// security & trust
Know what you’re connecting, what AegisRunner stores, and how access is controlled before you run your first test.
// platform controls
Saved App access tokens, session-cookie values, custom headers, and login scripts are encrypted before database storage using AES-256-GCM. The testing service decrypts the credentials it needs to sign in and run your authorized workflows.
Private test artifacts are accessed through an authenticated endpoint that checks project access before issuing an expiring download link. These links expire after 15 minutes. Treat a generated link or downloaded file as sensitive information.
Project access is checked against your membership and workspace role. Write operations use additional permission checks. Review who belongs to your workspace and projects as your team changes.
Enable two-factor authentication in account security settings and keep your recovery codes somewhere safe. Connections to the AegisRunner website and app use HTTPS.
// data handling
Depending on the workflow, AegisRunner processes the URLs and app builds you provide, page content, test definitions, screenshots, recordings, and execution logs. Screenshots and logs can contain information displayed in your application. Use dedicated test accounts and representative test data.
AI features send relevant test context to model providers to analyze pages and generate or review tests. Image-based analysis can include screenshots. Provider processing depends on the feature and configuration; ask us to review the provider and retention requirements for your use case before supplying sensitive data.
Uploaded mobile builds are stored in private object storage. Cloud real-device testing transfers the build to the device-testing provider to execute your tests. See the privacy policy for the mobile-build processing details.
Localhost and private-network workflows let you test apps that are not publicly reachable. This describes how the target is reached; it does not mean all testing, AI processing, or evidence storage stays on your machine. Review the workflow’s data path with us if you need a specific deployment boundary.
Retention depends on the data type and your account settings. The privacy policy explains retention and deletion requests. Export supported web suites as Playwright TypeScript when you want to maintain the test code yourself. Contact us for a data-handling review or deletion request.
Need to assess a sensitive workflow, review a security questionnaire, or report a concern? Contact the AegisRunner team. Share the scope of your question; keep passwords and API keys out of your message.