Privacy

The short version

asserty runs the browser inside your own network, on a runner you install. We do not crawl your application, and nothing connects inward to it. What reaches us is what a run produces: the instructions, the screenshots captured at each step, and the model's reasoning.

What the hosted service stores

• Account data — your email address, display name, organization membership and role.
• Authored content — applications, test cases, instructions, routines, skills and suites.
• Test users you create for the application under test, including any credentials you enter.
• Run records — status, verdict, timings, token counts and a screenshot for each step.
• Runner metadata — name, version, last-seen time and a hash of the runner token.

Credentials

Model provider API keys are write-only: they are stored encrypted and never returned by the api once saved. Runner tokens are stored only as a hash and cannot be read back after creation — rotating a token revokes the previous one immediately. Test-user credentials you store are held so a run can use them, and are visible to members of your organization.

Model providers

You bring your own provider — OpenAI, Azure OpenAI or Anthropic. Model calls are proxied through the api so that no key is ever present on a runner. The content of a run, including screenshots of your application, is sent to the provider you configured, and their terms apply to that processing.

Separation between organizations

Every tenant-scoped record carries an organization discriminator enforced at the persistence layer, so one organization's data is not reachable from another's session.

Authentication

Sign-in is handled by Keycloak using OpenID Connect. Sessions use a short-lived access token and an httpOnly refresh cookie. Optional time-based one-time-password multi-factor authentication is available, with encrypted seeds and hashed recovery codes.

Self-hosting

If you run asserty yourself, none of the above involves us. Your deployment holds all of it, and the only external service is the model provider whose key you supply.

Contact

Questions about this document, or a request about data we hold, can go to [email protected].