Security
BitAssure holds your sign-in details and pictures of your product in use. This page says plainly how that is protected, and what we have not built yet.
The part specific to what we do
Most services hold your account details. We also hold screenshots and video of your application in use, because that is what makes a failing check possible to understand.
That material is treated as yours. We store it to show back to you and the people in your organisation, and for nothing else. We do not analyse it, mine it, or use it to train models.
Because you decide what BitAssure looks at, the strongest protection is on your side: test against staging environments with made-up data rather than real customer records.
Encrypted in transit and at rest
What is in place today
Passwords are never stored
We keep a one-way hash, so nobody, including us, can read your password back out. Sign-in attempts are rate limited by address and by account.
Sessions survive a database leak
Your session token is stored only as a hash. A copy of our database does not hand anyone a set of live sessions to walk in with.
Your data is scoped to your organisation
Every request is checked on the server against the organisation that owns the resource. Nothing relies on the browser to ask nicely for the right thing.
Encrypted in transit and at rest
Traffic runs over TLS. Screenshots and recordings are encrypted where they are stored, and are only served to people signed in to your organisation.
Recordings expire on their own
Screenshots and video are deleted automatically once they pass the retention window on your plan. You can delete any of it sooner.
Machine access is separate
API keys used by build pipelines identify an organisation, never a person, and can be revoked individually without disturbing anyone's sign-in.
What is not built yet
We would rather you knew the gaps before signing up than found them afterwards. None of the following exists today.
- On the roadmap
Single sign-on
SAML and OIDC so you can manage access through your existing identity provider rather than separate passwords.
- On the roadmap
Roles and permissions
Today, everyone in an organisation can do everything. Read-only and per-project roles are planned.
- On the roadmap
Private environments
Testing systems that are not reachable from the internet, through a connector inside your own network.
- On the roadmap
Independent audit
We have not been through a formal certification. When we are, this page will say which one and when.
Reporting a vulnerability
If you believe you have found a security problem, email security@bitassure.app with enough detail to reproduce it. We will acknowledge within two working days and keep you updated until it is resolved.
Please do not test against other customers' accounts or data while investigating. We will not pursue action against anyone who reports a genuine issue in good faith and gives us a reasonable chance to fix it first.