Security

Mockingbird runs tests against your application using credentials you trust us with, so security is not a feature: it is the product working as promised. This page describes how we store, encrypt, and protect your data. Questions or concerns: admin@mockingbirdai.com.au.

1. Data residency

Mockingbird is built for Australian teams, and your primary data stays in Australia:

• Database, authentication, and file storagerun in Supabase’s Sydney region. Accounts, tests, run results, encrypted credentials, step screenshots, run logs, and per-step telemetry are stored there.
• Application servers run on Vercel with serverless functions in the Sydney region.

Some processing necessarily happens overseas: AI model inference (Anthropic), cloud browser sessions and their recordings (Browser Use), payments (Stripe), transactional email (Resend), and error telemetry (Sentry) are processed primarily in the United States. The Privacy Policy covers overseas disclosure in detail.

2. Encryption

In transit

All traffic between your browser, our servers, and our service providers is encrypted with TLS. The app and API are HTTPS-only.

Test credentials and secrets

Test credentials, custom secret modules, and TOTP seeds are encrypted at rest with industry-standard symmetric encryption applied at the database level. The encryption key is held in the application environment, separate from the database, so a copy of the database alone cannot reveal your secrets. Secrets are decrypted only at the moment a test run needs them, and secret values are structurally redacted from run logs, step telemetry, and stored run history before any of it is written or shown. Redaction applies to text. Screenshots and session recordings capture the page as it appeared, so a value the agent typed into a field that your application displays in the clear can still be visible in them - one more reason to use dedicated test accounts rather than real ones.

Passwords and API keys

Account passwords are stored as salted hashes by our authentication provider; we never see or store plaintext passwords. API keys are shown once at creation and stored only as SHA-256 hashes. We cannot recover a lost key, only issue a new one.

3. Application and infrastructure security

• Tenant isolation. Workspace data is isolated with PostgreSQL row-level security, enforced in the database rather than only in application code.
• Isolated test execution. Every test run executes in its own ephemeral cloud browser session, created for the run and destroyed afterwards. Runs never share browser state.
• Rate limiting. Authentication and sensitive actions are rate limited to slow credential-stuffing and abuse.
• Least-privilege access. Access to production systems is limited to the people who operate the Service.
• Monitoring. Error and performance telemetry alerts us to failures and anomalous behaviour.

4. Sub-processors

We use a small, deliberate set of service providers. Each receives only what its function requires:

5. Data retention and deletion

Account and product data - including step screenshots, run logs, and per-step telemetry - is retained while your account is active. Session recordings are held by our cloud browser provider and expire after a limited period, after which the replay is no longer available. You can delete credential and secret modules yourself at any time, and deleting them removes the ciphertext. For account deletion or a copy of your data, email admin@mockingbirdai.com.au.

6. Incident response

If we become aware of a data breach likely to cause serious harm, we will notify affected users and the Office of the Australian Information Commissioner as required by the Notifiable Data Breaches scheme, and tell you what happened, what data was involved, and what we are doing about it.

7. Responsible disclosure

If you believe you have found a security vulnerability in Mockingbird, we want to hear about it. Email admin@mockingbirdai.com.au with enough detail to reproduce the issue. We will acknowledge your report promptly, keep you informed as we investigate, and credit you if you would like once the issue is fixed. We ask that you give us a reasonable opportunity to remediate before public disclosure, avoid accessing other users’ data, and do not run automated scans that degrade the Service. We will not pursue or support legal action against researchers who act in good faith and follow this policy.

8. Contact

Security questions: admin@mockingbirdai.com.au