Security
What we protect, and what we have not built yet
This page describes the current state of the product honestly. UxerProof holds no third-party security certifications and we do not claim any.
Tenant isolation
Every tenant-owned record belongs to exactly one workspace. Access is enforced in the database with workspace-aware row-level security, not only in application code. A user can read a row only when they are an active member of the owning workspace, and destructive operations additionally require an owner or admin role.
Authorised targets only
UxerProof will not execute a Circuit against a domain the workspace has not verified. Verification is performed with a DNS TXT record, a meta tag or a well-known file. There is no arbitrary-URL testing entry point, and the product is not designed to be pointed at systems you do not control.
Execution isolation
Circuit execution is designed to run in isolated, short-lived browser workers with no shared state between runs and no persistent browser profile. The execution service is not connected in this release; when it is, each Run receives a fresh sandbox that is destroyed at the end of the Run.
Credentials
UxerProof does not store reusable credentials. There is no plaintext secrets table and no credentials table of any kind in the schema. Authenticated Circuits are designed around short-lived, encrypted, scoped secrets injected at execution time and destroyed with the worker. Until that mechanism ships, Authenticated Circuits remain unavailable rather than being implemented insecurely.
Data minimisation
We store only what accounts, collaboration, reports, regression and billing genuinely require:
- Account and workspace metadata
- Project and environment configuration
- Domain-verification state
- AI User and Circuit definitions
- Structured run results
- Findings and Proof Scores
- User-selected or redacted evidence
- Baselines
- Retention settings
- Usage and billing ledger records
- Security-relevant audit events
We do not retain the following by default:
- Credentials in plaintext
- Complete browser profiles
- Raw HTML or DOM dumps
- Network request or response bodies
- Session cookies
- Full videos
- Unredacted form data
- Unnecessary page content
Retention controls
Standard retention
Structured reports, findings and baselines are kept for your plan's retention window. Raw execution artefacts are deleted within 24 hours of report generation.
Ephemeral Mode
Raw screenshots, traces and execution artefacts are deleted immediately after report synthesis. Structured reports and baselines are retained only when you explicitly choose to retain them.
No report retention
You export the report and all run data is scheduled for deletion. Nothing is kept beyond the usage ledger and audit record.
Audit
Security-relevant events — sign-in, membership change, domain verification, retention change, export and deletion — are recorded as audit events scoped to the workspace. Audit records are retained independently of evidence retention because they are how we prove what happened.
Analytics boundary
Customer application data, screenshots, findings and Circuit contents are never sent to marketing analytics. Product analytics, where used, are limited to aggregate interface events.
Not yet in place
- No SOC 2, ISO 27001 or comparable certification. None is claimed.
- No independent penetration test has been completed for this release.
- SSO/SAML is planned for Enterprise and is not available today.
- The execution service, secrets injection and evidence redaction pipeline are not deployed.
Reporting a vulnerability
Report suspected vulnerabilities through the support page. Please include reproduction steps and do not test against other customers' workspaces.