Checking that you've used cryptography properly is a little tricky, and requires special expertise. I would not expect a typical black-box penetration test to be a very effective way of checking it, or a good use of your money. Instead, you probably want a security audit or security review, preferably by someone familiar with cryptography.
One of the best ways to reduce risk is to minimize the extent to which you are designing your own encryption method. In cryptographer parlance: don't roll your own crypto. For instance, you might encrypt the data using GPG (or something that encrypts to OpenPGP format).
See Lessons learned and misconceptions regarding encryption and cryptology for further suggestions. Don't forget to use authentication (e.g., use authenticated encryption, or encrypt-then-authenticate). Use good key management (e.g., generate a truly random crypto key; don't generate your crypto key from a passphrase).