Security

​

Data Bugzy accesses

Bugzy accesses two categories of data to perform QA testing:

• Repository code — read access to your repository contents for test generation; write access to commit generated Playwright tests to a separate test repository
• Application URL — Bugzy runs a real Chromium browser against your application to explore UI flows and execute tests

Bugzy does not access databases, internal APIs, or infrastructure beyond the application URL you provide.

​

GitHub access scopes

When you connect GitHub, Bugzy requests the following scoped permissions via GitHub OAuth: Bugzy commits generated tests to a separate test repository. Write access to your main repository is limited to PR comments.

​

Encryption

Credentials (API tokens, SSH keys, environment variables) are encrypted before storage and decrypted only at runtime inside ephemeral containers.

​

Test execution isolation

Every test execution runs in an isolated, ephemeral Google Cloud Run container:

• No persistent state — containers are destroyed after task completion; no data, files, or credentials remain
• Per-repository SSH keys — each repository connection uses a unique SSH key pair; keys are not shared across projects or teams
• Network isolation — containers access only the target application URL and required cloud services
• Pre-installed browsers — Chromium is pinned to a specific Playwright version to prevent supply-chain drift

​

Authentication and authorization

• User authentication — GitHub OAuth via Supabase Auth; no passwords stored
• API authorization — JWT tokens with expiration, validated on every request
• Webhook verification — all inbound webhooks (GitHub, Slack, Stripe) are verified using HMAC signature validation
• Team-level isolation — all data is scoped to teams via Row Level Security; users can only access projects belonging to their team

​

Database security

Bugzy’s database runs on Supabase (PostgreSQL) with the following protections:

• Row Level Security (RLS) — enforced on all tables; every query is scoped to the authenticated user’s team
• Encrypted connections — all database connections use TLS
• No direct access — the database is not exposed to the public internet; access is restricted to application services

​

Compliance

​

GDPR

Bugzy complies with the EU General Data Protection Regulation (Articles 5-34):

• Lawful basis — data processing is based on contractual necessity (Article 6(1)(b))
• Data minimization — only data necessary for test generation and execution is accessed
• Right to access, rectification, and erasure — submit requests to privacy@bugzy.ai
• Data Processing Agreement — available at bugzy.ai/legal/dpa
• EU-only processing — all data is processed and stored within the European Union

​

Bulgarian PDPA

Bugzy complies with the Bulgarian Personal Data Protection Act as a data processor registered in Bulgaria.

​

Sub-processors

​

Data retention

​

Incident response

• Regulatory notification — the Commission for Personal Data Protection (CPDP) is notified within 72 hours of a confirmed data breach, per GDPR Article 33
• Customer notification — affected customers are notified within 24 hours for high-risk breaches involving personal data
• Post-incident review — root cause analysis and remediation steps are documented and shared with affected parties

​

Contact