Security
Your clients trust you with their roadmap. You can trust us with it.
NaatOps holds your stories, test evidence and release history. Here is how we keep it safe, and how you can always take it with you.
Roles for every person
Owner, Admin, Manager, Developer and Viewer, checked on the server for every request. Viewers can read but never change anything. Clients can get a read-only release report link without an account at all.
Passwords and sign-in
Passwords are stored as bcrypt hashes, never in plain text. Sessions use short-lived access tokens, and refresh tokens are stored hashed. Single sign-on with any OpenID Connect provider is supported.
Secrets stay secret
Secret variables in the API client are encrypted with AES-256-GCM and are never sent back to the browser. API tokens are shown once and stored as hashes.
Offboarding in one click
Remove someone and they lose access on their next request. Their API tokens are revoked at the same time, while their issues and history stay intact.
Audit log
Role changes, removals, invitations, project archives, data exports and API token changes are recorded with who did it and when. Owners and admins can read it in Settings.
Signed CI webhooks
Build and deployment events are only accepted with a valid GitHub, GitLab or HMAC signature, using a secret unique to each repository.
Your data, whenever you want it
Owners and admins can download the whole workspace at any time: issues, comments, test cases and runs, docs, API requests, sprints and releases, as CSV and JSON. No lock-in.
Hardened by default
Strict security headers, a CORS allowlist, rate limits on sign-in and every API route, and an allowlist of attachment file types with a size cap.
Questionnaires and reviews
Your client asking for a vendor security questionnaire? Send it over and we'll fill it in. We can also walk your IT team through how NaatOps handles data.
Report a vulnerability
Found something? Please tell us privately through the contact form. We reply within two working days and fix confirmed issues quickly.