Security

Data isolation

Every project, test and run is tied to your account. Database row-level security ensures you can only read your own data.

Run records are server-written

Agent actions, run status and issues can only be written by the server after the browser worker authenticates with a shared secret. Users can read them but cannot edit them.

Test account passwords

Poolabs stores only the email of each test account. Passwords stay on the browser worker you deploy and are never saved in our database.

Isolated browsers

Each AI user gets a fresh browser context — separate cookies, storage and session — which is discarded when the run ends.

Responsible use

Only test applications you own or are authorized to test. See our Terms.

Reporting a vulnerability

Found an issue? Tell us through the contact form with "Security" in your message.