Table of Contents
- SOC 2 Compliance
- Accessing Data in Ghost Inspector
- Storing Data in Ghost Inspector
- Ghost Inspector Employee Access
- Do you have concerns about security? Get in touch with us.
- Contacting Ghost Inspector Securely
SOC 2 Compliance
SOC 2, more formally known as Service Organization Control 2, is a voluntary compliance standard for service organizations, developed by the American Institute of CPAs (AICPA). It specifies how organizations should manage customer data. SOC 2 is both a technical audit and a requirement that comprehensive information security policies and procedures be written and followed.
Ghost Inspector achieved SOC 2 compliance in 2021 with the completion of our SOC 2 Type I report. The trust services criteria of our audit include security, availability and confidentiality. Our Type II audit period is currently underway and will be completed in early 2022. Contact support to request a copy of our SOC 2 report.
Accessing Data in Ghost Inspector
Ghost Inspector uses best practices for internet security. This helps ensure that your data is safe, secure, and available only to authorized users. Your data will be completely inaccessible to anyone else unless you explicitly choose to share that data with the public.
Ghost Inspector enforces secure HTTPS for our entire website, including the public (unauthenticated) parts of the site. All communications with Ghost Inspector’s API are also protected with SSL. We also use HTTP Strict Transport Security to ensure your web browser never interacts with Ghost Inspector over insecure HTTP.
Ghost Inspector provides each user in your organization with a unique username (e-mail address) and password. These credentials must be entered to access your organization’s data. A private API key is also available within each account which must be used when accessing our API. 2 factor authentication is available for all user accounts.
The Ghost Inspector recording extension allows you to record your actions and make them into a test. It only does this when you manually start recording a test; it’s not tracking your actions otherwise. Active recording is indicated by a green toolbar icon. The recording stops the second you finish (or cancel). Furthermore, the extension only sends the recorded data to our servers when you save the test. It does not send this data to our servers during the recording process — only when you explicitly save it.
The extension is only capable of making a small number of API calls to our servers. It can authenticate your account. We do this with your e-mail address and password, but we do not store a copy of these locally. Instead, we store your API key for future authentication. Other API calls are used to get a list of your current suites and tests. The last type of API call that the extension performs is sending your recording to our servers when you save it. All of these are done over HTTPS.
Storing Data in Ghost Inspector
Ghost Inspector is hosted on Amazon Web Services which provides comprehensive security practices for our underlying infrastructure. We follow AWS recommended best practices for architecting in the cloud. See AWS Cloud Security Documentation for more information. Ghost Inspector runs services and stores data in the us-east-1 region located in Northern Virginia, USA. We do offer various global geolocations for test running. These geolocations are not used by default, only when explicitly enabled for your tests. Each geolocation corresponds with a specific AWS region and operates as a network proxy only; it does not run tests or host databases directly.
Ghost Inspector allows you to store browser actions in a test and execute them from our servers. This can include logging into websites with a set of credentials. We provide an option for making values private. This prevents the value from being displayed in your test results but does not encrypt the actual value in our database. All test information is stored as plain text in our database. While we take the utmost precautions to secure our servers and database (including the use of “data at rest” encryption on database disk volumes), if a database breach were to occur, test data would be accessible. For this reason, we insist that you never use live credentials or any type of sensitive data within a test — whether specified manually or recorded with our extension.
If your test requires an account login, dummy data and/or staging servers should be used. If you're logging into a production application with Ghost Inspector, you should use an account designated for Ghost Inspector that does not contain any sensitive data and can easily be disabled. You should never use your own private credentials.
Why do we take this stance? The nature of browser testing makes encryption of values very challenging to uphold in all situations. We need access to plain text values to assign them into inputs, like a password field in a login form. This means we can't simply hash passwords to some irreversible value the way you typically do when storing passwords. Even when encrypting values in our database, we still need to send them in plaintext to the browser via automation APIs. There's a chance the value could be stored in a log file by the test runner or another service. If assigned improperly, the value could show up in a video or appear in a screenshot. There are many opportunities for a value to be exposed, some of which are out of our control and are instead based on the design of the test itself. For that reason — and because Ghost Inspector is designed as a testing product — our stance is simply that sensitive credentials should not be stored with us.
We understand that this may disqualify some companies from leveraging our service, but we feel that it's the right approach for us considering the risks involved in allowing sensitive information to be stored and used in the way that browser testing requires.
Ghost Inspector Employee Access
Ghost Inspector employees will only access your account data when one of the following scenario occurs:
- You request help from the Ghost Inspector support team and provide explicit permission to access a given resource. Permission will be attained through the support conversation. Permission is assumed when you send a specific resource identification or link URL to a resource in our system.
- The Ghost Inspector engineering team determines that there is a security issue or system-level interruption being caused by a specific resource and is required to investigate.
- Ghost Inspector suspects that a particular resource or account is behaving abusively and is required to investigate.
Do you have concerns about security? Get in touch with us.
We’re always happy to answer any questions or concerns about security you might have. If you are a Ghost Inspector customer (or potential customer) and have further questions about security, just visit our Support page.
Contacting Ghost Inspector Securely
If you’ve found a security vulnerability in a Ghost Inspector website or service, please send an email to our security team at firstname.lastname@example.org. Your email will be promptly reviewed and we will respond. We request that you not publicly disclose the issue until it has been addressed by us. We do attempt to reward responsible security reports that are sent to us. You can find more details about this on our Bug Bounty Program page.
If you choose to contact our security team, you can encrypt with PGP or the free alternative GnuPG. Our PGP key is listed below. This key is also registered with the MIT Public Key Server. You may use this key to encrypt your communications with Ghost Inspector.
Once you’ve imported our key, you can verify the signature of emails we send you by running
User name: Ghost Inspector Security <email@example.com> Key ID: 9E4FD4E8 Key fingerprint: C3AA 059E 305B E982 CBA6 327A E4E6 0722 9E4F D4E8 Expiration date: April 8, 2024 -----BEGIN PGP PUBLIC KEY BLOCK----- mQINBF6OHVUBEAC27xrYHVrO29JkJ8/0gOqUeo8kdVK6pzQoTjNRzfFXqYNyGVgA slP9yaKn0L3aGX30oIW9Lmch2ml6TIPI77HvHTEGfaFb2bDfAAm1bT1OAbcKf36L oZov6zz/cSbjJNXVHnrNcp6BYOA0wRI9GBhoSB7fgRssc8r5/YblTsb5FG8PuyL4 J4kgM3AZvQ8JPx2U2ze62hHloqqkEGbcEvMfzaYcqF0uOkjCz2quYYjHL70P960x +LaeNaqDyHW+5rjpzoGJEPBYNwI0pyHtjBllCCcDFrnlYxdANHRUBFIXyZv/UvbR XVu8K0VkWJzdCcS//b4UszbC5Xl29OdZO555bS4n89poS7mVcxmLnqLNIxjP7GvM T0P9WpRLr/nixsL3LoZjS4TEYGwG60f1zEeOypsblKHib3yh9CKiRI+pWRTxzDBx Y2nussP2Wn+PMRGzfRXKjzhPPt3S9Fk121k9nA+LHEeolfUcEyQ+lpaCT3NcUV6j a0eY13LBEiCFoHWfa+WjXoDAXykdpVy721sDsobXNO0GjhqKSJXAGv1i9t94aUc5 5YzNSSWldxASmmiuQsWIfoK0mImIlJ+9pofb94osz9hpghukVEam22+5DdInSL7T PeXP5FIf6byqnzDA3dVRYBCXN3LCKk4pLx6sZAiG/O/nd5410v9xrylr9wARAQAB tDZHaG9zdCBJbnNwZWN0b3IgU2VjdXJpdHkgPHNlY3VyaXR5QGdob3N0aW5zcGVj dG9yLmNvbT6JAlQEEwEIAD4WIQTDqgWeMFvpgsumMnrk5gcink/U6AUCXo4dVQIb AwUJB4YfgAULCQgHAgYVCgkICwIEFgIDAQIeAQIXgAAKCRDk5gcink/U6FxcD/sE pbmEaSgim6wevgMYXP3RKOfzuDGZ4QVaQLR2ZotxWz/3b4iZBpCcFSeiBgwYWPCc j/Ed6feuibJ3TEwp90MFmDSRpgAbfI1/MKTrhFEQi5yyWq4zujrjttXATODPyrKi btYSSlRqyiTU3hlcDoJtJB2RIlMEgschozc2/umrkK/sC8rEpsMsqJGogxQ/PfkT NDZz4HzT/sp0SXw4i0lf25ANHqz6tYY5W10+b0DCMw3qO5yLM3sjV/3Uz2sCDaYw RQ7Dd031FEjZTATBTMXoEs5NoKD0tn1m4F/RQHAzXeRaAaBN2GrY+knjCPDSiC9K //wuxaZi7ykcjou4Pc94KC/No2/n3lC0WTVRZOJqsZ2iDKzmWvRaV74BhC7cP1oT Wroo9d7nKCdkyxCg8jKnlFWwv27upHc0nLq4gsF/xKlQMDiIBWN3mzjZrWt4aIFU Z2Y9bqqUjyM62lTmbPWWof9xEwlUTlwfzU/3PfFM/cghW7UHjdZm7qZ9GpNDMV2s M978/K+AFiFWeB+YpznWXEARKUzhc9BTWTr7t05k27jdCOO+hOpSNDJDao7D51nt 2Lu8itWesflXWWDxGFrwiy27LDH4HO0npQ3b4/BWrhd1jgwGgRatleQxqSJuOKsi 4ksPro+h2U4/Hv+DSwRYI+u/82KlQq6i46U0VWtGdLkCDQRejh1VARAAmhWL1ww7 1+diSkTDhX9FU06osStYryMUB9qwmlKiaGzRxh6ThH2/oyIKxKFfXg2cayO3XZqk UPtJtjpFvGWCEQvRAOO2jhhr5gcdQjQ9phN+/RrHJiMtceKZdXVrpXSjJ+9xslln Jxo8TzWysrYEVPTGFw86DZsyikpq4JixutdfNA/ThGmQMM6aiJL5cPM6f6+Gu0fm jh11LqOiDnU8LAlwPEeYkIg1goFVYslmiM3ja3nPNdV8x96M/mFk5mdKIdNcbZI2 9RawxAEYoX8tkJx+2I5I9d8zQnGRCXzBqbuV3eMguglrlvf83Ry0FbnSwdIRW7IU Nv1VbQQwDITROvLXqso+VcSwxaex+ZpGLg68lJQ5yWh4Dlmyq7zth6wPMLdMxT3+ x9Ec/ukRB7/N0T937UzFsKdQyasAcEOsE9oRg5hQehbCcIa41NWgC5z3D7mX6y/c m3hlJeKveRSVUt4hkXi560XdyuV+UnNIois7OZ0itP4qUVLvPGKPfSiQY+vMPQoG awG0tbD6V+opqGgoamr0rmtdCElJ8TJUm9tBwqZB/g61qvmH5Ep9czClqBFbtXkb /f/rr0P8DCNkh6KSki5imuoJFNsH6LtMQhSUWdaTAtIQ1wHjDEt3EuayqnF8+m9u yafAi+3PsddMN6Qq9we9/EjMnGCyp/hE0y8AEQEAAYkCPAQYAQgAJhYhBMOqBZ4w W+mCy6YyeuTmByKeT9ToBQJejh1VAhsMBQkHhh+AAAoJEOTmByKeT9TodpgP+QF/ aTZhYfEvSbbJb5HULQ2xxr8Ih/jbp/E1XT8dk3e4dLm+ByrxRo83SO+tDwR2kfDM cJk79veyf6c9oyPWqmVmh6/yeO7sTwU1ZiAgQ5QWpHDITGrzDnb2cAmFC+N7pAM7 L9aPkRSrpgz6PJLbu2ziSGt2ddRbOBvRNGg8zLsxEbX94BmSZVlV+Uj62UJHTHxp iV9R+Tba3HpCnnckIlAUMmtCBzBBKJ4CKQ3iRHhlZFBD5Lxf5ma8BIro1pjQZlJJ fI+dKhIBycClDn3erWliOeh58ME409j29oNirFc6dW4VkcgZw6no7QRFI1p3tK4g YU4eYDZVkPZ5qYVqUzwL9ToT/PfkUjMmOzrc6VaYGf1rpSYY4KezNyvSq0L/C+fl Lf0gtd4TmOKZyTZts++KhqAc6TqywYOJ3AluPKh+oU7g6BOL4ZnoLB+p6QVK1Dgf nBMGROt9+kaCwtv3/o6taFg1QNS6mZRzWOim6e2boBhGzmtNvd1Ny36u6oYonHQE hUk31bCs5/ExZs+tDPWwGehXBrAgFcY6vw+c+WCe0qT0vjclXmd+WA0sl5tun+7Q nlzjCMXZy+NBInuPF8VFW8VqD1DFpQMKD3tjKOpXYVzqBmGByVHxdFRNm/XgRxGu KId7Gblta05YcGNjLN0Y3CIndIkVsorv/qlf5vzG =+uBP -----END PGP PUBLIC KEY BLOCK-----