Security & trust

Your tests stay yours. Hosted in the EU, and we list what leaves it.

vikingQA is built for teams that must pass a security review. This page shows what is in place today and what is on our roadmap. Each roadmap item carries a label.

Talk to sales Read the security documentation

For developers: every test is plain Playwright in your own git repository.

SOC 2 Type II Roadmap
ISO 27001 Roadmap
GDPR
Hosted in the EU

Audits and certifications.

Today we hold no SOC 2 or ISO 27001 certification, and no independent penetration test is complete. Until then, we answer your security questionnaire directly and offer a call with the engineers who built the system.

Audit reports shared under NDA through a trust center. Roadmap

SOC 2 Type II Roadmap

An independent audit of security, availability and confidentiality, every year.

ISO/IEC 27001:2022 Roadmap

A certified information security management system.

GDPR

We act as your data processor. A data processing agreement under Article 28 is available.

Request the DPA

Penetration test Roadmap

An independent firm tests the application and the infrastructure every year.

Hosted in the EU. Kept to the minimum.

The vikingQA application, the database, the cloud browsers, the test sandboxes and the evidence storage run in the EU. The agent worker and the realtime gateway run in Frankfurt, Germany.

Two things leave the EU today. AI model inference runs in the United States by default, under standard contractual clauses (see “How the agent uses your data”). Our sandbox provider writes a single payload larger than 2 MiB to object storage in the United States.

A US region for Enterprise customers is on our roadmap.

Delete a project and its data is removed on the same schedule as the table below. When the contract ends, we delete or return your data, at your choice.

Data	Where it is stored	How long
Your test code	In your own git repository. vikingQA keeps a working copy of the test scripts in its EU database.	You decide. The working copy: for the life of the project.
Run evidence (video, trace, network and console logs)	EU object storage	90 days. Ask us for a shorter period. A retention period that you set per plan is on our roadmap.
Test cases, runs and results	EU database	For the life of the project
Secrets and environment variables	EU database, each value encrypted with AES-256-GCM	Destroyed immediately when you delete them
Account data (name, work email)	EU database. Sign-in, billing and email providers are in the United States, under standard contractual clauses.	Until the account is deleted. Then the personal data is anonymized and cannot be restored.
Agent conversations	EU database	12 months

We change your code in one place only, and you decide who merges.

Least access to your repository

vikingQA works with repositories on GitHub and GitLab. On GitHub it connects through a GitHub App with access to the repositories you select. It pushes only to its own branches. It never force-pushes, never deletes a branch and never pushes to your default branch. A change reaches your default branch through a pull request only: you merge it yourself, or you turn on automatic merge and vikingQA merges it for you.

Secrets stay secret

Each secret is encrypted with AES-256-GCM. It is injected into the test run at run time and is never sent to a model provider. Our logs redact values that look like credentials.

Reach private applications safely

Use a fixed IP address for your allow-list. Your own CI can run the tests inside your network today, because they are plain Playwright in your repository. Private vikingQA runners are on our roadmap.

The right access for each person.

Roles: Owner, Admin, Member, and a restricted Customer role for clients and external testers.
Project-scoped API tokens that you can rotate and revoke.
Every request is checked against your organization, your project and your role before it runs. A user removed from your organization loses access immediately.
Single sign-on with SAML 2.0 and OIDC (Okta, Microsoft Entra ID, Google Workspace). Roadmap
SCIM provisioning. People who leave your company lose access the same day. Roadmap
Enforced multi-factor authentication. Roadmap
Custom roles on Enterprise. Roadmap
Audit log of every sign-in, permission change, integration call and repository write. Export it or stream it to your SIEM. Roadmap
Our own staff reach production only through SSO, MFA and time-limited, logged access. Roadmap

Secure by default.

Encryption

TLS in transit. Credentials and secrets are encrypted at rest with AES-256-GCM, with a separate key for each purpose.

Isolation

Each test run and each agent session gets its own sandbox. Sandboxes are never shared between customers.

Secure development

Secrets are held in a secrets manager and never in source control. Static analysis, dependency scanning and secret scanning on every commit are on our roadmap.

Vulnerability management

Report a vulnerability and we confirm receipt within two business days. An independent penetration test every year is on our roadmap.

Backups and recovery

A managed database takes automated backups. Published recovery objectives and scheduled restore tests are on our roadmap.

Incident response

If a personal data breach affects you, we notify you without undue delay and within 24 hours.

How the agent uses your data.

Your data is never used to train AI models, by us or by our model providers.
Our default model providers process prompts in the United States, under standard contractual clauses. They receive page content and screenshots. They never receive credentials.
An EU inference region and zero-retention terms with the default model providers. Roadmap
You can use your own model provider or a private deployment. Your application’s content then stops flowing to the provider it replaces. Talk to us to set it up.
The agent sees only the project it works in: its repository, its knowledge sources and its test application.
You choose which knowledge sources and integrations each project can use, and what each one is allowed to do.
Every command the agent runs in a sandbox is logged. Every code change is a pull request: you merge it yourself, or you turn on automatic merge and vikingQA merges it for you.

Model providers are listed with our subprocessors

The companies that help us run vikingQA.

We keep the list short and we tell you 30 days before we add a subprocessor. You may object.

Write to privacy@vikingqa.io for the current list and for change notices.

Subprocessor	Purpose	Location
Anthropic	The model that explores your application and writes tests	United States, standard contractual clauses. EU inference region Roadmap
OpenAI	Assertion checks and assisted authoring	United States, standard contractual clauses. EU inference region Roadmap
Amazon Web Services	Evidence storage	EU
Cloud browser provider	Runs the browser that the agent drives	EU
Sandbox provider	Runs your Playwright tests in isolation	EU. A single payload larger than 2 MiB is written to object storage in the United States.

See all subprocessors

GDPR and documents for your review.

Under GDPR you are the controller and vikingQA is your processor. We act only on your instructions.

Security overview (PDF) Roadmap
SOC 2 Type II report Roadmap
ISO 27001 certificate Roadmap
Penetration test summary Roadmap
Pre-filled CAIQ and SIG Lite questionnaires Roadmap
Service level agreement Roadmap

Data processing agreement (DPA): read and request Request answers to your security questionnaire Privacy policy Security documentation About the service level agreement

Available when your releases need it.

A public status page and a 99.9% uptime SLA on Enterprise plans are on our roadmap. Today we make no uptime commitment.

Found a vulnerability?

Write to security@vikingqa.io. We confirm receipt within two business days and we do not take legal action against good-faith research.

Responsible disclosure policy

Questions, answered.

Does vikingQA store our source code?

Your repository is the source of truth for your tests. vikingQA keeps a working copy of the test scripts and their results in its EU database for the life of the project. During a run, a sandbox checks out the repository you connected. A paused agent session can keep a snapshot of its sandbox, and a snapshot is never restored for another customer.

Can vikingQA test an application that is not on the public internet?

Yes. Use a fixed IP address for your allow-list. Your own CI can run the tests inside your network today, because they are plain Playwright in your repository. Private vikingQA runners are on our roadmap.

Do test recordings contain personal data?

They show what your test environment shows. Use synthetic or anonymized test data and dedicated test accounts. Evidence is kept for 90 days. Ask us for a shorter period.

Can we sign our own DPA or security addendum?

Talk to us. We review it with you.

Who at vikingQA can see our data?

Only engineers who need it to support you. Time-limited, logged staff access with an access log that you can ask for is on our roadmap.