What we protect, and what we have not built yet

Tenant isolation

Every tenant-owned record belongs to exactly one workspace. Access is enforced in the database with workspace-aware row-level security, not only in application code. A user can read a row only when they are an active member of the owning workspace, and destructive operations additionally require an owner or admin role.

Authorised targets only

UxerProof will not execute a Circuit against a domain the workspace has not verified. Verification accepts an exact DNS TXT record, HTML meta tag or well-known text file. HTTP-based checks use only the Environment's HTTPS origin, reject redirects and private network targets, and require an exact issued token. There is no arbitrary-URL testing entry point, and the product is not designed to be pointed at systems you do not control.

Execution isolation

Circuit execution uses an isolated browser context for each Run and does not reuse a persistent browser profile. The production runner feature remains disabled until its exact release candidate and worker boundary are attested. Enabling that feature is a separate operational decision, not part of publishing this site.

Credentials

UxerProof does not store reusable credentials. There is no plaintext secrets table and no credentials table of any kind in the schema. Authenticated Circuits are designed around short-lived, encrypted, scoped secrets injected at execution time and destroyed with the worker. Until that mechanism ships, Authenticated Circuits remain unavailable rather than being implemented insecurely.

Data minimisation

We store only what accounts, collaboration, reports, regression and billing genuinely require:

• Account and workspace metadata
• Project and environment configuration
• Domain-verification state
• AI User and Circuit definitions
• Structured run results
• Findings and Proof Scores
• User-selected or redacted evidence
• Baselines
• Retention settings
• Usage and billing ledger records
• Security-relevant audit events
• Support requests you explicitly submit

We do not retain the following by default:

• Credentials in plaintext
• Complete browser profiles
• Raw HTML or DOM dumps
• Network request or response bodies
• Session cookies
• Full videos
• Unredacted form data
• Unnecessary page content

Browser traces are disabled. Page content and screenshots are disabled by default. Where a reviewed Test Contract explicitly enables them for a documented purpose, content is redacted, form and editable values are masked, URL queries and fragments are removed, and capture is suppressed on authentication, recovery, payment and billing routes. Password, token and payment-credential capture cannot be enabled by a customer override.

Retention controls

Audit

Security-relevant events — sign-in, membership change, domain verification, retention change, export and deletion — are recorded as audit events scoped to the workspace. Audit records are retained independently of evidence retention because they are how we prove what happened.

Analytics boundary

Customer application data, screenshots, findings and Circuit contents are never sent to marketing analytics. Product analytics, where used, are limited to aggregate interface events.

Not yet in place

• No SOC 2, ISO 27001 or comparable certification. None is claimed.
• No independent penetration test has been completed for this release.
• SAML SSO is implemented for Enterprise and remains gated until a tenant and its domains are configured and verified.
• The execution service, secrets injection and evidence redaction pipeline are not deployed.

Reporting a vulnerability

Read the responsible-disclosure guidance before reporting a suspected vulnerability. Do not access another customer's workspace or include live secrets or personal data in a report.