testeiya 0.2.0 → 0.3.1-0.1

package/skills/testeiya/testomatio-docs/docs/legal/security/index.mdx

@@ -1,242 +0,0 @@
----
-title: Testomat.io Security Overview
-description: Testomat.io’s Security Overview outlines robust measures to ensure data integrity, confidentiality, and availability. It features encryption, access controls, regular audits, and compliance with standards such as SOC 2. Security protocols include continuous monitoring, secure hosting on DigitalOcean, and regular system backups. Development and incident response practices prioritize vulnerability management and user privacy.
-type: article
-url: https://docs.testomat.io/legal/security
-head:
-  - tag: meta
-    attrs:
-      name: keywords
-      content: Testomat.io security, data protection, encryption, SOC 2, network monitoring, secure development, access control, vulnerability management, privacy, compliance
----
-
-import DirectoryLinks from '/src/components/DirectoryLinks.astro';
-
-<DirectoryLinks directory="legal/security" />
-
-At Testomat.io, we prioritize the security of our users' data and information. We implement rigorous security measures and protocols to ensure the integrity, confidentiality, and availability of our users' data.
-
-Testomat.io is built on the foundation of trust and transparency. We are dedicated to safeguarding the data and privacy of our users, clients, and partners. Our security protocols are meticulously designed to protect user information from unauthorized access, disclosure, alteration, and destruction. We employ a multi-layered approach to security, combining cutting-edge technology with best practices to create a robust and resilient security framework.
-
-Our security measures are comprehensive, encompassing various aspects including data protection, network security, application security, and physical security. We continuously monitor our systems and networks to detect and thwart any potential security threats and vulnerabilities. We also conduct regular security assessments and audits to ensure the ongoing effectiveness of our security controls and to identify areas for improvement.
-
-## Key Security Features
-   - **24/7 Proactive Monitoring:** Continuous monitoring of our systems for security, availability, and performance.
-   - **HTTPS Encryption:** Secure communication with our servers using TLS-based HTTPS protocols.
-   - **Automatic Updates:** Regular system and application updates to maintain security.
-   - **Professional Data Centers:** Utilization of leading data center providers with robust physical security controls.
-   - **System and Data Backups:** Regular backups for disaster recovery and system outages.
-   - **Data Protection:** Strict adherence to data protection laws and regulations.
-   - **High Availability:** Full redundancy of all critical systems and top-tier data connectivity.
-   - **Data Isolation:** Separate customer data with  isolation and access permissions.
-   - **Access Permissions:** Fine-grained access control via system permissions, roles, and network addresses.
-
-
-## Key Security Controls Summary
-
-Certainly! Below is the extended version of each point with at least 5 items:
-
-- **Servers and Data Centers**
-  - Hosted on **DigitalOcean** for reliable uptime and performance.
-  - Access restricted to **senior management level** to maintain security.
-  - Regular maintenance and updates are performed to ensure optimal performance.
-  - Monitored continuously for any irregularities or potential security breaches.
-  - Equipped with redundancy measures to prevent data loss and downtime.
-  
-- **Data Encryption**
-  - **At Rest:** Utilizes industry-standard encryption algorithms to secure stored data.
-  - **In Transit:** Employs TLS encryption to secure data during transmission.
-  - Passwords, keys, and tokens are encrypted and stored separately.
-  - Regular audits are conducted to ensure encryption integrity.
-  - Encryption keys are managed securely and rotated regularly.
-  
-- **Access Control**
-  - **RBAC:** Assigns roles to limit access based on job responsibilities.
-  - **MFA:** Developers authenticate using multiple factors to access sensitive areas.
-  - Access logs are maintained and reviewed regularly for unauthorized access.
-  - Access permissions are reviewed and updated regularly.
-  - Temporary access is monitored and revoked immediately after use.
-  
-- **Data Protection**
-  - Regular backups are conducted to secure locations in the Netherlands and Germany.
-  - Strict data retention and deletion policies are enforced.
-  - Data integrity checks are performed regularly.
-  - Data is anonymized where possible to protect user privacy.
-  - Data loss prevention measures are in place to monitor and block unauthorized data transfers.
-  
-- **Secure Development Practices**
-  - **Security in SDLC:** Integrated to identify and mitigate vulnerabilities early.
-  - **Code Review:** All code is scrutinized for security vulnerabilities before deployment.
-  - **Automated Checks:** Security checks are automated within continuous deployment tools.
-  - Developers are trained regularly on secure coding practices.
-  - Security requirements are defined and refined during the requirement gathering phase.
-  
-- **Incident Response Plan**
-  - A detailed plan is in place for detecting, responding to, and recovering from security incidents.
-  - Regular training sessions are conducted for the development and support team.
-  - Incident logs are maintained and analyzed for continuous improvement.
-  - Communication protocols are established for informing affected parties.
-  - Post-incident reviews are conducted to refine response strategies.
-  
-- **Regular Security Audits and Assessments**
-  - **Vulnerability Scanning:** Regular scans are conducted to identify and remediate vulnerabilities.
-  - Security policies and procedures are regularly reviewed and updated.
-  - Risk assessments are performed to identify potential security threats.
-  - External security experts are consulted for unbiased assessments.
-  - Remediation strategies are developed and implemented promptly after identifying vulnerabilities.
-  
-- **User Authentication and Management**
-  - **Strong Password Policies:** Enforced to ensure the creation of secure passwords.
-  - **Account Lockout Policies:** Implemented to protect against brute force attacks.
-  - User access is logged and monitored for suspicious activities.
-  - User accounts are reviewed regularly for any inactive or unauthorized accounts.
-  - Passwords are hashed and salted to enhance security.
-  
-- **Network Security**
-  - **Firewalls:** Deployed to monitor and control network traffic based on security policies.
-  - Intrusion detection systems are in place to identify malicious activities.
-  - Network traffic is analyzed for signs of DDoS attacks.
-  - Secure VPNs are used for accessing internal networks remotely.
-  - Network configurations are regularly reviewed and updated to enhance security.
-  
-- **User Training and Awareness**
-  - Regular training sessions are conducted to educate users on security best practices.
-  - Security awareness programs are implemented to inform users about potential threats.
-  - Users are tested on security knowledge to ensure understanding.
-  - Security reminders are sent regularly to reinforce best practices.
-  - Users are encouraged to report any suspicious activities or security concerns.
-  
-- **Third-Party Security**
-  - **Vendor Risk Management:** Vendors are assessed regularly to ensure security compliance.
-  - **Third-Party Integrations:** Reviewed and monitored for vulnerabilities.
-  - Contracts with vendors include strict security requirements.
-  - Vendors are required to conduct regular security audits.
-  - Vendor access to internal systems is restricted and monitored.
-  
-- **Application Security**
-  - **Input Validation:** Implemented to protect against various injection attacks.
-  - **Security Patching:** Regular updates and patches are applied to fix vulnerabilities.
-  - Application logs are monitored for any suspicious activities.
-  - Security headers are used to protect against attacks like clickjacking.
-  - Applications are developed following the principle of least privilege.
-  
-- **Logging and Monitoring**
-  - **Audit Logs:** Maintained and reviewed regularly for suspicious activities.
-  - **Real-Time Monitoring:** Implemented for immediate detection and alerts.
-  - Log retention policies are enforced to maintain logs securely.
-  - Anomalies in logs are investigated promptly.
-  - Logging systems are secured to prevent unauthorized access and tampering.
-  
-- **Business Continuity**
-  - **Disaster Recovery Plan:** Developed to ensure quick recovery of data and business operations.
-  - Business impact analyses are conducted to identify critical functions and systems.
-  - Recovery strategies are developed and tested regularly.
-  - Employees are trained on their roles during disaster recovery.
-  - Alternate business locations are identified for continuity during disasters.
-  
-- **Contractual Obligations**
-  - **SLAs:** Clearly defined to assure customers of availability and support levels.
-  - Contracts are reviewed and negotiated to include necessary security clauses.
-  - Compliance with contractual obligations is regularly audited.
-  - Breach notification clauses are included in contracts.
-  - Liability clauses are negotiated to protect against losses due to breaches.
-  
-- **API Security**
-  - **API Authentication:** Implemented to secure all APIs properly.
-  - **Rate Limiting:** Enforced to protect against abuse.
-  - APIs are monitored for any unauthorized access or abnormal activities.
-  - API keys are secured and rotated regularly.
-  - API endpoints are secured against injection attacks.
-  
-- **Legal and Regulatory Compliance**
-  - **Privacy Policy:** Maintained to detail user data collection, processing, and storage clearly and concisely.
-  - Compliance with applicable laws and regulations is regularly reviewed.
-  - Legal counsel is consulted to ensure compliance with international laws.
-  - Data protection impact assessments are conducted for new projects or changes.
-  - Policies and procedures are updated regularly to reflect changes in laws and regulations.
-
-## Infrastructure and Hosting
-
-We have transitioned our hosting strategy to a robust, multi-provider architecture to ensure maximum performance and security. Our core infrastructure and data are hosted on Hetzner, a leading cloud provider recognized for its high-performance hardware and strict data protection standards.
-
-To further enhance our service delivery, we utilize Netlify for optimized application deployment and Cloudflare for edge security and content delivery. This hybrid approach ensures redundancy and resilience across our entire stack.
-
-Hetzner maintains ISO 27001 certification, demonstrating a rigorous commitment to information security management and data confidentiality.
-
-https://docs.hetzner.com/general/others/certificates/
-
-
-
-## Trust, Security, and Compliance
-
-Our approach to security and compliance is holistic, ensuring that every facet of our service is aligned with the highest standards of reliability and integrity.
-
-### Compliance with Standards
-We adhere to stringent compliance standards to ensure that our services meet and exceed the regulatory requirements and industry best practices. Our compliance framework is addressing various aspects of data protection, privacy, and operational integrity. We stay abreast of the latest developments in compliance standards and promptly adapt our practices to align with any new requirements.
-
-### SOC 2
-Testomat.io is currently in the process of obtaining formal SOC 2 certification. However, we do not wait for the certificate to practice security; we are already executing all necessary controls and procedures required for compliance. We operate as a SOC 2-compliant organization today to ensure we are ready for formal attestation.
-
-### Backup Schedules
-Recognizing the diverse needs of our users, we offer backup schedules, allowing users to configure backups according to operational needs. This feature ensures enhanced data redundancy and recovery, enabling users to restore their data efficiently in the event of any unforeseen incidents or system failures.
-
-### Self-Hosting Options
-For users seeking greater control over their data and infrastructure, we provide self-hosting options. This allows users to host Testomat.io on their servers, giving them full autonomy over network access, data residency, and security configurations. Self-hosting empowers users to tailor the hosting environment to their specific organizational needs and compliance requirements.
-
-## Security Methodology
-
-At Testomat.io, the security of our customer data and systems is paramount. We maintain a proactive security stance driven by a dedicated internal security team responsible for systematic architecture review.
-
-To ensure our defenses remain robust against evolving threats, we conduct regular penetration testing engagements. These assessments allow us to identify and remediate vulnerabilities before they can be exploited.
-
-Security is a shared responsibility across our entire organization. Whether in customer support or engineering, every team member receives regular security training and updates.
-
-We are committed to continuous improvement, ensuring our users can trust us to keep their data secure and confidential.
-
-
-## Network Monitoring
-
-We have lots of tools to keep our network safe. We use firewalls and other tools to stop problems before they happen. The places that hold our data are watched all the time to keep them safe and working well. If something goes wrong, we have backups ready to jump in. This helps us keep everything running smoothly and safely for you.
-
-## Development Practices
-
-Our teams use top-notch practices to ensure our code and systems remain secure. We regularly peer-review code, perform manual penetration tests on all new features, and maintain strict version control over changes. Beyond the code itself, we continuously educate our team on common security risks. We also have our own secure setup to keep our reliance on outside sources low and to keep important code all in one place.
-
-## Managing Vulnerabilities
-At Testomat.io, we are proactive in finding and managing any weak points that might be present in our systems. Our approach ensures that vulnerabilities are identified promptly and addressed effectively to maintain the security and integrity of our services.
-
-### Identifying Vulnerabilities
-We employ a hybrid approach that combines automated scanning tools with manual penetration testing to assess our systems regularly. This allows us to identify both common security flaws and complex logic vulnerabilities before they can be exploited. Our team stays informed about the latest security threats and uses this knowledge to fortify our defenses continually.
-
-### Addressing Vulnerabilities
-Once a vulnerability is identified, we act to analyze and rectify it. We prioritize resolving any issues that pose a risk to our users and our platform, ensuring that any potential impact is mitigated promptly. We implement robust solutions to prevent the recurrence of similar vulnerabilities.
-
-### Remediation & Verification
-After a fix is implemented, we perform targeted remediation testing to validate the solution. This process ensures that the specific vulnerability has been effectively neutralized and that the changes have not introduced any new security regressions into the system.
-
-### Disclosure Policy
-We believe in transparency and responsible disclosure. If a vulnerability is discovered, we communicate it appropriately, ensuring that our users are informed and aware of any risks and the measures taken to resolve them. We work collaboratively with the internal security team and welcome any reports of vulnerabilities from the external bug hunters, addressing them with the utmost seriousness and urgency.
-
-### Continuous Improvement
-
-Our vulnerability management is an ongoing process. We learn from every incident and use these learnings to enhance our security posture continually. We are committed to evolving our practices to stay ahead of emerging threats and provide a secure and reliable environment for our users.
-
-## Privacy
-
-The Privacy Policy of testomat.io, operated by Optimum Solutions Sp. z o.o., governs the collection, use, and disclosure of user data. Users consent to this policy by using the service. 
-
-Check out a short summary of our privacy policy:
-- **Introduction:** The Privacy Policy applies to the services offered by testomat.io, operated by Optimum Solutions Sp. z o.o. Users consent to this policy by using the service.
-- **Data Collection:** The service collects personal and usage data, including names, email addresses, and browser information, using cookies and other tracking technologies.
-- **Use of Data:** Collected data is used to provide and maintain the service, improve user experience, and send newsletters and promotional materials, with users having the option to opt-out.
-- **Third-Party Services:** Data may be shared with third-party providers like Google Analytics, Facebook, and Stripe for analytics, remarketing, and payment processing. Users can opt-out of interest-based ads.
-- **User Rights:** Users have rights under GDPR, CalOPPA, and CCPA to access, modify, or delete their personal data by contacting Optimum Solutions Sp. z o.o.
-- **Data Security:** The service employs commercially acceptable means to protect user data, acknowledging that no method is 100% secure.
-- **Children’s Privacy:** The service does not intentionally collect data from children under 13 and has measures to prevent such collection.
-- **Policy Changes:** Users will be notified of any changes to the Privacy Policy via email or a notice on the service.
-- **Contact:** For inquiries regarding the Privacy Policy, users can contact the company via email or the [contact page](/support) on the website.
-
-For a comprehensive understanding of our practices and your rights, we encourage you to review the full version of our Privacy Policy at [Privacy Policy](https://testomat.io/privacy). 
-
-
-

package/skills/testeiya/testomatio-docs/docs/legal/security/jira.md

@@ -1,140 +0,0 @@
----
-title: JIRA Plugin Permissions and Security
-description: The Testomat.io JIRA plugin enhances integration with JIRA projects by linking test cases to issues. It offers read access to project issues and writes properties for storing test data. The plugin ensures data security and performs no update or delete operations. Features include linking/unlinking tests, viewing/editing tests in JIRA, running tests, and attaching reports.
-type: article
-url: https://docs.testomat.io/legal/security/jira
-head: 
-  - tag: meta
-    attrs:
-      name: keywords
-      content: JIRA integration, Testomat.io, test management, test linking, security, test data, API access, BDD, traceability matrix, test reports, JIRA plugin
----
-
-## Overview
-Testomat.io’s JIRA plugin is designed to enhance the integration between your testing environment and your JIRA projects. It accesses your JIRA projects to show tests that can be attached to any issue in JIRA, providing a seamless way to link your test suites with your project issues. Below is a detailed overview of the permissions required by Testomat.io and the scope of access within your JIRA projects.
-
-## Permissions and Access Scope
-- **Read Access:** Testomat.io has read access to all issues of a project it is enabled on. This is essential to fetch relevant details and display tests that can be attached to any issue in JIRA.
-- **Write Properties:** Testomat.io can write properties to save tests data into JIRA storage attached to a specific issue. This is the only write operation performed by Testomat.io.
-- **No Update or Delete Operations:** Testomat.io does not update or delete any issues on your JIRA. It strictly adheres to read and write properties operations to ensure the integrity of your JIRA issues.
-
-Based on the code, here's a comprehensive list of JIRA API endpoints used and the required permissions:
-
-### REST API Endpoints Used
-
-1. **Webhook Management**
-```
-POST /rest/webhooks/1.0/webhook
-```
-
-To unlink test cases when an issue is deleted (optionally)
-
-2. **Issue Operations**
-```
-GET /rest/api/2/issue/{issueId}
-POST /rest/api/2/issue
-PUT /rest/api/2/issue/{issueId}
-```
-To link, create and update jira issues for tests and defects
-
-3. **Issue Properties**
-```
-GET /rest/api/2/issue/{issueId}/properties
-GET /rest/api/2/issue/{issueId}/properties/{propertyKey}
-PUT /rest/api/2/issue/{issueId}/properties/{propertyKey}
-DELETE /rest/api/2/issue/{issueId}/properties/{propertyKey}
-```
-To store test cases and runs data inside Jira
-
-4. **Project Operations**
-```
-GET /rest/api/2/project/{projectKey}
-GET /rest/api/2/project/{projectKey}/properties/{propertyKey}
-PUT /rest/api/2/project/{projectKey}/properties/{propertyKey}
-DELETE /rest/api/2/project/{projectKey}/properties/{propertyKey}
-```
-
-5. **Issue Metadata**
-```
-GET /rest/api/2/issue/createmeta
-GET /rest/api/2/issue/createmeta/{projectKey}/issuetypes
-GET /rest/api/2/issue/createmeta/{projectKey}/issuetypes/{issueTypeId}
-```
-To read all current issue types when creating a new issue
-
-6. **Remote Links**
-```
-GET /rest/api/2/issue/{issueId}/remotelink
-POST /rest/api/2/issue/{issueId}/remotelink
-DELETE /rest/api/2/issue/{issueId}/remotelink/{linkId}
-```
-To attach reports to issues
-
-8. **User Properties**
-```
-PUT /rest/api/2/user/properties/{propertyKey}
-DELETE /rest/api/2/user/properties/{propertyKey}
-```
-To store auth data (optionally)
-
-9. **Search**
-```
-GET /rest/api/2/search
-```
-
-### Required Permissions
-
-It's recommended use an individual user account with appropriate permissions for the integration.
-
-This account should have the following JIRA permissions:
-
-1. **Project Level Permissions:**
-   - Browse Project
-   - Create Issues
-   - Edit Issues
-   - Link Issues
-
-2. **Global Permissions:**
-   - Manage Webhooks (Admin) *optional*
-
-3. **Property Management:**
-   - Manage Project Properties (Admin)
-   - Manage Issue Properties
-   - Manage User Properties *optional*
-
-## Security Note
-While Testomat.io has access to all issues of a project it is enabled on, it is important to note that there are no restrictions on the JIRA API regarding which issues Testomat.io has access to. However, Testomat.io is committed to maintaining the highest standards of data integrity and security and only accesses data essential for the functionality of the app.
-
-## JIRA Plugin features
-
-The Testomat.io Jira Plugin enhances your Jira experience, enabling a host of actions to be performed directly and seamlessly from Jira, streamlining your workflow and boosting efficiency.
-
-Namely, you can:
-
-- Connect multiple Testomat.io and JIRA projects easily.
-- Quickly link/unlink tests, suites, and plans to JIRA issues.
-- View and edit tests directly in JIRA.
-- Use autocomplete and smart suggestions for creating tests.
-- Easily modify BDD/Gherkin feature files and scenarios.
-- Create multiple tests at once from checklists from bulk create 
-- Run manual and automated tests from JIRA tickets.
-- Attach test reports to JIRA issues with a click.
-- Use tracebility matrix and reports to check test coverage in sprints and project.
-- Manage project branches.
-
-For details on how to use Testomat.io JIRA Plugin, please refer to [JIRA guide](https://docs.testomat.io/advanced/jira-plugin/) in our documentation.
-
-## FAQ
-
-#### Q: If we connect the Jira app, what access would Testomat.io gain? Can it access all projects?
-**A:** When connected, Testomat.io gains read access to all issues of the projects it is enabled on, allowing it to display tests that can be attached to any Jira issue. It does not have restrictions on the Jira API regarding which issues it can access. However, Testomat.io strictly adheres to accessing only the necessary data for its functionality and maintains high standards of data integrity and security. It does not update or delete any issues on your Jira and only performs write operations to save test data into Jira storage attached to a specific issue.
-
-#### How can we be confident in the security and privacy of the JIRA Plugin app?
-**A:** We understand the concerns regarding security and privacy. Testomat.io is committed to maintaining the highest standards of security and data protection. Testomat.io only accesses data essential for its functionality and does not perform any operations that would compromise the integrity of your Jira issues. If you have specific concerns or need more information, please feel free to [Contact](/support) our support team, and we will be happy to assist you.
-
-#### Does your app have any compliance certifications?
-Our application has completed the CAIQ Lite Questionnaire, which provides comprehensive answers covering all compliance and security levels. We strictly adhere to all CAIQ points, ensuring that our security practices align with industry standards and best practices for safeguarding user data. We are committed to maintaining full compliance in areas such as data protection, risk management, and access control. We provide our CAIQ Lite Questionnaire responses upon request via email. [Contact](/support) our support team, and we will be happy to assist you.
-
-
-## Additional Information
-For any concerns or additional information regarding the permissions and security of the Testomat.io JIRA plugin, please refer to our [Security Page](/legal/security) or [Contact](/support) support team.

package/skills/testeiya/testomatio-docs/docs/legal/security/subprocessors.md

@@ -1,76 +0,0 @@
----
-title: Subprocessors
-description: Testomat.io uses subprocessors including DigitalOcean, Hetzner, and Google Cloud for core infrastructure and data storage, Cloudflare for traffic management, and a range of providers for customer support, payment processing, email delivery, monitoring, and AI services. Each subprocessor is vetted for security and privacy before integration. Key subprocessors include Crisp, Pipedrive, Slack, GitHub, Calendly, Stripe, SendGrid, SendPulse, AppSignal, Groq, OpenRouter, and Cohere.
-type: article
-url: https://docs.testomat.io/legal/security/subprocessors
-head:
-  - tag: meta
-    attrs:
-      name: keywords
-      content: Subprocessors, Testomat.io, DigitalOcean, Hetzner, Google Cloud, Cloudflare, cloud infrastructure, data storage, traffic management, customer support, Crisp, Pipedrive, Slack, GitHub, issue management, Calendly, scheduling, Stripe, payment processing, SendGrid, SendPulse, email delivery, AppSignal, monitoring, Groq, OpenRouter, Cohere, AI services, security, privacy, GDPR, DPA
----
-
-Testomat.io may use various subprocessors to deliver high-quality services and maintain its operational efficiency. 
-
-## Core Infrastructure Subprocessors
-
-Testomat.io uses the following subprocessor for hosting customer data and providing or supporting the core infrastructure that helps deliver the services:
-- **Entity:** DigitalOcean
-  - **Description/Purpose:** Cloud infrastructure
-  - **Server Locations:** Germany, Netherlands
-  - **Security:** https://www.digitalocean.com/security
-- **Entity:** Hetzner
-  - **Description/Purpose:** Cloud infrastructure
-  - **Server Locations:** Germany, Netherlands
-  - **Security:** https://www.hetzner.com/unternehmen/zertifizierung/
-- **Entity:** Google Cloud
-  - **Description/Purpose:** Data storage
-  - **Server Locations:** USA
-  - **Security:** https://cloud.google.com/security
-
-
-## Other Subprocessors
-
-Also we use the following subprocessors to perform other service functions for different kinds of help, like customer support and payment processing:
-
-- **Cloudflare:** Traffic management
-  - Location: USA
-  - Security: https://www.cloudflare.com/trust-hub/
-- **Crisp:** Customer support
-  - Location: France
-  - Security: https://help.crisp.chat/en/category/legal-security-1t29poq/
-- **GitHub:** Issue management
-  - Location: USA
-  - Security: https://github.com/security
-- **Pipedrive:** Customer support
-  - Location: Estonia
-  - Security: https://www.pipedrive.com/en/trust-center
-- **Slack:** Customer support
-  - Location: USA
-  - Security: https://slack.com/trust/security
-- **Calendly:** Planning online meetings
-  - Location: USA
-  - Security: https://calendly.com/security
-- **Stripe:** Payments services
-  - Location: USA
-  - Security: https://stripe.com/en-pl/legal/privacy-center
-- **SendPulse:** Email and marketing activities
-  - Location: EU
-  - Security: https://sendpulse.com/legal/security
-- **SendGrid:** Email delivery
-  - Location: USA
-  - Security: https://sendgrid.com/en-us/policies/security. 
-- **AppSignal:** Logs and monitoring
-  - Location: Germany
-  - Security: https://www.appsignal.com/security
-- **Groq:** AI LLM
-  - Location: USA
-  - Security: https://trust.groq.com/
-- **OpenRouter:** AI (LLM routing
-  - Location: US
-  - Security: https://trust.openrouter.ai
-- **Cohere:** AI embeddings
-  - Location: USA
-  - Security: https://trustcenter.cohere.com
-
-Before Testomat.io decides to use another company or service, we check if the company is safe, secure, and can keep information private.