Attestation letter
What is an attestation letter (TPM)?
The report is for you. The attestation letter (TPM, Third Party Memorandum) is for everyone else: a two-page statement with which you show a customer, auditor, investor or insurer that your application has been tested and what the outcome was, without handing over your findings. Some call it a pentest certificate or a letter of attestation; it is the same thing.
Why you need two documents
A pentest report contains exactly what an attacker would want to know: which vulnerabilities there were, where, and how to reproduce them. That document goes to your developers, not to a customer who sends you a security questionnaire. But that customer does want proof. That is what the attestation letter is for.
What an attestation letter contains
- Who tested, with which certifications and on behalf of which entity.
- What was tested: the application, the environment, the user roles, the period.
- How it was tested: manually, against OWASP WSTG and ASVS Level 2.
- The outcome as a count of findings per severity, without detail.
- The status after retest: what was resolved, what was formally accepted.
- Signature and date.
What it doesn't contain
No description of findings, no endpoint, no proof of concept, no technical detail. Nothing in the attestation letter can be used against you. That is the entire design.
Who asks for it
- A customer with a security questionnaire. The question "have you had a recent pentest?" is answered with an attestation letter, not a report.
- An auditor for SOC 2, ISO 27001 or ENS, as evidence of technical testing within the audited period.
- An investor doing due diligence.
- An insurer who wants to see a test before writing or renewing a cyber policy.
One statement per retest round
The attestation letter describes the situation at the time of the test. After every retest round you get a signed statement of what has been resolved since. So you can send a customer the attestation letter first and, three weeks later, the statement that the findings are gone — without ever telling them what they were.
It is not an audit report
My attestation letter is the tester's statement about the test he carried out himself. It is not an assurance report issued by an auditor under an auditing standard. An auditor uses it as evidence; it doesn't replace their opinion. If your auditor has questions about the attestation letter, I answer them directly and free of charge.
See an example
Download the sample attestation letter: two pages, entirely fictional, only the structure is real. If you also want to see what your developers get, download the sample report.
FAQ
Frequently asked questions
Will my auditor accept an attestation letter?
In practice yes, as evidence of a test carried out within the audited period. If you want certainty, send them the sample attestation letter before the test. I align the scope with your system description so the letter covers what the auditor wants to see.
Can I share the attestation letter?
Yes, that is what it is for. Bear in mind it names your application and the test period. Share it with whoever asks; don't publish it on your website.
Do I get an attestation letter if nothing is found?
Yes. Then it says exactly that — and that is precisely the document you want to show.
Is it the same as a pentest certificate?
Yes. Pentest certificate, letter of attestation, attestation letter, TPM: different names for the same document — the tester's statement that the test was done, on what, how and with what outcome. It is not a certificate issued by a body, nor an audit report.
A 30-minute call is enough to know whether this fits.
Book a scoping callPrefer email? Send your scope to info@hacketico.es — within 24 hours on working days you'll know whether it fits in 5 days and what it costs.