Control what a campaign can test.

Our application, account records and campaign evidence are hosted in France, within the European Economic Area.

Agent-to-dashboard traffic uses TLS. Access to campaign records is restricted to the owning account. Stripe processes payments and Resend delivers email; both process some account data outside the EEA.

Short-lived email sign-in and account-security link tokens are kept in authentication records only as cryptographic hashes. Enrolled authenticator secrets are encrypted at rest, and recovery codes are stored as hashes.

The privacy policy and Data Processing Agreement describe processing providers, the data involved and international transfers.

Campaign objectives and selected campaign context are also sent to an external service for campaign analysis and attack planning. This context can include credential details, access evidence and operation output. Contact security@autoattack.ai before deployment if your assessment has specific provider, retention or residency requirements.

Set the objective, authorized scope, exclusions and starting access before deployment. Review the reversible changes included in the campaign setup.

Credential attempts use lockout controls. Each campaign runs in a fresh container, and you can request a stop from the campaign page.

Deleting your account from Settings makes it inaccessible and deactivates your agents. Your email address is overwritten after 30 days, subject to the retention exceptions in the privacy policy.

If a breach affects your personal data, we notify the relevant supervisory authority within 72 hours where required, and affected customers without undue delay. Found a security issue in AutoAttack itself? Email security@autoattack.ai, or use the machine-readable contact at /.well-known/security.txt.