At a glance
The short answers
| Question | Answer |
|---|---|
| Where is our data stored? | In the EU: the database and files at Supabase in Frankfurt, Germany. |
| Is it encrypted? | Yes: in transit with TLS, at rest by the hosting provider. Tokens of connections (Jira, Azure DevOps, Teams, Slack) are encrypted again with AES-256 by UAT Studio; nobody can read them back. |
| How do people sign in? | With their Microsoft work account (Microsoft Entra ID), or with a one-time code by email. With Microsoft, your own sign-in rules apply, including your second step. With the email code, admins add two-step verification with an authenticator app; a workspace can require it for all its admins. No passwords to leak, and only people who were invited get in. |
| Does our IT have to approve the app for Microsoft sign-in? | Only if your organisation lets only IT approve apps. UAT Studio asks Microsoft for sign-in and the basic profile only (openid, profile, email, User.Read). An administrator can approve it once for the whole organisation with this approval link. |
| Who sees what? | Roles per workspace and per project: admins, testers (only their own project and group), stakeholders (view only) and developers (issues only). The database enforces this for every request. |
| Can UAT Studio support see our data? | Only with your permission, for a limited time that an admin chooses. Every visit and change is in the audit log. |
| Is there an audit log? | Yes, of every change to test cases, results, issues, people and access, with who and when. Admins can export it to Excel. |
| Is our data used to train AI? | No. AI test design is an optional add-on; the user stories, process descriptions and issue texts sent to it are not used to train the AI, and names of testers are not sent. |
| Can we use our own AI model? | Yes. An admin connects your company's model: Microsoft Foundry / Azure OpenAI (OpenAI models or Claude; also the route for Microsoft Copilot), OpenAI, Anthropic, Amazon Bedrock, or Google Gemini and Vertex AI. The texts then go to your own provider, within your contract and region, and not to Anthropic through UAT Studio. The key is stored encrypted and cannot be read back. |
| Can we prove to an auditor what was tested? | Yes. An admin downloads an evidence pack per UAT: the go/no-go report as a PDF, every result per step, the issues with their history, every sign-off, the audit log and the screenshots, with a SHA-256 checksum per file. The checksum of the whole pack is also kept in the audit log. |
| Is it accessible? | UAT Studio aims at WCAG 2.1 level AA (EN 301 549). Every release is checked automatically on every screen; an independent audit has not been done yet. See the accessibility statement. |
| Can we get our data out? | Yes, at any time: every project to Excel, and everything of the workspace with its files as one download. On request we delete the workspace. |
Hosting
Hosting and sub-processors
UAT Studio is a product of Salvion (KvK 42076990). We use these service providers (sub-processors) to run it:
| Provider | What for | Where |
|---|---|---|
| Supabase | Database, sign-in and files | EU (Frankfurt, Germany) |
| Cloudflare | Hosting of the app and the website, protection against attacks | Global network; no storage of your test data |
| Resend | Sending emails (invitations, sign-in codes, notifications) | EU (Ireland) |
| Anthropic | AI test design (test cases, and summaries and write-ups of issues), only when your workspace uses that add-on and has not connected its own AI model | United States, under the EU Standard Contractual Clauses |
The connections you set up yourself (Jira, Azure DevOps, Teams, Slack, Zapier, Make, webhooks) send data to your own accounts there, as you configure them.
Security
How UAT Studio is secured
- Access rules in the database. Every read and write is checked against the role of the person, also when someone calls the API directly.
- Sign in with Microsoft (Microsoft Entra ID, for every organisation with Microsoft 365) or with a one-time code by email; only invited addresses get in, and only email addresses Microsoft has confirmed.
- Two-step verification with an authenticator app; a workspace can require it for all its admins. A Microsoft sign-in counts as the second step.
- Tokens and secrets of connections are encrypted with AES-256 (AES-GCM), with the key kept apart from the database; only the last four characters are shown. API keys are stored as a fingerprint only.
- Files (screenshots, evidence) are only available to people with access to the project, through short-lived links.
- Audit log of every change, with who and when, including support visits.
- Releases go through automated tests of the security rules and the screens before they reach production.
Privacy
Privacy and the GDPR
For the data in your workspace, your organisation is the controller and Salvion the processor. We sign a data processing agreement (verwerkersovereenkomst) with you; ask for it at [email protected]. Our privacy statement explains what we process ourselves.
Tip for your UATTest environments are often a copy of production. Use test data where you can, and ask testers to crop or blur screenshots with personal data.
Buying
Buying UAT Studio
- Pay by invoice, per project or per month or year. We put your purchase order number on the invoice.
- Start with a free pilot of 14 days: no credit card, no commitment.
- No per-user licences: every business tester is included, so the number of testers never needs a new approval.
- Supplier onboarding: we fill in your supplier form and provide our company details and bank details on request.
Questions
Security questionnaires
Send your security or vendor questionnaire to [email protected]. We usually return it within a few working days.