VAPT testing priced in rupees, written for global reviewers.
Manual web application and API testing for Indian SaaS companies, fintechs and the agencies that build for overseas clients. Same working day, invoices in rupees, and a report set out the way enterprise and overseas security reviewers read.
Who asks for testing, and what they want
The reader of a pentest report is rarely the engineer who fixes it. These are the readers we write for in this market.
| Who asks | What they usually look for | What the engagement gives you |
|---|---|---|
| Enterprise and overseas customers | A recent independent test, what it covered and the status of what it found, usually inside a security questionnaire. | A shareable summary with scope, dates and a fix-status ledger, plus a dated retest record. |
| SOC 2 and ISO 27001 audits | Evidence that in-scope systems were tested and findings tracked to closure. ISO 27001:2022 covers this in controls 8.8 and 8.29. | Testing evidence for your auditor to review. It is not an attestation or a certification. |
| DPDP Act 2023 | Reasonable security safeguards to prevent a personal data breach, under section 8(5). | Evidence that one set of safeguards, your application's access controls, was tested and fixed. Testing alone is not compliance. |
| RBI, SEBI and IRDAI regulated entities | Periodic VAPT under each regulator's cyber security framework, often by a CERT-In empanelled auditor. | Testing earlier in your release cycle. Where an empanelled auditor is mandatory, the regulatory audit itself must come from one. |
| Agencies building for overseas clients | A third-party test before the client accepts the build, often on the client's own contract terms. | Testing on the client's timeline, with the report shared as agreed with you and the client. |
Not claimed: CERT-In empanelment · Approval or listing by any Indian regulator. If a contract requires one of these, tell us at scoping.
Prices in Indian rupees
Starting prices for the three packages. Your quote is fixed after a scoping call.
Compare the packagesFocused test
One web application or one API, before a release or a first customer review.
Product test
A multi-tenant SaaS product and its API, for enterprise reviews and audit evidence.
Release programme
Teams that ship every week and answer security reviews all year.
The hours we share
Your working day is ours. The other rows are your customers: London overlaps your afternoon, and New York starts as your day ends.
The practical side
- Invoices in rupees
- Invoices come from Zeno Ventures Pvt. Ltd., Noida, the company that owns ZenoPentest. GST is added at the applicable rate.
- Same working day
- Scoping calls, urgent-finding escalations and the readout all happen inside Indian business hours.
- Your customers' hours
- When the reviewer is in London or New York, a review call in their hours can be booked by arrangement.
- Paperwork before testing
- A statement of work and written authorisation from the system owner come first.
In more detail
What Indian software companies usually need
Most Indian teams that ask for VAPT are answering someone else’s question. An enterprise prospect has sent a security questionnaire. An auditor has asked for testing evidence ahead of SOC 2 or ISO 27001. A US or European customer wants to know that tenant data stays inside its own tenant. In each case the reader of the report is not the engineer who will fix the findings, and the report has to work for both.
That is the main thing ZenoPentest is built for. The summary states what was tested, when, by which method and with what result, in language a reviewer can check in minutes. The detail gives your engineers the request, the response, the affected roles and a specific fix. After the retest, a new version records which findings are fixed and when that was verified.
Selling abroad from India
If your buyers are overseas, the test is part of the sale. Reviewers in the UK and US often ask the same three things: was the test independent, did it cover the product they are buying, and were the findings fixed. A report that leaves any of those unclear sends the questionnaire back to you.
So the scope matters as much as the testing. We name the application, the API, the roles and the tenants in the report, and we state what was not tested. A reviewer who sees “admin and member roles tested across two tenants” can match that to the product they are buying. A reviewer who sees “the website was scanned” cannot.
Regulated entities and empanelment
Banks, NBFCs, payment companies, brokers and insurers have their own obligations under RBI, SEBI and IRDAI frameworks, and some of those require a CERT-In empanelled auditor. ZenoPentest does not claim empanelment. If your audit must come from an empanelled auditor, use one for that audit.
Where testing still helps is earlier. A product test before a major release gives your engineers time to fix what a later audit would otherwise find, and the report is yours to share with the auditor if you choose.
Personal data and the DPDP Act
The Digital Personal Data Protection Act 2023 requires data fiduciaries to protect personal data with reasonable security safeguards. A penetration test checks one important part of that: whether the application’s own access controls stop one user, or one tenant, from reaching another’s data. It does not cover policies, contracts or the rest of your obligations, and we do not present it as compliance.
We test with accounts and data you create for the purpose. We do not need real customer records, and we ask you not to send them.
- GST registration details shown on invoices
- Standard payment schedule wording
Questions buyers ask
Are you CERT-In empanelled?
No. ZenoPentest does not claim CERT-In empanelment. If a regulator or a customer contract requires an empanelled auditor, that audit must come from one. Tell us at scoping and we will say plainly whether testing with us still helps, for example before a release.
What does VAPT include here?
Vulnerability assessment and penetration testing of a web application and its APIs, done by hand with authenticated test accounts. Scanners help with discovery, and every reported finding is confirmed manually with request-level evidence. We do not sell scan-only reports.
Do the prices include GST?
No. Prices are shown before GST, which is added at the applicable rate on the invoice.
Why is the rupee price lower than the dollar price?
Prices are set for each market rather than converted at the day's exchange rate. The package, the testing days and the report are the same in every currency.
Can the report go to a customer in the US or Europe?
Yes. The report is written in English for two readers: a summary a reviewer can read in minutes, and detail your engineers can act on. Who receives it is agreed before testing.
We are an agency building for an overseas client. Who signs the authorisation?
The client, as the owner of the system, signs the authorisation. Your agency can hold the commercial contract and the relationship. The agencies page sets out the options.
Start with one product.
Tell us what you are shipping and who needs the report. You get scoping questions, then a fixed quote in your currency.