Security
Built to be trusted with your app
Operio signs into your app, works through your journeys and records what it sees. Here's how we protect the credentials, data and evidence that involves.
- Secrets at rest
- AES-256-GCM encryption
- Data in transit
- Encrypted connections
- SOC 2 Type 2
- In progress
- GDPR
- DPA available on request
Your data
Your data stays yours
Credentials, test cases and results are protected, kept separate from other customers, and used only to run Operio for you.
Secrets are encrypted
Test account passwords, integration tokens and webhook URLs are encrypted with AES-256-GCM. Webhook URLs are never shown in full after you save them.
Isolated by team
Access controls keep each team's projects, runs and evidence separate from every other customer.
Never used for training
Your test cases, flows and results are used only to run the service for you, never to train shared AI models without your explicit consent.
Deleted when you leave
When an account closes, its data is deleted or anonymized within 90 days, unless the law or a DPA requires longer.
Access
Every way in is scoped and logged
People, scripts and coding agents each get the access they need, and changes leave a trail.
Scoped agent access
Coding agents connect over OAuth with read, or read and write, access. Each call checks the user's current team membership, and tools never return stored login passwords.
API keys done right
Personal API keys are shown once, stored only as a hash, and can expire after 7 to 365 days.
An audit log
Owners and admins can review who changed what. Updates record which fields changed, not their values.
Test execution
Tests run apart from everything else
The browsers and devices that drive your app are short-lived and separate from Operio's own systems.
Isolated browsers and devices
Tests run in remote browser sessions and cloud devices that are kept apart from Operio's backend.
Sessions that expire
Browser and device sessions shut down after 20 minutes of inactivity, so nothing is left running.
Built for test data
We recommend test accounts and synthetic data. Operio staff don't access stored credentials except where needed for security, support or legal compliance.
Responsible disclosure
Found a security issue?
Email us the details and the steps to reproduce. Please give us reasonable time to fix it before sharing it publicly, and don't access data that isn't yours.
FAQ
Security questions
In the United States and other countries where Operio or its providers operate, with appropriate safeguards. Transfers from Europe can rely on Standard Contractual Clauses.
Yes. Email support@operio.run to request a Data Processing Agreement.
Our SOC 2 Type 2 work is in progress. Contact us and we'll share where it stands and help with your security review.
We use trusted providers for hosting, test browsers and devices, email and payments. Contact us for the current list.
We recommend dedicated test accounts and synthetic data. If you test production, use accounts created for testing, never real customer accounts.
Running a security review?
Bring your questions and we'll walk through how Operio handles your data.