Security
Where your data goes, and what we haven't done yet.
For security reviews: where Stagewright runs, where recordings can run instead, how secrets are handled, what goes to our AI providers, and the certifications we don't have yet.
This page describes how the product is built today. Stagewright is in private beta, so it’s shorter than a mature vendor’s trust page, and it says what’s missing. If your review needs something that isn’t here, ask at support@stagewright.ai.
Where it runs
| Part | Where |
|---|---|
| API, dashboard and player | Cloudflare Workers |
| Cloud recordings | Cloudflare Containers |
| Database | Neon Postgres, one region (US East) |
| Videos, frames, traces and narration audio | Cloudflare R2 |
| Sign-in, organizations and single sign-on | Clerk |
| Drafting, mapping and translation | Anthropic (Claude) |
| Narration | ElevenLabs |
The database is in the US today. There’s no choice of region yet; an EU deployment is something we’d build later, when a customer needs it.
Separation between workspaces
Every table that holds a workspace’s data carries the workspace’s id, and Postgres row-level security limits each query to that workspace. The application connects as a database role that is subject to those policies; migrations run as the owner. The product’s database tests run as that same restricted role, so they see what the application sees.
The audit log is append-only for the application: it can add rows, not change or delete them.
Recordings can run on your side
A walkthrough drives a real browser through your product, signed in as a real account. You choose where that browser runs:
- On a developer’s machine, with the CLI. Localhost and VPN-only apps work, because the browser is local.
- In your CI, with
stagewright ciin GitHub Actions, GitLab CI, Azure Pipelines, Bitbucket Pipelines or Buildkite. Runs in your CI use your compute and are free on every plan. - On a runner inside your network. For staging that only your network reaches, run Stagewright’s recorder container yourself. It opens no ports: it asks Stagewright for work over outbound HTTPS, records in its own Chromium, and uploads the results. Its token can only take and report its own runner’s runs; it can’t read walkthroughs, start runs, approve or publish. Runners you host are on the Scale plan.
- In our cloud, when your app is reachable from the internet.
In the first three, your staging environment and its credentials don’t need to be reachable from outside your network. The recordings, screenshots, traces and video are still uploaded to Stagewright, the same as cloud runs.
Secrets
Walkthrough files refer to secrets by name ({{secrets.password}}), so values never go in your repository.
- Stored secrets are write-only in the dashboard and encrypted with AES-256-GCM under a key only the API holds. Connection credentials for integrations are encrypted the same way.
- Local and CI runs read secrets from their own environment (
WALKTHROUGH_SECRET_<NAME>). Stored values are not sent to a local run unless the environment opts in, and each release is written to the audit log with the secret names, never the values. - Runners you host receive the stored secrets of the environment that chose them, and each release is written to the audit log with the runner’s name.
- In recordings, secret values are redacted from the timeline, step text and logs, and a sign-in step marked
hiddenisn’t in the video.
What’s on screen is in the video
Stagewright records what the browser shows. We recommend a demo account with seeded data rather than a real customer’s.
Masks (mask: selectors in a walkthrough) leave regions out of the before-and-after comparison, such as timestamps or generated ids. They don’t blur the video yet. Blurring personal data in video is planned. Until then, keep real personal data out of the account you record with.
AI providers
Stagewright uses two AI providers, and keeps it to those on purpose.
Anthropic (Claude) writes drafts and maps features. Depending on what you use, it’s sent: source files from the repository you connect (to map features and draft walkthroughs from their code), the text and structure of screens when Stagewright explores your app, support question clusters (already redacted), issue and pull request text when a walkthrough is written from an issue, narration and step text to write articles or translate, and your team’s own words from the pages and meetings you pick as voice sources. Secret values are not sent.
ElevenLabs turns narration text into speech. It receives the narration lines and the voice to use. Narration is cached in R2 by voice and text, so an unchanged line isn’t sent again. When a runner you host needs narration, Stagewright synthesizes it and sends the audio; no voice-provider key leaves Stagewright.
What we keep from support tools and meeting notes is described on the privacy page: redacted question clusters and counts, never message bodies or transcripts.
Access and identity
- Single sign-on with SAML, through Clerk’s enterprise connections, on the Scale plan. An organization’s admins add the connection in Settings › Security.
- Audit log export as CSV or JSON lines, on the Scale plan: who did what in the organization, including approvals, publishing and secret releases.
- API keys are scoped (reading walkthroughs, starting runs, approving, releasing secrets) and belong to an organization. Each local or CI run gets its own token that’s valid only for that run.
- The GitHub App asks for read-only access to repository contents, and write access only to checks, pull request comments and deployments.
Not built yet: SCIM provisioning, per-workspace retention settings, and a self-serve way to delete a workspace’s data.
Certifications
Stagewright is not SOC 2 certified. We’ll start the audit once there’s traction or a customer needs it, and we keep our practices audit-ready in the meantime: every change goes through a pull request that must pass typecheck, tests and a dry-run build before it can merge, database migrations are tried on a copy of the database first, a failed migration stops a deploy before any code ships, and production secrets live in one secrets manager.
We don’t have ISO 27001, HIPAA, or a third-party penetration test, and we won’t say we do until we have.
Reporting a problem
If you find a security issue, or need answers for a review, write to support@stagewright.ai. A person reads it.
Try it on your own product
Record a first walkthrough on your machine with no account. PR checks, approvals and publishing are in private beta: join the waitlist and we'll set you up by hand.