Security and data

Tests sign in to your apps and click real buttons, so ReplayQA is built to keep credentials safe and test browsers contained.

Credentials

• Never taken from video. Passwords show as dots in recordings anyway; ReplayQA asks for them separately.
• Encrypted at rest and never shown again after saving, even to Admins.
• Typed in only at run time, by the test runner, and masked in screenshots, videos, traces and logs.
• Scoped to one site, so staging and production credentials stay separate.

Use dedicated test accounts with only the permissions your flows need.

Containing test browsers

• Each run uses a fresh, isolated browser, with no cookies or data from other runs or other workspaces.
• The browser can only reach your site's address and its allowed hosts. Everything else is blocked, including private networks and cloud metadata addresses.
• On sites marked production, steps flagged as destructive are blocked.

Access

• Roles limit who can approve tests, change sites and credentials, invite people or manage billing. See Team and roles.
• Workspaces are fully separated. Members of one can never see another's tests, runs or recordings.
• Account settings → Revoke all sessions signs you out everywhere else and disconnects every Chrome extension, for example after losing a laptop.

AI

AI sees your video frames when it analyzes a recording, and the failure evidence when you press Explain with AI. It never sees your credentials, and it never runs during replays.

How long data is kept

Admins set retention under Workspace settings:

When a video expires, the tests made from it and their steps are kept; only the video file is deleted. Screenshot baselines used by "Looks the same as before" checks are kept as long as the test.

You can also delete a recording at any time from its page. Tests generated from it are kept.