Invicti Web + API, formerly sold as Acunetix, is a web application security scanner. It tests websites and APIs for vulnerabilities, including the OWASP Top 10 and OWASP API Top 10, and also finds business logic flaws. It is offered as a subscription service through the vendor's platform. Under the Invicti name the vendor also offers a wider application security platform.
The vendor, Invicti Security, is headquartered in Austin, Texas. The company is therefore subject to US law, including the possibility of access under the US CLOUD Act. According to its privacy policy, customer data is processed in Amazon Web Services regions, with the location decided case by case based on the customer's location, but the regions are not named. Customers sign a data privacy addendum. For EEA users the vendor names a representative in Malta. No self-hosted or open-source option is described on the vendor's pages, so European organisations should weigh the US headquarters and the unnamed hosting regions.