Security
Your tests, credentials and evidence stay yours.
What the product does today and what is still being built, stated plainly.
- Sign-in and roles
- Sign-in runs through Clerk. Every workspace has four roles: owner, lead, tester and viewer. A workspace always keeps at least one owner, and only an owner can make or remove one.
- Tenant isolation
- Every query is limited to your workspace in the application, and Postgres row-level security refuses other workspaces’ rows at the database.
- Secrets stay out of the product
- A connected repository names a secret instead of holding its token. The secret is read from a vault when it is used and never returned by the API.
- Audit log
- Changes to people, roles, settings and billing are recorded in a workspace audit log.
- Protected environments
- Only owners and leads can run, schedule or monitor against an environment marked protected, such as production.
- Where it runs
- The API runs on Azure in East US 2. Runner locations are Azure regions, starting with East US 2 and West Europe.
- Hosted by you
- Enterprise plans can run runners and secret vaults in your own environment, with keys you hold.
TestSapien is in early access. We have no SOC 2 report yet. Ask us at hello@testsapien.com for the security questionnaire.