Security

How the service is built, and what it does not claim. Written plainly so you can judge it against what you are about to point it at.

Last updated 16 September 2026

Access to your data

• Every table carries row-level security, so a workspace reads only its own runs, products and findings. The rules are applied on every server start, not by hand.
• Sign-in tokens are verified against the project's own key rather than trusted as sent.
• Screenshots are never public. They are served through short-lived signed links that expire, and a share link you create can be revoked.
• Administrator access needs a verified email address on an allow-list.

What a persona can reach

• A persona stays on the site you point it at: its registrable domain and subdomains. A link that leaves the site is undone, so a persona cannot wander into a third-party sign-in page or a hosted checkout.
• Personas are given fake details to type. Never give one a real payment card or a real customer's credentials.
• If you need a signed-in flow, you sign in yourself in the browser and hand it over. We never store your password.
• Each run has a time and turn budget, so nothing runs away with your site or our bill.

Secrets and keys

Provider keys live in the host's environment, never in the code, and are not readable through the application. An integration key you add, such as Linear, is stored on the server and never shown back to the browser.

Reliability

Data sits in a managed Postgres database with daily backups. Runs are queued and driven by a separate worker, so a deploy does not lose a run in flight, and a run interrupted by one is recorded as interrupted rather than left hanging. Each run's screenshots are deleted with the run.

What we do not claim

Meerkat has no SOC 2 report, no ISO certification, no penetration test to show you, and no single sign-on or audit log yet. If any of those are a requirement for you, say so and we will tell you honestly where we are.

Reporting a problem

Email support@runmeerkat.com with what you found and how to reproduce it. We will confirm within two working days. Please do not test other customers' data or run denial-of-service attempts against the service.