Security & Trust

How TestPerfect protects your code, your test data and your customers' information.

EncryptionAES-256-GCM at rest · TLS in transit
UK GDPR / EU GDPRDPA available on request
Self-hosted test agentsAvailable
SOC 2 Type IIPlanned

Data protection

  • ✓All traffic served over HTTPS, and the application connects to its managed Postgres database over TLS.
  • ✓Integration secrets — AI provider keys, Jira API tokens and Azure DevOps PATs — are encrypted with AES-256-GCM by the application before they are written to the database, so they are never stored in plain text.
  • ✓Test artefacts (screenshots, logs, videos) are written to the machine executing the test and indexed against that execution; artefacts captured by a self-hosted agent stay on your own infrastructure.
  • ✓Exported reports and documents are generated in your browser and downloaded directly — they are never stored on our servers.
  • ✓Deleted organizations, projects and test cases are recoverable from Archive for 3 months, and every test case keeps a full version history with compare and rollback.
  • ✓Customer code, requirements, test cases and uploaded documents are never used to train third-party AI models.

Identity & access

  • ✓Authenticated sessions via NextAuth with HTTP-only secure cookies.
  • ✓Sign in with Google Workspace via OIDC on every plan; Microsoft Entra ID sign-in is supported and enabled on request. Identities without a verified email from the provider are refused.
  • ✓Passwords are hashed with bcrypt, and "sign out everywhere" revokes every active session for an account.
  • ✓Role-based access control across organizations, projects and releases.
  • ◷SAML 2.0 for Okta, OneLogin and Ping, and SCIM 2.0 user provisioning — scoped for Enterprise customers, talk to sales.Planned

Application security

  • ✓Automated secret scanning on every push, and dependency vulnerability checks on every build with weekly automated update PRs.
  • ✓Server secrets live in the hosting provider's encrypted environment configuration, never in the application database.
  • ✓Diagnostic and maintenance endpoints are not exposed in production; privileged API routes require an authenticated session.
  • ◷Independent third-party penetration test.Planned

Privacy & data residency

  • ✓Data Processing Agreement (DPA) available on request, covering UK GDPR and EU GDPR.
  • ✓Our sub-processors are listed below; customers with a DPA are notified before a new one is added.
  • ✓Right to erasure: delete your account from the Account page and every row that references you is removed in a single transaction.
  • ◷Self-service data export from the Account page (available today on request).Planned
  • ◷Choice of EU or US data residency.Planned

AI usage

  • ✓Bring your own LLM API key (OpenAI, Azure OpenAI, Anthropic, Google and others). Organization admins can refuse the platform's shared key entirely, so every AI call is billed to and governed by your own provider account.
  • ✓Admins can restrict which AI providers and models their organization may use.
  • ✓Hallucination guardrails on all citation and clause-extraction AI features (see Industry Standards).

Operational security

  • ✓Documented incident response process; affected customers are notified without undue delay, and within 72 hours of a confirmed personal-data breach.
  • ✓Managed Postgres with point-in-time recovery, and periodic restore tests.
  • ✓Multi-factor authentication on every administrative account used to operate the service.
  • ✓Append-only audit log of privileged actions — sign-in and sign-in denials, password and API-token changes, and organization deletion or restore — with CSV export for review. Credentials are redacted before they are ever written.
  • ◷Direct audit-log streaming to SIEM (Splunk, Datadog).Planned
  • ◷Public status page and uptime SLA.Planned

Sub-processors

  • VercelApplication hosting
    NeonManaged Postgres database
    RenderHosted test-execution services
    OpenAIAI features (when using the platform key)
    AnthropicAI features (when selected)
    GoogleAI features (Gemini, when selected) and Google sign-in
    ResendTransactional email
    Stripe and PayPalPayment processing
    HubSpotSales and support contact records

Reporting a vulnerability

  • Email info@testperfectlimited.co.uk with "Security report" in the subject. We acknowledge reports within 3 business days and won't take action against good-faith research that avoids privacy violations and service disruption.

Need a security review?

We can share our security overview and DPA, and complete your security questionnaire.