Security practices

Data in transit and at rest

All traffic to CogentRun is served over HTTPS with modern TLS. Workspace data, run artifacts, and vault entries are stored encrypted at rest by our hosting and storage providers. Encryption details and providers: TLS 1.2+ in transit and encryption at rest; vault secrets are additionally encrypted with Fernet (AES-128-CBC with HMAC) before they reach the database.

Credential vault

• Test credentials are encrypted before storage and decrypted only inside a run.
• Secrets are injected into the browser session, not written into test text or logs.
• Vault values are never displayed back in full after saving.

Use dedicated test accounts with the least privilege the flow needs. Do not put production admin credentials or live payment instruments in the vault.

Access control

• Data is scoped to your workspace; members only see their organisation's suites and runs.
• Passwords are stored as salted hashes, never in recoverable form.
• Internal access to customer data is limited to staff who need it for support or incident response, and is logged. Available account controls (roles, retention settings): role-based access control and an audit log of account changes.

Integrations

Jira, GitHub, and Bitbucket connections use the scopes you approve and can be revoked at any time from the source tool or from your workspace settings. Revoking a connection stops further reads immediately; content already used to generate tests stays in your workspace until you delete it.

Integration tokens are encrypted before storage and are read through a single internal path, so no part of the product holds its own copy. Tokens are never written to run logs or reports. Incoming webhooks are authenticated — signature-verified where the provider supports it — and are rate-limited and de-duplicated so a noisy tracker cannot trigger a flood of analyses against your wallet.

Grant the narrowest scope that works. If a repository does not need to be readable for the outcome you want, do not include it in the connection.

Untrusted content and prompt injection

The agent reads material written by people other than you: Jira tickets and comments, pull request descriptions and diffs, repository files, and the live DOM of the application under test. Any of it could contain text designed to steer an AI agent. We treat all of it as untrusted data rather than instructions, and wrap it before it reaches a model so the boundary between your instruction and third-party content stays explicit.

We call this out plainly because the risk is real rather than theoretical: an analysis can be configured to post its result back into your tracker automatically, which is a path from injected content to an action in your systems. Two controls we recommend on your side: keep automated posting off for projects where an unreviewed comment would cause harm, and give the integration only write access it actually needs.

Where the agent is allowed to go

Every externally supplied URL the platform will fetch or navigate to is validated before use. All resolved addresses are checked in both IPv4 and IPv6, non-HTTP schemes are rejected, and addresses in private, loopback, and link-local ranges are refused — so a target URL cannot be used to reach internal infrastructure. Redirects are re-validated rather than trusted.

Test isolation

Runs execute in isolated cloud browser sessions and on managed real devices, which are reset between runs so state and cookies do not leak between customers. Device and browser infrastructure providers: Amazon Web Services (compute, object storage, mobile and browser device testing, email) and AWS RDS (managed PostgreSQL).

Retention and deletion

You can delete a suite, a run, or an entire workspace. Deletion removes recordings, screenshots, and reports for that scope. Default artifact retention and backup windows are listed in the privacy policy.

Certifications and audits

We are actively preparing for SOC 2 Type II and ISO 27001 compliance. We do not claim any certification we have not completed. Current status: No formal certifications yet — available on request as we pursue SOC 2. If you need a security questionnaire, DPA, or penetration test summary, ask us and we will tell you exactly what exists today.

Reporting a vulnerability

If you believe you have found a security issue, email info@cogentrun.com with steps to reproduce and the impact you observed. Please give us reasonable time to fix it before disclosing publicly, avoid accessing other customers' data, and do not run load or denial-of-service tests against our infrastructure. We will acknowledge reports within 2 business days. We do not currently run a paid bounty programme unless stated otherwise.