What your IT team needs to know before a pilot.

1. Where tests run, and what must be reachable

This is the question that decides whether a pilot can start, so it comes first.

Unattended runs need your test environment to be reachable from the AutoTestX server.The usual options:

• Allow the AutoTestX server’s fixed outbound IP address through to your Maximo test environment (we give you the address during the pre-check).
• On Business, a dedicated instance of your own in AWS Canada or the US, with its own fixed address.
• Run tests with atx run in a CI runner inside your network. Results are JSON on that machine, not in the app.

If none of these is acceptable, recording and watched runs still work behind your VPN, but scheduled and suite runs will not. Tell us early: it changes whether a pilot makes sense.

From testers’ computers: HTTPS to app.autotestx.com on port 443, for the browser and for the agent’s one WebSocket connection. No inbound ports.

2. The agent on testers’ computers

• Needed for recording, picking an element and watching a run. Not for anything else.
• Windows: a download (about 80 MB) that installs for the current user only, with no administrator rights, starts at sign-in, and is removed from Settings → Apps.
• macOS: installed with one Terminal command, for the current user only, removed with--uninstall.
• Signing: neither installer is code-signed yet, and the Mac app is not notarized by Apple. SmartScreen or your endpoint protection may warn about or block it; plan for an allow rule.
• Browser: opens Edge (Windows) or Chrome (Mac) with a temporary, separate profile, so it never touches the user’s own browser data.
• Pairing: each computer is approved by the user, signed in, in their browser, and can be disconnected at any time under Profile → Your computers.
• Logs: %LOCALAPPDATA%\AutoTestX\agent.log or~/Library/Logs/AutoTestX/agent.log.

The agent in the documentation →

3. What is stored, and where

On one server in AWS Canada (Central), as files on its disk, backed up by daily server snapshots. Business plans can have a dedicated instance in Canada or the US. All traffic uses HTTPS.

AutoTestX is for test environments. Use test data, not production data or real people’s personal information.

4. AI

Optional. An organization admin can turn AI off for the whole organization, and AI healing is off until a project turns it on. No run acts on an AI answer.

• Which features: the AI step writer, AI healing suggestions and AI failure diagnosis.
• Provider: Anthropic’s API (United States), on the AutoTestX key or your organization’s own Anthropic key. On Enterprise, only your own key.
• What is sent: the text of a test you ask it to draft; the names and attributes of page elements (role, label, id, heading) for healing; the failed step’s details for diagnosis.
• Never sent: screenshots, recordings or secret values.

5. Screenshots, video and what is redacted

Be clear on this one: redaction applies to text, not to pictures.

• Text: secret values are replaced with ***REDACTED*** in every log line, step detail, error message and variable in a report, and masked inside traces.
• Screenshots are not masked. A step screenshot shows whatever was on the screen: record details, names, amounts, and any value typed into a field that displays it. Password fields show dots, as in the browser.
• When screenshots are taken: after every step for runs from the app, on failure foratx run unless --screenshots is given, and always for Screenshot steps.
• Video and trace are kept only for failed or flaky runs, for 14 days. If a step types a sensitive value into a field that shows it, the run keeps no video or trace at all.

The remaining risk is data on screen. Keep it to test data, and type credentials only into password fields.

6. Accounts and access

• Email and password accounts. Passwords stored as scrypt hashes; sessions in HttpOnly, SameSite=Strict, Secure cookies that end after 12 hours idle, 7 days at most.
• Each customer is a separate organization. Every record is checked against its own project; refused cross-tenant requests are logged.
• Five project roles (Admin, Test Manager, Test Developer, Tester, Viewer) and organization admins. Only roles with the permission can add custom code steps.
• Self-healing decisions are kept in an append-only, hash-chained audit trail.

7. Export and deletion

• Tests are JSON in a documented format, which you can copy out at any time.
• On request we export or delete your organization’s data within 30 days. Deletion is done by us, by hand, today; there is no self-serve delete or automatic retention yet.
• Data still in server snapshots is overwritten as the snapshots roll over.

8. Not confirmed yet

What we can’t yet state, so you don’t have to discover it:

A security questionnaire, or a question not answered here? Emailinfo@autotestx.com or use the contact form.