Security Overview
Assertive.tech is engineered from the ground up for high-trust software teams and enterprise environments. We enforce bank-grade encryption, strict multi-tenant isolation, and zero-trust execution.
1. Encryption Standards
Data in Transit: All network communication across the web app, API endpoints, and runner infrastructure is strictly encrypted using TLS 1.3 protocols.
Data at Rest: All database records, backups, and storage buckets are encrypted using AES-256.
Secret Vault Key Security: Customer secrets ({{secret.KEY}}) are encrypted using AES-256-GCM. Secrets are decrypted only in memory during execution and are automatically masked in all run logs, public reports, and UI views.
2. Ephemeral Sandbox Isolation
Clean Environments: Every browser test run takes place inside an isolated, disposable cloud container provided via Browserbase.
Instant Teardown: Once a scenario run completes or times out, the browser sandbox, cache, cookies, and temporary session state are completely wiped.
3. Access Control & Governance
Multi-Tenant Isolation: Data access is enforced at the database level using Supabase Row-Level Security (RLS) policies scoped strictly to verified organization_id memberships.
Role-Based Access Control (RBAC): Organization roles (org_admin, org_member, org_viewer) restrict administrative privileges, secret vault edits, and user invitations.
Multi-Factor Authentication (2FA): Support for TOTP authenticator apps (Google Authenticator, 1Password) with mandatory AAL2 session enforcement.
4. Vulnerability Disclosure
We welcome security researchers and community feedback. If you identify a potential security vulnerability, please report it directly to security@assertive.tech. We review all submissions promptly.