# Security at TestOwl

> How TestOwl protects your data: encryption, hosting, access control, credential storage and our current compliance status for QA teams.

## Where Your Data Lives

The TestOwl platform runs on Google Cloud: application servers on Google Cloud Run and project data in a managed Cloud SQL PostgreSQL database, both in the us-central1 region (United States). Local runs execute in a browser on your own computer; screenshots, videos, logs and results are then uploaded to your project.

## Encryption

Data is encrypted in transit between your browser or desktop app and TestOwl, and data stored in Google Cloud is encrypted at rest by the platform. Project Secrets and integration credentials (such as Jira access tokens) are additionally encrypted by TestOwl with AES-256-GCM, with the key held in Google Secret Manager, separate from the database.

## How Credentials Are Stored

Passwords, API keys and tokens your tests need belong in [Secrets](https://help.testowl.ai/docs/data/secrets). Secret values are never shown in the app, run reports or logs. Email and password accounts use a one-time email code at every sign-in; Google, GitHub and Microsoft sign-in is also supported.

## Access Control

Project members have a per-project role: Owner, Admin, Editor or Viewer. Viewers can only view; Editors build and run tests; Admins also delete items, manage schedules and invite people; only Owners manage billing or delete the project. See [project roles](https://help.testowl.ai/docs/team-and-account/project-roles).

## Data Captured During a Run

[Masking Rules](https://help.testowl.ai/docs/data/masking-rules) hide parts of the page in captured screenshots and video, matched by text, CSS selector or XPath, while the test still checks the real page. Text sent to Jira has Secret values, masking-rule matches and common credential patterns removed first.

## Compliance

TestOwl does not currently hold SOC 2 or ISO 27001 certification. The [Privacy Policy](https://testowl.ai/privacy-policy) explains our legal bases for processing personal information, retention, and your rights over your data.

## Reporting a Vulnerability

Email team@testowl.ai with "Security" in the subject line, the steps to reproduce and the affected URL or app version. We acknowledge security reports within two business days. Please allow us to fix an issue before disclosing it publicly.