Test content, run results and traces sit in a hosted database, and model calls go to a provider. You need to know which, where and whether any of it trains a model.
For security reviewers
You are evaluating a vendor that will hold test data and keys. Here is what we can show you.
A testing tool touches staging systems, credentials and model-provider keys. This page answers the four questions a review usually starts with, says what we do not have, and lists who handles data on our behalf.
| Event | Resource | Actor | Status |
|---|---|---|---|
| Key rotation | Organization key | Org admin | Success |
| KMS provider updated | Organization key | Org admin | Success |
| Credential created | Project secret | Project admin | Success |
Example data. Each event also records its time.
What you need to establish
Four questions, answered from how the product works.
Provider keys and test credentials are the most sensitive thing you will hand over. You need to know how they are stored, who holds the master key and what leaves in an export.
Staging systems and test databases are often unreachable from the internet, and your firewall team will not open an inbound port for a vendor.
Reviewers ask for reports, not reassurance. You need to know what exists, what it proves and what it does not.
How CertiQA answers
Specific controls, each with its limit.
Data stays in a defined place
Data is encrypted in transit with TLS, including the connection from the API to the database, which is checked against the AWS certificate authority. Core infrastructure and database storage run on AWS in us-east-1, encrypted at rest with AWS KMS keys. Test conversations, tool-call arguments, API request and response bodies and production traces are also encrypted by the application before they are stored. Customer data and test traces are not used to train public foundation models. Model calls during a run go to the provider you configure, or the platform default if you have not added your own keys.
The platform-default model provider and configured providers may receive the content sent to them. The subprocessor list below is versioned and dated; entries marked "details to be confirmed" are in use, and their contracting entity and processing region are still being verified.
You can check
- The subprocessor table on this page.
- A workspace administrator accepts the Data Processing Addendum in the product before any test can run.
Keys are encrypted, versioned and rotatable
Secrets such as LLM provider keys and third-party credentials are encrypted at rest with AES-256-GCM envelope encryption. Data encryption keys are wrapped by a master key. Key versions are tracked, and an organization admin can rotate the key, which re-encrypts stored secrets under the new version. On Enterprise Ultra the master key can be your own AWS KMS or HashiCorp Vault key.
Keys are never exposed in browser builds. When you export a suite to Playwright code, secrets are replaced with process.env references. Multi-provider bring-your-own-key is on Team Pro Plus and Enterprise Ultra.
Rotate when no run depends on reading a secret at that moment, and check the audit trail afterwards.
Who can act
- Key rotation and billing: organization admin only.
- Quarantine and gate overrides: a separate approver role.
- Eight roles across organization, project and runner scope.
- SAML SSO through WorkOS on Enterprise Ultra.
Runners that dial out, never in
A customer-hosted runner is a container you deploy in your own cloud network, as a Docker container, an ECS task or a Kubernetes deployment. It starts every connection itself, outbound over HTTPS, to register, pick up work and report results. No inbound firewall port is opened, and test data, database calls and test credentials for those runs stay inside your network.
Available on Enterprise Ultra. A segment with no outbound access at all cannot reach CertiQA, and there is no fully offline version.
your network
runner --- HTTPS (outbound) ---> CertiQA
staging app, test database,
test credentials stay here
no inbound ports openedTwo kinds of evidence
Each organization has a security audit trail of key rotations, KMS provider updates and credential lifecycle actions, with the time, event type, resource, actor and status. Separately, a Release Report records measured test results for a signed-off run or a date range, with a SHA-256 hash so edits are detectable.
The audit trail is a record of security-relevant account changes, not a log of everything done in the product. A Release Report is evidence for a reviewer, not a certification, and its audit-log section is platform-wide.
Not held
CertiQA does not currently hold SOC 2 or ISO 27001 reports. We would rather say so here than in a questionnaire.
Subprocessors
Who handles data on our behalf
| Subprocessor | Purpose | Location |
|---|---|---|
| Amazon Web Services, Inc. | Core cloud infrastructure, database and artifact storage | United States (us-east-1) |
| Cloudflare, Inc. | Edge routing, CDN, DDoS mitigation and bot checks | Global edge network |
| WorkOS, Inc. | Authentication, enterprise SSO and directory sync | United States |
| Stripe, Inc. | Payment processing and subscription billing | United States |
| Brevo (Sendinblue SAS) (details to be confirmed) | Transactional email (approvals, invitations, billing, support and alert emails) and the early-access list | European Union (to be confirmed) |
| Mailtrap (Railsware) (details to be confirmed) | Backup transactional email, used only if the primary email provider fails | To be confirmed |
| Google LLC (Gemini) (details to be confirmed) | Platform-controlled model processing for AI features | Provider-dependent (contracting entity and region to be confirmed) |
| Anthropic, PBC (details to be confirmed) | Platform-controlled model processing for AI features | Provider-dependent (contracting entity and region to be confirmed) |
| Provider | Purpose | Location |
|---|---|---|
| Customer-selected model providers | AI feature processing with a provider account or self-hosted endpoint the customer configures, such as OpenAI, Anthropic, Gemini or a self-hosted model. The customer controls this relationship and its terms. | Chosen by the customer |
List version 2026-10-26, last updated 2026-10-26. Entries marked "to be confirmed" are in use or planned, but the contracting entity and processing region are still being verified. The Data Processing Addendum uses this list. A DPA must be accepted before personal data is processed for a customer. For a security questionnaire or vulnerability report, email [email protected].
FAQ
Questions security reviewers ask
Where does our data go when we use CertiQA?
Test definitions, run results and traces are stored in CertiQA's database on Amazon Web Services in us-east-1. Data is encrypted in transit with TLS, including the connection from the API to the database, which is verified against the AWS certificate authority. The database and stored files are encrypted at rest with AWS KMS keys. Conversations, tool-call arguments, API request and response bodies and production traces are encrypted again by the application before they are stored, and secrets are encrypted at rest. During a run, model calls go to the LLM provider you configure, or to the platform default if you have not added your own keys. CertiQA does not use customer data or test traces to train public foundation models.
How are secrets and LLM API keys encrypted?
Secrets such as provider keys and third-party credentials are encrypted at rest with AES-256-GCM envelope encryption. Data encryption keys are wrapped by a master key, and key versions are tracked so an organization admin can rotate the key and re-encrypt stored secrets. On Enterprise Ultra the master key can be your own AWS KMS or HashiCorp Vault key. Keys are never exposed in browser builds, and secrets in an exported Playwright suite are replaced with process.env references.
See which plans include BYOKCan runs stay inside our own network?
Yes, on Enterprise Ultra. A customer-hosted runner is a container you deploy in your own cloud network. It starts every connection itself, outbound over HTTPS, to pick up work and report results, so no inbound firewall port is opened. Test data, database calls and test credentials used by those runs stay inside your network. A network with no outbound access at all cannot reach CertiQA, and there is no fully offline version.
Who can see and change what in our account?
Access is role-based, with eight roles across organization, project and runner scope. Key rotation and billing need the organization admin role, and approving a quarantine or quality-gate override needs a separate approver role from the person who wrote the test. SAML single sign-on through WorkOS is included on Enterprise Ultra.
What evidence can we get for our own review?
A security audit trail for each organization records key rotations, KMS provider updates and credential lifecycle actions, with time, event type, resource, actor and status. It is a record of security-relevant account changes, not a log of everything done in the product. Separately, a Release Report records measured test results for a signed-off run or a date range, with a SHA-256 hash so edits are detectable. It is evidence for a reviewer, not a certification.
Does CertiQA hold SOC 2 or ISO 27001 certification?
No. CertiQA does not currently hold SOC 2 or ISO 27001 reports and does not claim to. For a vendor review, email [email protected] with your questionnaire. Our Data Processing Addendum is published at certiqa.app/dpa, and a workspace administrator accepts it in the product before any test can run.
Which subprocessors does CertiQA use?
Stripe for billing, WorkOS for identity and SAML SSO, Amazon Web Services for core infrastructure and database storage in us-east-1, Cloudflare for edge routing and DDoS mitigation, Google for the platform-default Gemini model, and any model provider you configure. We also use a transactional email provider; its identity must be confirmed in the published subprocessor list before production launch.
How do I report a vulnerability?
Email [email protected] with the details. We welcome responsible security research and will respond to your report.
Send us your questionnaire.
Tell us what your review needs and we will answer from how the product works. If you want to see the controls yourself, the 14-day trial is open to an engineer on your team.