Hosting and data

Where your data is

• Test data and account data are stored in the EU: runs, results, screenshots, traces and browser consoles, and your name, email address and sign-in details. The app and its database run in Frankfurt, Germany.
• Sign-in runs on Squally’s own infrastructure: account data and sessions are stored in the app’s database in the EU (Frankfurt).
• Emails are sent from the EU (Ireland), and error tracking runs in the EU (Germany).
• Payments: paid plans open after the beta. The payment provider and where it processes data will be listed here and in the privacy policy then.
• AI analysis is opt-in and processed by Anthropic in the United States - see AI analysis below.

Every service provider, with what it receives, where it is and the basis for a transfer outside the EU, is listed in the privacy policy.

In transit

The reporter, the app and the read API are reached over HTTPS at https://app.squally.dev. Squally’s own connections to its file storage and to the AI provider use HTTPS too.

Keys and secrets

• Ingest keys and read keys are stored only as a hash. Squally shows each key once, when it is created, and cannot show it again. See Keys.
• A Slack webhook URL is stored encrypted (AES-256-GCM).
• Secrets in error text and test output, such as tokens, keys and passwords in URLs, are masked before they are stored. See What the reporter sends.

Error tracking

Squally records its own application errors with an error-tracking service hosted in the EU (Germany) - errors only: no performance tracing and no session tracking. It is configured not to send personal data by default, and before an error is sent, request bodies - your test data - cookies and authorization headers are removed from it. IP addresses are not stored.

When a GitHub check or comment or a Slack message cannot be delivered, Squally records that too - with the ids of the run and the project, which of the three it was, and a short failure code such as timeout or 403. Nothing else: no error text, no URL - a Slack webhook URL is itself a secret - no token and no test data.

AI analysis

AI analysis is opt-in. It needs the Standard or Pro plan and a project switch that is off by default, and it runs only when someone clicks to analyse a failed attempt. Nothing is sent before that.

When an analysis is started, the following is sent to Anthropic in the United States, which writes the explanation: the test’s name and file path, the browser, the branch, which attempt it is (first try or retry number), whether a later retry of the test passed in the run, a one-line summary of the test’s other attempts in the run, the command to run the test locally, the error messages, the top lines of each stack, the code snippet and its location, an excerpt of the page snapshot, the attempt’s duration, its timeout and whether it was hit, a derived error category, and the test’s flaky rate and failure rate over its recent CI runs.

Not sent: the commit author, the commit message, the test output and browser console, screenshots, traces, the recorded steps, and any account data. See AI analysis.