> For the complete documentation index, see [llms.txt](https://docs.does.qa/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://docs.does.qa/choosing-a-test-automation-approach/security-and-trust.md).

# Security and trust

How DoesQA handles security, credentials, production testing, GDPR, and enterprise trust as one operated platform.

DoesQA builds and operates the full testing stack: the product, the Test Steps, the Test Runners, and the Results. Security and trust start there. One platform means clear ownership when something needs fixing, and controls you can turn on for the environments you test.

For programme detail, certifications evidence, and policies, see [Security](/platform/security.md) and [Security on does.qa](https://does.qa/security).

## Is DoesQA secure?

DoesQA runs on **AWS in the UK** (`eu-west-2`), with customer data **encrypted at rest** and customer-facing access over HTTPS. Staff access follows least privilege. Admin accounts use MFA. DoesQA holds and follows **Cyber Essentials**.

DoesQA has a proven **99.9%** uptime. DoesQA has been **approved for use by the UK Government**.

The deeper controls, retention rules, and [what DoesQA stores](/platform/security.md#does-doesqa-store-our-data) live on [Security](/platform/security.md).

## How does DoesQA handle credentials and secrets?

Keep secrets in product controls built for them, not in plain step text. Full behaviour is on [How DoesQA handles credentials and secrets](/platform/security.md#how-doesqa-handles-credentials-and-secrets).

| Control                                                 | What it is for                                                                                                                         |
| ------------------------------------------------------- | -------------------------------------------------------------------------------------------------------------------------------------- |
| [Private Values](/values/value-store.md#private-values) | Credentials and other secrets used in Flows. After save, the content stays hidden in the UI and still applies when Tests run.          |
| [MFA](/configuration/mfa.md)                            | MFA secrets under **Settings → MFA**, used with [Set MFA](/test-steps/action/set-mfa.md). The secret is not viewable again after save. |
| Account access                                          | Unique accounts, approval for new access, and least-privilege staff access on the DoesQA side                                          |

Your team decides which credentials enter DoesQA and who can use them on your account. See shared responsibility on [Security](/platform/security.md#shared-responsibility).

## Can DoesQA safely test production systems?

**Staging** is the best place for full regression suites.

You can also test **production**. Many customers do. Recommended practice when you do:

* Point Flows only at the URLs you intend to hit.
* Use careful [Values](/values/value-store.md) for any production credentials.
* Allow DoesQA runner IPs through your firewall when needed ([Whitelisting IPs](/configuration/whitelisting-ips.md)).
* Block hostnames Runs should never reach ([Block Hostnames](/configuration/block-hostnames.md)).

Those isolation controls are part of how enterprise teams keep production Runs inside clear boundaries.

## Does DoesQA train AI models on customer data?

[DoesQA AI](/platform/doesqa-ai.md) stays **inside DoesQA**, hosted in the UK. Nothing leaves the DoesQA ecosystem for DoesQA AI.

**Learning** is optional. When it is on, Intelligence can improve for you and your account. When something useful applies more widely, other customers only get **generic** learning, not your private account detail. You can turn Automation Intelligence and Learning **off** any time.

DoesQA also works fully with AI off: Flows, Manual Elements, Runs, and Results stay available.

## Is DoesQA GDPR compliant?

DoesQA is aligned with **UK GDPR**. Customer infrastructure runs in the UK on AWS (`eu-west-2`). DoesQA LTD is registered in England and Wales. DoesQA follows GDPR rights including the right to removal. See [How long we keep data](/platform/security.md#how-long-we-keep-data).

Read the current policies on does.qa:

* [Security on does.qa](https://does.qa/security)
* [Information Security Policy](https://does.qa/legal/information-security-policy)

For a direct answer on what is stored, see [Does DoesQA store our data?](/platform/security.md#does-doesqa-store-our-data).

## Is DoesQA suitable for enterprise use?

Enterprise teams use DoesQA when they want reliable hosted Runs and clear platform ownership, with controls around where Tests can go.

DoesQA holds and follows **Cyber Essentials**. Isolation controls such as [Whitelisting IPs](/configuration/whitelisting-ips.md) and [Block Hostnames](/configuration/block-hostnames.md) keep Runs inside the boundaries you set. Flows, Steps, Runners, and Results sit in one product, so there is no third-party remote runner to argue with when something fails. See [Maintenance and reliability](/choosing-a-test-automation-approach/maintenance-and-reliability.md).

DoesQA has a proven **99.9%** uptime and has been **approved for use by the UK Government**.

Optional AI stays under your control. Turn it off when a policy requires it.

## Related

* [Security](/platform/security.md)
* [Security on does.qa](https://does.qa/security)
* [DoesQA AI](/platform/doesqa-ai.md)
* [Maintenance and reliability](/choosing-a-test-automation-approach/maintenance-and-reliability.md)
* [Coverage and speed](/choosing-a-test-automation-approach/coverage-and-speed.md)
* [Value Store](/values/value-store.md)
* [MFA](/configuration/mfa.md)
* [Whitelisting IPs](/configuration/whitelisting-ips.md)
* [Block Hostnames](/configuration/block-hostnames.md)