Documentation › Security & Compliance

Security & Compliance Overview

Reference A summary for security, procurement and IT teams evaluating MaxTAF Cloud. For a formal security questionnaire or DPA, contact Code Development Ltd.

This page explains how MaxTAF Cloud authenticates users, protects credentials, handles your test data, and where that data flows — including when AI features are used. It covers both the SaaS offering and self-hosted (on-premises) deployments.

Two deployment models

SaaS — MaxTAF runs the platform at mx1.maxtaf.com; you sign in and your data lives in the MaxTAF-managed environment. On-premises — you run the entire platform inside your own network/cluster, so test data and credentials never leave your infrastructure. See On-Premises Installation.

Authentication & access control

User sign-in is handled by an identity provider (Keycloak) using standard OpenID Connect / SSO. Passwords are never stored by the application layer in plain text.
Projects are isolation boundaries. A user only sees the projects they are a member of. Cases, suites, files and parameters are scoped per project.
Project membership is managed by project administrators (Project Settings ▸ Users), who add collaborators by email. Users without an account appear under Users requests until they register.
Public projects are opt-in only and require typing the exact project id to confirm — a deliberate guard against accidental exposure. Everything in a public project becomes visible to all MaxTAF Cloud users, so it is intended for shared examples, not customer data.

API keys

Programmatic access (the REST API, the recorder's upload, CI/CD pipelines) uses a per-user API key together with a project id, sent as request headers:

X-Maxtaf-Api-Key: mx-xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx
X-Project-Id: your_project_id

Treat the API key like a password

A user's API key authorizes actions across the gateway surface for the projects that user can access — importing/exporting cases, triggering runs, reading results, file operations and project parameters. Store it in a secrets manager or your CI system's encrypted secrets, never in source control. You can invalidate and regenerate your key at any time from Admin ▸ User Settings.

Data handling

Data	What it is	Where it lives
Test assets	Cases, suites, page objects, files, parameters, schedules.	The platform database and project file system (SaaS: MaxTAF-managed; on-prem: your cluster).
Run artefacts	Logs, console output, screenshots, videos, Allure reports.	The project file system under a `runs` folder (one folder per run id).
Credentials you script	App logins your tests use (e.g. a Maximo user).	Stored as project/case parameters. Prefer project parameters and treat parameter values as secrets — see below.
AI provider keys	Claude/Gemini/OpenAI keys for the AI Assistant / AI cases.	Project Settings ▸ AI Configuration, as `mx.ai.*` parameters.

Credential hygiene for tests

Put application logins in project parameters (e.g. a Maximo URL, username, password token) and reference them from cases — this keeps secrets out of case scripts and lets you rotate them in one place.
Use per-environment parameter layers (user/project) so a personal QA credential never ships inside a shared case.
Video recording is off by default (mx.selenium.enable_video_recording=false / mx.playwright.enable_video_recording=false). Enable it deliberately, and remember videos may capture on-screen secrets.

AI features & data flow

MaxTAF has two distinct AI features, and it is important for security review to distinguish them:

Feature	What is sent to an AI provider	Control
AI Assistant (in-app chat helper)	Depends on the code-submission mode: `auto` streams the code you open/edit to the configured provider; `manual` sends nothing unless you explicitly submit a snippet.	`mx.ai.aiAssistant.codeSubmissionMode` — set to `manual` for privacy-sensitive work.
AI test cases (natural-language tests)	The case's natural-language script and browser observations are processed by the AI agent to drive the browser during the run.	Only cases you author as the AI type use this. Scripted (MXML/Java/etc.) cases involve no AI provider at run time.

You choose the AI provider (Claude, Gemini, OpenAI, or a custom OpenAI-compatible endpoint) and supply your own key — so the data-processing relationship for AI content is between you and that provider.
The AI-generated MXML case an AI run produces replays with no AI provider involvement — a key reason to convert exploratory AI runs into MXML for regression.
On-premises: to keep AI data inside your boundary, point the custom provider at a self-hosted model endpoint.

Network & execution

Tests execute in a Linux browser environment on isolated nodes drawn from a pool. Private pools give an account dedicated nodes.
On-premises, browser nodes and the AI execution grid run inside your cluster, so tests reach internal systems (like an internal Maximo) without exposing them to the internet.
The application is fronted by a gateway that enforces authentication and role/path checks on every request.

Backup & portability

Project export/import lets you back up and move a project's cases, suites, schedules, files and parameters (runs are not included — download the runs folder separately). See Backup & maintenance.
On-premises operators are responsible for database and volume backups; see the installation guide.

Need formal documentation?

For a completed security questionnaire, data-processing agreement, or details of the SaaS hosting region and sub-processors, contact your Code Development Ltd account manager or use Learn ▸ Support in-app.