Your credentials stay on the runner. The AI stays off unless you turn it on.
What runs where, what is allowed to leave, and which controls exist today versus on the roadmap. Each control below carries its status, because a security review deserves the plain answer.
- CredentialsEntered once on the runner, protected with DPAPI
- AIOff unless a run enables it; none in the runner kit
- NetworkRunner in your network; Cloud is outbound HTTPS only
Built today, and what is on the roadmap.
- Built
Credentials never leave the runner
Each named password is entered once on the runner and protected with Windows DPAPI. It is never sent to the portal, written into the capture or stored in a recorded bundle; password steps are written commented out with an empty value, as the recorder writes them.
- Built
No model unless a run enables one
Steps are resolved by rules. The model fallback is off unless a run asks for it, and the runner kit carries no model client or prompt at all, so an edited kit still sends nothing. A test in the product pins that.
- Built
Execution stays in your network
The runner that drives SAP and web applications sits inside your network in every edition. In Cloud it makes outbound HTTPS connections only.
- Built, not run live
Zero egress in Sovereign
The Sovereign control plane runs inside your network and requires no outbound connection. The install check includes your firewall confirming no egress during the verification run.
- Built
Signed offline updates
Engine and XF tables delivered as a signed bundle; signatures and SHA-256 checksums verified before anything runs; applied on your schedule.
- Built
Offline licence
An offline-signed, node-locked, term-bound licence file, verified on the server, so nothing has to phone home to stay licensed.
- Roadmap
Signed runner installer
The runner kit signed with MindMap Digital's code-signing certificate, and an MSI your IT can deploy.
- Built
MindMap Sovereign AI
Off unless you enable it. An open-weight model on MindMap's own GPU host, or inside your perimeter. Its answers are advisory: a step a model chose is marked and goes to review.
- Built
Single sign-on and roles
Sign-in through your identity provider over OpenID Connect, Microsoft Entra ID first, with roles for administrators, reviewers and authors, and an audit log.
- Roadmap
Independent assurance
Threat model, penetration test, security whitepaper with data-flow diagrams, and SOC 2 Type I readiness for Cloud.
If the application prints a password, it is on the page.
AutoTestr never handles a password it is given beyond the runner. But if the application under test displays a password on screen, as some demo applications do, that text is part of the page and can appear in the identity of an object located by it. We flag those objects rather than editing their identity, because an edited identity would no longer match the element. Nothing else in the output carries the value.
Hardening raises the cost of analysis. It does not make it impossible.
Code that runs on a machine you control can, in principle, be analysed there. The runner kit already leaves out what it does not need, such as any model client, and further hardening layers are on the roadmap. Each raises the cost and limits exposure; none is a wall. We say the same in writing. What holds the arrangement together is the licence, the agreement, and the stream of updated XF tables that a frozen copy would lack.
What a security reviewer usually asks for
- Data flows per edition: on the deployment page, and walked through with your team on a call.
- The exact prerequisites for a runner, and what it connects to: in the census & pilot checklist.
- Which AI mode is in use, and proof that it is off: the setting is per installation, and off is the default.
- A security whitepaper and penetration-test summary: in preparation. Ask, and we will tell you where they stand.
Bring your security questions to an engineer.
A working session on credentials, data flows and AI policy with the people who built AutoTestr. Status words, not adjectives.
Worksoft and Certify are trademarks of their owner. MindMap AutoTestr is a MindMap Digital product; naming Certify describes the files AutoTestr produces and does not imply endorsement by Worksoft. Capability status words on these pages (Built, Built not run live, Roadmap) describe the current release.