Security and Compliance

Terra maintains a security program designed to meet the requirements of enterprises operating in regulated industries. Controls are independently audited and continuously monitored. Security reports, policies, and completed questionnaires are available by request.

Privacy and Data Protection

Terra operates as a data processor for customer-controlled information and as a data controller for limited business and account data. Our practices are designed to align with the world's most rigorous privacy frameworks. A standard Data Processing Agreement is available for review and execution alongside the Master Services Agreement. Customer data is encrypted in transit using TLS 1.2 or higher and at rest using AES-256 or equivalent industry-standard encryption.

Responsible Agentic Operations

Terra operates autonomous agents that perform security testing on behalf of our customers. Every engagement begins with explicit, documented authorization, and agents operate strictly within the defined scope. Customer environments, findings, and engagement data are logically isolated. Every action taken by a Terra agent is attributable, logged, and auditable.

Corporate Responsibility

Terra's commitments extend beyond the technical. The standards we hold ourselves to in business conduct, supply chain integrity, and human rights are documented and enforced. All Terra personnel are required to read and acknowledge the Terra Code of Conduct. Suppliers and contractors engaged by Terra are required to meet the standards set forth in our Supplier Code of Conduct.

llms.txt | Terra Security

# Terra Security

> Terra is the agentic offensive security company. Terra Platform™ delivers continuous, Human-on-the-Loop pentesting across web apps, AI systems, external and internal networks, APIs, mobile, and cloud — replacing point-in-time pentests with always-on, validated findings.

Terra combines autonomous AI agents with certified human researchers through TORCH (Terra Offensive Research Collaboration Hub). Findings are verified, prioritized by business context, and delivered as audit-ready reports accepted by SOC 2, ISO 27001, HIPAA, and PCI-DSS frameworks. Terra is SOC 2 Type II certified.

**Canonical domain:** https://www.terra.security  
**Product naming:** Terra Platform™ (platform), TORCH (collaboration hub; formerly Terra Portal), Human-on-the-Loop (not "human-in-the-loop")  
**Primary CTA:** Book a demo at https://www.terra.security/book-a-demo

## Product

- [Home](https://www.terra.security/): Agentic offensive security platform overview — one platform, every attack vector, continuously validated.
- [Terra Platform™](https://www.terra.security/terra-platform): Core product page for continuous agentic pentesting with production-safe execution and human governance.
- [Web Application Testing](https://www.terra.security/terra-platform/web-app-testing): Continuous web app pentesting that adapts to auth flows and business logic.
- [External Network Testing](https://www.terra.security/terra-platform/external-network-testing): Continuous external network pentesting — map services and chain misconfigurations.
- [Internal Network Testing](https://www.terra.security/terra-platform/internal-networks): Continuous internal network pentesting — trace lateral movement and privilege escalation.
- [AI Red Teaming](https://www.terra.security/terra-platform/ai-red-teaming): Red teaming for AI apps, copilots, LLMs, MCPs, and agent behavior.
- [TORCH](https://www.terra.security/terra-platform/terra-offensive-research-collaboration-hub): Terra Offensive Research Collaboration Hub — agent-human collaboration for offensive security.
- [Agent Architecture](https://www.terra.security/agent-architecture): How Terra's ambient and copilot agents work together.
- [Book a Demo](https://www.terra.security/book-a-demo): Request a live demo of Terra Platform.

## Use Cases

- [Continuous Validation](https://www.terra.security/use-cases/continuous-validation): Always-on testing aligned to code change and CI/CD.
- [Replace Legacy Pentests](https://www.terra.security/use-cases/replace-legacy-pentests): Move from 4–6 week engagements to 2–4 hour validation cycles.
- [End Alert Fatigue](https://www.terra.security/use-cases/end-alert-fatigue): Verified, exploitable findings instead of noisy scanner output.
- [Consolidate OffSec Tools](https://www.terra.security/use-cases/consolidate-offsec-tools): One platform for web, AI, network, and internal app testing.
- [Reduce Exposure Dwell Time](https://www.terra.security/use-cases/reduce-exposure-dwell-time): Find and confirm vulnerabilities within hours of introduction.
- [Prove Compliance Continuously](https://www.terra.security/use-cases/compliance-as-an-outcome): Audit-ready, human-signed reports as a byproduct of continuous testing.
- [Security & AppSec](https://www.terra.security/use-cases/security-appsec): Scale offensive security without linear headcount growth.
- [CISO](https://www.terra.security/use-cases/ciso): Continuous visibility into exploitable risk across the full attack surface.
- [Compliance & GRC](https://www.terra.security/use-cases/compliance-grc): Continuous pentest evidence for SOC 2, ISO 27001, PCI-DSS, and HIPAA audits.
- [Partners](https://www.terra.security/terra-partners): Partner program for MSSPs and offensive security service providers.

## Learning Center

- [Agentic Pen Testing: What Is It, and How to Get Started](https://www.terra.security/blog/agentic-pen-testing): Introduction to autonomous, AI-driven security testing.
- [AI Red Teaming: What Security Teams Need to Know](https://www.terra.security/blog/ai-red-teaming-what-security-teams-need-to-know): Guide to AI red teaming beyond traditional pentesting.
- [How to Build a Governed Continuous Pentesting Program](https://www.terra.security/blog/how-to-build-a-continuous-pentesting-program): Governance, guardrails, and safe scope for continuous testing.
- [Why White-Box Pentesting Is Essential for Real Offensive Security](https://www.terra.security/blog/why-white-box-pentesting-is-essential-for-real-offensive-security): Why context-aware, white-box testing maximizes detection.
- [What Human-on-the-Loop Really Means at Terra Security](https://www.terra.security/blog/what-human-in-the-loop-means-at-terra-security): How human researchers govern agent execution at critical decision points.
- [Offensive Security Training in an AI World: 7 Essentials](https://www.terra.security/blog/offensive-security-training-in-an-ai-world-7-essential-components-to-consider): Essential training components for modern adversary thinking.
- [How to Implement a Continuous Offensive Security Testing Program](https://www.terra.security/land/how-to-implement-cost): Landing page on building a continuous offensive security program.

## Insights

- [Insights (Blog)](https://www.terra.security/blog): Perspectives on agentic offensive security, continuous pentesting, and threat research.
- [Research](https://www.terra.security/category/research): Threat research, CVE disclosures, and security analysis.
- [Essential Guides](https://www.terra.security/category/essential-guide): In-depth guides for security practitioners.
- [Case Studies](https://www.terra.security/category/case-studies): Customer success stories and implementation examples.
- [Analyst Reports](https://www.terra.security/category/analyst-reports): Third-party analyst coverage of Terra and the category.
- [Whitepapers](https://www.terra.security/category/whitepapers): Downloadable whitepapers and long-form content.
- [News](https://www.terra.security/category/news): Company news and announcements.
- [Press Releases](https://www.terra.security/category/press-release): Official press releases.
- [When AI Becomes the Attack Surface: CVE-2026-25724](https://www.terra.security/blog/when-ai-becomes-the-attack-surface-lessons-from-discovering-cve-2026-25724): Research disclosure on AI system vulnerabilities.
- [Continuous Internal Network Penetration Testing in Terra Platform™](https://www.terra.security/blog/continuous-internal-network-penetration-testing-terra-platform): Product announcement for internal network coverage.

## Company

- [About Terra](https://www.terra.security/about): Company overview, team, investors, and awards.
- [Testimonials](https://www.terra.security/testimonials): What enterprise security teams say about Terra.
- [Careers](https://www.terra.security/careers): Open roles across engineering, security research, and GTM.
- [Events](https://www.terra.security/events): Conferences, webinars, and meetups.
- [Contact](https://www.terra.security/contact-us): Get in touch — demo requests, partnerships, and support.

## Legal

- [Privacy Policy](https://www.terra.security/privacy-policy): How Terra collects, uses, and protects data.
- [Terms of Service](https://www.terra.security/terms): Terms governing use of Terra Platform and services.
- [Data Processing Agreement](https://www.terra.security/dpa): DPA for personal data processing.
- [Service Level Agreement](https://www.terra.security/sla): Uptime commitments and support response times.
- [Employee and Candidate Privacy Notice](https://www.terra.security/employee-candidate-privacy-notice): Privacy notice for job applicants and employees.

## Optional

- [Search](https://www.terra.security/search): Site search for product pages, insights, and resources.
- [Meet Us at Gartner](https://www.terra.security/meet-us-at-gartner): Event landing page for Gartner conference attendees.
- [Internal Network Waitlist](https://www.terra.security/internal-network-waitlist): Join the waitlist for internal network testing features.
- [Public Sector](https://www.terra.security/category/public-sector): Content for public sector security teams.
- [Videos](https://www.terra.security/category/videos): Webinars and video content.
- [Product Updates](https://www.terra.security/category/product): Product news and feature announcements.