Instafill.ai completed an independent penetration test in January 2026
On January 19, 2026, Instafill.ai announced that an independent penetration test of its product was complete. The note was shared for transparency and to support customers' security reviews. The current security practices are on the Security and Privacy page.
Scope
The assessment covered the web application and the APIs, including the .NET gateway and the Python processing API. It looked at authentication and authorization, payment and subscription flows, and data access controls, across production and test environments.
Testing was aligned with common industry references: the OWASP Top 10 (2023), the OWASP API Security Top 10 (2023) and the CWE/SANS Top 25 categories.
Results
The assessment identified findings across different severity levels. Instafill.ai fixed the highest-severity findings first, then completed follow-up testing with Iterasec for the in-scope remediation items. The post does not list the findings.
SOC 2 Type II
The post said this penetration test is a required part of Instafill.ai's upcoming SOC 2 Type II external audit. The audit's status is on the compliance page.
Getting the full report
The complete 102-page penetration test report is available to customers and prospects evaluating Instafill.ai for their organization. To get a copy for a compliance or security review, email [email protected].
The post notes that third-party testing is often part of vendor security review for teams in healthcare, legal, finance and other regulated industries. Data encryption in transit and at rest is described on the Security and Privacy page.
