the client in the Pentrox Portal indefinitely. Pentrox does not automatically delete client data. Clients can access their data at any time. On explicit written request from the client, Pentrox removes the data within a reasonable period and confirms removal in writing.
Backups Portal data is backed up daily. Backup retention, geography, and encryption details are documented in the Pentrox internal information security policy and are shared with prospective clients during scoping under non-disclosure agreement.

Security of Pentrox infrastructure

How Pentrox protects its own systems, described in publishable detail only.

The Pentrox Portal and internal testing infrastructure are treated as in-scope assets under the Pentrox information security policy. The controls below are the items that Pentrox is willing to describe publicly. Detailed configuration, architecture diagrams, and hardening specifics are not published on this page and are shared with prospective clients under non-disclosure agreement.

Authentication Two-factor authentication is mandatory for all Pentrox Portal users, including client users and Pentrox staff. Passwordless recovery flows are not enabled.
Access control Role-based access control governs every action in the Portal. Client users see only the projects to which they are explicitly assigned. Pentrox staff access is restricted to the projects they are assigned to.
Encryption in transit and at rest All traffic to the Portal is served over TLS. Data at rest is stored on encrypted volumes.
Audit logging Authentication events, privileged actions, and finding lifecycle changes are logged in the Portal for audit purposes. Log retention is documented in the internal policy.
Backups Portal data is backed up daily. Routine restore testing is introduced when the production environment is live; until that point, ad-hoc restore validation is performed when the backup configuration changes. Backup retention and encryption details are documented in the internal information security policy.
Patching Portal dependencies are monitored and patched on a defined cadence. Security-critical patches are applied out of cycle.
Monitoring Authentication failures and privileged actions are monitored. Alerts route to the Pentrox security response channel.

Pentrox operates its Portal and supporting systems in line with the same principles it applies when assessing client environments, including least privilege, defense-in-depth, and internal quality review before production change.

Code of ethics and scope boundaries

What Pentrox refuses to do, in writing.

Pentrox operates strictly within the boundaries of the written statement of work and the mutually signed authorisation letter. Any activity outside those boundaries is out of scope and is not performed, regardless of pressure, incentive, or time constraint.

The following activities are never performed, even on request:

  • Deployment of ransomware, wipers, destructive payloads, or any code that damages data or causes service loss outside an agreed test window.
  • Denial-of-service testing, load-based disruption, or availability impact testing without a written authorisation that specifies the target, the window, and the rollback plan.
  • Exfiltration of real personal data, payment data, authentication credentials of real users, or intellectual property beyond the minimum evidence needed to demonstrate a finding.
  • Access to systems, accounts, or networks not listed in the signed scope, including third-party dependencies, upstream providers, and systems of unrelated parties.
  • Social engineering of individuals not included in the authorised target list, including family members, unrelated third parties, and minors.
  • Assessments aimed at surveilling individuals rather than testing systems.
  • Assessments whose purpose or likely outcome would breach Dutch law, European Union law, or applicable sanctions regimes.

When an assessment uncovers a pre-existing compromise, an active attacker, or a finding that poses immediate and significant risk to the client or to a third party, the issue is escalated immediately through the channel agreed at kickoff. Continuation of testing is paused until the client instructs otherwise.

Pentrox retains the right to decline or withdraw from any assessment whose scope, purpose, or conditions cannot be reconciled with this code of ethics.

Incident notification

How Pentrox handles critical findings and security incidents during an assessment.

Incident notification timelines are agreed during scoping. Critical findings are escalated immediately through the channel agreed at kickoff.

The escalation channel, the list of named contacts on both sides, and the out-of-hours contact path are recorded in the kickoff document and updated if personnel change. Specific notification service levels are not published on this page. They are defined in the statement of work for each assessment and reflect the risk profile of the target environment.

For security events affecting Pentrox systems, the response procedure is documented in the Pentrox internal information security policy. Notification to affected clients is carried out in line with the obligations of the Data Processing Agreement executed at the start of the assessment.

Personnel vetting

How Pentrox employees and contractors are vetted before they access client environments.

All Pentrox employees undergo Personnel Screening (PES) checks at the commencement of employment. The scope of those checks is documented in the internal personnel security policy and reflects the sensitivity of client data handled by offensive security staff.

Contractor usage is limited. Where a contractor is used, the contractor is bound by the same confidentiality obligations, information security policy, and code of ethics as a Pentrox employee. Contractor vetting requirements are documented in the internal personnel security policy and shared with prospective clients under non-disclosure agreement during vendor evaluation.

Clients in regulated sectors that require a specific vetting standard, such as AIVD screening for national security assessments or sector-specific clearance for DigiD-scoped projects, should raise the requirement during scoping so that the right staff can be assigned or the project can be declined if the standard cannot be met.

Procurement pack and questionnaires

How to complete vendor due diligence on Pentrox without a delay.

Pentrox completes vendor-risk questionnaires on request. Most questions are already answered on this page, which is intended to compress the questionnaire exchange from weeks to days. Where a questionnaire requires evidence that is not published here, the evidence is shared during scoping under a mutual non-disclosure agreement.

Turnaround for a completed vendor questionnaire depends on the length and complexity of the template. An expected completion date is confirmed in writing on receipt of the questionnaire and the signed non-disclosure agreement.

The following artefacts are available during vendor evaluation:

  • Completed vendor-risk questionnaire in the template supplied by the client.
  • Certificate of insurance.
  • Standard framework agreement and standard Data Processing Agreement for review.
  • Pentrox information security policy summary.
  • Sub-processor list current at the date of disclosure.
  • Sample redacted assessment report that shows report structure and finding detail.
  • Extract of the Pentrox code of ethics and scope boundaries.

Requests are addressed to info@pentrox.nl with the subject line "Procurement pack". The contact form at /en/contact is the preferred route for a first exchange.

Request a procurement pack · info@pentrox.nl

This page is maintained by Pentrox B.V. and is updated when the underlying facts change. Prospective clients are encouraged to cross-reference this page with the information provided during scoping. Where the two differ, the facts provided in writing during scoping take precedence.

© 2026 Pentrox B.V. All rights reserved. Last updated: September 9, 2026