> ## Documentation Index
> Fetch the complete documentation index at: https://docs.testdino.com/llms.txt
> Use this file to discover all available pages before exploring further.
# TestDino Data Security and Privacy
> TestDino is SOC 2 Type 2 and ISO 27001 certified and GDPR compliant. Encryption, retention, scrubbing, deletion, and AI controls in one place.
TestDino is SOC 2 Type 2 and ISO 27001 certified, GDPR compliant, and encrypts data in transit and at rest.
## Quick Reference
| Topic | Summary |
| :-------------------------------------------------------- | :--------------------------------------------------------------------- |
| [Certifications](#certifications) | SOC 2 Type 2, ISO 27001, GDPR |
| [Encryption](#encryption) | AES-256 at rest, TLS 1.2+ in transit |
| [Hosting and infrastructure](#hosting-and-infrastructure) | SOC 2 audited cloud infrastructure, private networks, separate backups |
| [Access control](#access-control) | Role-based, least-privilege, logged support access |
| [Data retention](#data-retention) | By plan: Free 7 days, paid 21 days artifacts and 90 days test data |
| [Sensitive Data Scrubbing](#sensitive-data-scrubbing) | Secrets masked on upload, before they reach the dashboard |
| [Data removal](#data-removal) | Export any time, 30 days after termination, then deletion |
| [AI controls](#ai-controls) | Per-project toggles, no model training on customer content |
| [Report a vulnerability](#report-a-vulnerability) | Acknowledged within 2 business days |
## Certifications
TestDino maintains independent third-party certifications covering security, availability, and confidentiality.
| Standard | Scope | Covers |
| :----------- | :-------------------------------------- | :------------------------------------------------------------------------------------- |
| SOC 2 Type 2 | Security, Availability, Confidentiality | Operating effectiveness of controls over time |
| ISO 27001 | Information security management | Risk-based ISMS with annual surveillance audits |
| GDPR | Data protection | Data Processing Agreement and Standard Contractual Clauses for international transfers |
A Data Processing Agreement is available for customers who require one. For audit reports or a signed DPA, email **[support@testdino.com](mailto:support@testdino.com)**.
## Encryption
Customer data is encrypted both in transit and at rest.
| State | Method |
| :------------- | :-------------------------------------------- |
| In transit | HTTPS with TLS 1.2 or higher |
| At rest | AES-256 via cloud platform encryption |
| Key management | Provider-managed keys with automatic rotation |
## Hosting and infrastructure
TestDino runs on a SOC 2-audited cloud provider with redundant power, networking, and storage.
* Production databases run in private virtual networks and are not exposed to the public internet.
* Automated backups are stored separately from production.
* Incident response procedures are documented and followed for security events.
For internet-facing services and firewall configuration, see [Network Endpoints](/security/network-endpoints).
## Access control
Production access follows role-based, least-privilege defaults.
* TestDino staff do not browse customer test data or traces in normal operation.
* Support access to a customer account requires the customer's permission and is logged.
* A customer can request removal of their data per the contractual terms.
On your side, [Single Sign-On](/platform/organizations/single-sign-on) routes your team through your own identity provider over OIDC and can block password sign-in on domains you verify. [SCIM Provisioning](/platform/organizations/scim-provisioning) removes a user's access and frees their seat when you unassign them in that provider.
## Data retention
Free keeps test evidence and test history for 7 days. Paid plans keep evidence for 21 days and history for 90 days. Trends and analytics run from 1 month on Free to custom on Enterprise.
The full matrix, manual test record caps, and storage quotas are on [Retention and Limits](/security/retention-and-limits).
## Sensitive Data Scrubbing
TestDino scans test artifacts for secrets and replaces them with masked values before they appear in the dashboard. Scrubbing happens on upload, not on display, so secrets never reach the dashboard at all.
**Note**
Sensitive Data Scrubbing is an Enterprise plan feature. Contact **[support@testdino.com](mailto:support@testdino.com)** to enable it.
| Pattern type | Examples |
| :-------------------- | :------------------------------------------------------------------ |
| API keys | `sk_live_*`, `sk_test_*`, `api_key_*`, `AKIA*` (AWS) |
| Authentication tokens | Bearer tokens, JWT tokens, OAuth access and refresh tokens |
| Passwords | Password fields in configuration, connection strings |
| Environment variables | `DATABASE_URL`, `SECRET_KEY`, `PRIVATE_KEY`, custom secrets |
| Connection strings | Database URIs containing credentials |
| Private keys | RSA and EC private key blocks, PEM-encoded certificates |
| Cloud credentials | AWS secret keys, GCP service account keys, Azure connection strings |
Matches are replaced with `*********` across traces, console output, test step errors, network logs, and inline attachments. Test titles, file paths, git metadata, and timing data are left as they are.
### What gets scrubbed
| Artifact Type | Scrubbing scope |
| :----------------- | :------------------------------------------------------------------------------------- |
| Playwright traces | Environment variables, inline secrets, auth tokens in network request/response headers |
| Console output | Logged secrets, connection strings, token values |
| Test step errors | Secrets in error messages or stack traces |
| Network logs | Authorization headers, cookie values, API keys in URLs |
| Inline attachments | Secrets in base64-decoded attachment content |
Originals are kept encrypted with AES-256, restricted to designated security administrators, and opened only during a security investigation. Every access is logged.
Application logs are scrubbed separately at the infrastructure level on all plans: passwords, tokens, and API keys are stripped, and audit logs record user ID, action, resource, and IP address.
## Data removal
Export your data at any time through the dashboard or the API. When a subscription ends, data stays available for 30 days, then is deleted. Deletion requests during the term are handled per your contract.
Data that reaches the end of its retention period is deleted automatically, and expired test runs cascade to their suites, cases, and stored artifacts.
## AI controls
AI features run on enterprise AI providers under contractual terms that prohibit training their models on customer content.
AI processing is controlled per project. A master toggle controls all AI analysis at once, and 5 features toggle independently, so you can keep failure categorization on while turning off everything else. With a toggle off, no test data is sent to AI models for that feature.
| Toggle | Controls |
| :---------------------------- | :-------------------------------------------------------- |
| **Master toggle** | All AI-powered analysis and insights |
| **Failure Categorization** | Assigning a category and confidence score to each failure |
| **Dashboard Insights** | AI summaries on the project dashboard |
| **Test Run Insights** | AI analysis on an individual test run |
| **AI Insights Page** | The cross-run AI Insights page |
| **Test Case Recommendations** | Fix suggestions on a single test case |
Configure these in [Project Settings](/platform/project-settings#ai-features). Changes apply from the next test run, and only Owner and Administrator roles can modify AI settings. Disabling AI does not affect existing AI-generated data from previous runs.
## Report a vulnerability
Report suspected vulnerabilities to **[support@testdino.com](mailto:support@testdino.com)**. Reports are acknowledged within 2 business days. TestDino requests 90 days of confidentiality while a fix is developed and released.
## Related
Every data category collected during test execution, registration, and platform usage
Internet-facing services, domains, and firewall rules
***
For security or data privacy inquiries, email **[support@testdino.com](mailto:support@testdino.com)** or use the [discord](https://discord.gg/hGY9kqSm58) community.