Security at TestOwl

The TestOwl platform runs on Google Cloud. The application servers run on Google Cloud Run and project data is stored in a managed Cloud SQL PostgreSQL database, both in the us-central1 region in the United States.

When you run tests locally through the desktop app, the browser runs on your own computer. Screenshots, videos, logs and results are captured locally and then uploaded to your project so they appear in the run report, the same as a cloud run.

Data is encrypted in transit between your browser or desktop app and TestOwl. Data stored in Google Cloud is encrypted at rest by the platform.

Sensitive values get a second layer: project Secrets and integration credentials, such as Jira access tokens, are encrypted by TestOwl with AES-256-GCM before they are stored, and the encryption key is held in Google Secret Manager, separate from the database.

Passwords, API keys and tokens your tests need belong in Secrets. A Secret can be used in any test case or flow, but its value is never shown in the app, in run reports or in logs.

Your own TestOwl sign-in is protected too. Email and password accounts enter a one-time code sent to their email every time they sign in, and changing a password signs you out of every other device. You can sign in with Google, GitHub or Microsoft instead, in which case TestOwl never sees a password.

Every member of a project has a role — Owner, Admin, Editor or Viewer — and roles are set per project. Viewers can see tests and reports but cannot change them; Editors can build and run tests; Admins can also delete items, manage schedules and invite people; only Owners can manage billing or delete the project. See project roles for the full permission table.

Test runs can capture screenshots and video to help you debug failures, and those can contain customer details or payment data. Masking Rules hide parts of the page in captured screenshots and video, matched by visible text, CSS selector or XPath, while the test itself still reads and checks the real page.

If you connect Jira, nothing is sent until a person on your project chooses to send it, and TestOwl strips known Secret values, masking-rule matches and common credential patterns from the text first. Our Privacy Policy lists exactly what is shared.

TestOwl does not currently hold SOC 2 or ISO 27001 certification, and we will not claim one until it is in place. Today we rely on the safeguards described on this page. Our Privacy Policy explains the legal bases we use for processing personal information, how long we keep it, and the rights you have over your data.

If you believe you have found a security vulnerability in TestOwl, email [email protected] with "Security" in the subject line. Include the steps to reproduce it and the affected URL or app version. We acknowledge security reports within two business days.

Please give us a reasonable chance to fix the issue before you disclose it publicly, and do not access or change other customers' data while testing.