# Security AI Tool Evaluation: Escape AI Pentesting

## Tool Overview
**Name:** Escape (formerly Escape.tech)
**Type:** AI-Powered API Security & Pentesting Platform
**Website:** https://escape.tech
**Primary Function:** Automated API security testing, vulnerability scanning, penetration testing for APIs (REST, GraphQL, gRPC)

---

## Privacy Policy & Enterprise Compatibility

### Commercial/Enterprise Use Permission
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Privacy Policy: https://escape.tech/privacy (or https://escape.tech/legal/privacy)
- Terms of Service: https://escape.tech/terms (or https://escape.tech/legal/terms)
- Legal Documentation: https://escape.tech/legal

**Key Questions:**
- Does the privacy policy explicitly permit commercial use?
- Are there any restrictions on enterprise deployment?
- What is the licensing model for commercial use?
- Any restrictions on testing production APIs?
- Any geographic restrictions?

### Data Training & Model Use
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Privacy Policy: https://escape.tech/privacy
- AI/ML disclosure in documentation
- Security documentation: https://docs.escape.tech/

**Key Questions:**
- Is customer API data used to train or improve AI models?
- How does the AI-powered pentesting work?
- Can customers opt out of data collection for model training?
- What API data is collected during testing (endpoints, payloads, responses)?
- Are test results used to improve detection algorithms?
- Is any data anonymized and aggregated for ML training?
- How are API schemas and specifications handled?

### Data Retention Policies
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Privacy Policy: https://escape.tech/privacy
- Data Processing Agreement (DPA)
- GDPR compliance documentation
- Documentation: https://docs.escape.tech/

**Key Questions:**
- How long is API test data retained?
- How long are vulnerability reports and scan results stored?
- What is the data deletion policy?
- Can customers request data deletion?
- Data retention for API traffic logs
- Data retention for discovered vulnerabilities
- Backup retention periods

### Data Sharing Policies
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Privacy Policy: https://escape.tech/privacy
- Subprocessor List
- Third-party integrations documentation

**Key Questions:**
- Is API data shared with third parties?
- Who are the subprocessors?
- Is vulnerability data shared across Escape customers?
- Are attack patterns aggregated/anonymized and shared?
- What data is shared with integrations (CI/CD, issue trackers)?
- Is any API data sent to external AI services (OpenAI, etc.)?

### IP & Confidentiality Concerns
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Terms of Service: https://escape.tech/terms
- Enterprise Agreement
- Intellectual Property Policy
- Confidentiality provisions

**Key Questions:**
- Who owns the IP rights to pentest results?
- Are there confidentiality protections for proprietary APIs?
- What happens to API specifications during testing?
- Are API endpoints and schemas stored?
- How is sensitive data in API responses handled?
- Are authentication tokens/credentials stored?
- Are there NDA provisions for enterprise customers?
- How are discovered vulnerabilities handled (disclosure policy)?

---

## Pricing & Plans

### Free Tier
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Pricing Page: https://escape.tech/pricing
- Documentation: https://docs.escape.tech/

**Information Needed:**
- **Features Included:** Which testing modules (OWASP API Top 10, business logic, etc.)
- **API Limits:** Number of APIs or endpoints that can be tested
- **Scan Limits:** Number of scans per month
- **User Limits:** Number of team members
- **Duration:** Is it free forever, trial period, or limited time?
- **Support Level:** Community, email, or no support?
- **Test Depth:** Limited vs full penetration testing capabilities
- **CI/CD Integration:** Available in free tier?

### Paid Plans
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Pricing Page: https://escape.tech/pricing
- Contact sales for enterprise pricing

**Plans to Document:**

#### Starter/Developer Plan (if available)
- **Cost:** $ per month or $ per API
- **Features:** List key features
- **Limits:** APIs, scans, users
- **Support:** Level of support included
- **Test Types:** Which vulnerability tests are included

#### Professional/Team Plan (if available)
- **Cost:** $ per month or $ per API
- **Features:** Advanced testing capabilities
- **Limits:** Higher limits or unlimited
- **Support:** Priority support, SLA
- **Additional:** Advanced reporting, custom rules

#### Enterprise Plan
- **Cost:** Custom pricing (contact sales)
- **Features:** Full feature set, custom testing, white-glove service
- **Limits:** Typically unlimited or very high
- **Support:** Dedicated support, SLAs, CSM, direct Slack/Teams channel
- **Additional:** Custom DPA, compliance certifications, on-premise deployment, air-gapped support
- **Services:** Professional services, custom integrations, training

---

## Usage Limits

### API Rate Limits
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- API Documentation: https://docs.escape.tech/api
- Rate Limiting Documentation

**Information Needed:**
- API requests per hour/day to Escape platform
- Different limits per plan tier
- Rate limit for scanning customer APIs
- Concurrent scan limits

### API/Application Limits
**Status:** REQUIRES MANUAL VERIFICATION
**Information Needed:**
- Number of APIs per organization
- Number of endpoints per API
- API specification size limits (OpenAPI, GraphQL schema size)
- Limits vary by plan tier

### Scan Limits
**Status:** REQUIRES MANUAL VERIFICATION
**Information Needed:**
- Number of scans per month
- Scan frequency (continuous vs scheduled)
- Concurrent scan limits
- Scan duration/timeout limits
- Test depth limits (number of requests per scan)

### User/Seat Limits
**Status:** REQUIRES MANUAL VERIFICATION
**Information Needed:**
- Minimum seats for paid plans
- Maximum team members
- Read-only user limits
- Guest/external user policies

### Integration Limits
**Status:** REQUIRES MANUAL VERIFICATION
**Information Needed:**
- Number of CI/CD integrations
- Webhook delivery limits
- Issue tracker integration limits

---

## Enterprise-Specific Considerations

### Compliance & Certifications
**Status:** REQUIRES MANUAL VERIFICATION
**Sources to Check:**
- Security/Trust page: https://escape.tech/security or https://escape.tech/trust
- Compliance documentation

**Check for:**
- SOC 2 Type II certification
- ISO 27001
- GDPR compliance
- CCPA compliance
- PCI-DSS relevance (for payment API testing)
- OWASP API Security Top 10 coverage
- Penetration testing certifications (CREST, OSCP, etc.)

### Deployment Options
**Status:** REQUIRES MANUAL VERIFICATION
**Check for:**
- Cloud-hosted (SaaS) - standard offering
- Self-hosted/on-premise options
- Private cloud deployment
- Air-gapped environment support (critical for pentesting)
- Hybrid deployment (control plane cloud, scanning on-prem)
- Data residency options (EU, US, etc.)

### Security Features
**Status:** REQUIRES MANUAL VERIFICATION
**Check for:**
- SSO/SAML support
- SCIM provisioning
- Role-based access control (RBAC)
- Audit logging
- Data encryption (in transit and at rest)
- Two-factor authentication (2FA)
- IP whitelisting
- API key management
- Secure credential storage for API authentication

### Testing Capabilities
**Status:** REQUIRES MANUAL VERIFICATION
**Check for:**
- OWASP API Security Top 10 coverage
- Business logic testing
- Authentication/authorization testing
- Rate limiting testing
- Input validation testing
- GraphQL-specific tests
- gRPC testing support
- REST API testing
- WebSocket testing
- Custom rule creation
- Compliance testing (PCI-DSS, HIPAA)

### Integration Ecosystem
**Status:** REQUIRES MANUAL VERIFICATION
**Check for:**
- CI/CD platforms (GitHub Actions, GitLab CI, Jenkins, CircleCI)
- Issue trackers (Jira, Linear, GitHub Issues)
- Communication (Slack, Microsoft Teams, email)
- API Gateways (Kong, Apigee, AWS API Gateway)
- Documentation platforms (Swagger, Postman)
- Cloud providers (AWS, Azure, GCP)

---

## Research Checklist

- [ ] Read complete privacy policy
- [ ] Review terms of service
- [ ] Check pricing page for current costs and plans
- [ ] Review API documentation for rate limits
- [ ] Check for Data Processing Agreement (DPA)
- [ ] Verify GDPR/compliance information
- [ ] Review documentation for deployment options
- [ ] Check security/trust center for certifications
- [ ] Test free tier if possible (understand sign-up requirements)
- [ ] Contact sales for enterprise-specific information
- [ ] Review integration documentation
- [ ] Check for customer case studies or testimonials
- [ ] Understand AI/ML capabilities and data usage
- [ ] Review vulnerability disclosure policy
- [ ] Check for bug bounty program

---

## Additional Resources

- Documentation: https://docs.escape.tech/
- Blog: https://escape.tech/blog
- GitHub: Check for open-source components, examples, or client libraries
- Status Page: Check for uptime/status page
- Support: Check for support portal or contact information
- Community: Discord, Slack, or forum

---

## Notes

**Important Considerations for Escape:**
1. **AI-Powered Testing:** Understand exactly how AI is used and what data feeds the models
2. **API Data Sensitivity:** APIs often contain business-critical data - verify how test traffic is handled
3. **Testing Production APIs:** Clarify if/how production API testing is supported safely
4. **Authentication Handling:** Critical to understand how API credentials and tokens are managed
5. **Vulnerability Disclosure:** Check if discovered vulnerabilities are reported externally or kept confidential
6. **Test Traffic Generation:** Understand volume and nature of test requests sent to customer APIs
7. **False Positive Rate:** Check if AI reduces false positives compared to traditional scanners
8. **Schema Requirements:** Verify if OpenAPI/GraphQL schemas are required or if discovery is automatic

**Critical Security Questions:**
- Does pentesting generate traffic that could trigger rate limits or WAF rules?
- How are API keys and credentials securely provided to the platform?
- Is there a way to test staging/development environments only?
- What happens if a critical vulnerability is discovered?
- Are pentest results encrypted at rest?

**Competitive Positioning:**
- Compare to: StackHawk, Astra Security, Veracode, HCL AppScan
- Note AI-specific advantages or limitations
- Evaluate API-specific features vs general application security

**Company Background:**
- Verify company funding, stability, and reputation
- Check for any security incidents in the past
- Review customer testimonials specific to enterprise use

**Last Updated:** [DATE TO BE ADDED AFTER RESEARCH]
**Researcher:** [TO BE COMPLETED]
**Verification Status:** Template - Requires Manual Research