Workspace

Security and data

How passwords, keys and links are kept, what the AI sees, and how to delete your data.

Passwords and secrets#

Sign-in account passwords are encrypted when saved, never shown again, never returned by the API, and never sent to the AI. The tester types them into the sign-in form.
Endpoint headers and integration secrets (Slack webhooks and similar) are encrypted and never shown again.
In the app, test text that looks like it contains a password is not sent, and the assistant never asks for a password.

Keys and links#

API keys are shown once; we keep only a hash. Revoking one stops it straight away.
Share links are random; we keep only a hash. They expire, and you can turn one off at any time.

Your account#

Passwords for your Testsy account are at least 10 characters and stored as a salted hash. You can sign in with Google instead.
Where you are signed in lists your sessions; sign out of any of them, or out of every other device.
Changing your password signs out your other devices.
Settings → Delete account deletes your account and any workspace you own alone: its tests stop running and a paid plan is cancelled. It cannot be undone.
The owner can delete a single workspace too: see Team and roles.

Activity#

Owners and admins see the workspace's activity (Settings): who created, changed, ran and deleted what, and from where (the web app, a key, an agent). It can be downloaded as CSV.