Katalon Security and Trust Center | Katalon
How Katalon protects your test data, your pipeline and your audit trail
Architecture, controls and regional obligations in one place - written for the security reviewer, the auditor and the buyer who has to sign.
ISO/IEC 27001 Certified
ISO/IEC 27017 Certified
ISO/IEC 42001 Certified · AI management
SOC 2 Type II Attestation
GDPR Processor · DPA available
DORA Regulation · EU
Answers to common security questions
01 Where is my test data stored?
Your test data is stored in your organization’s selected Katalon-managed secure environment. Regional hosting options are available in the United States and Europe; availability depends on the product and deployment model.
02 Is data encrypted in transit and at rest?
Yes. Customer data is encrypted at rest using AES-256 and protected in transit using TLS 1.2 or higher.
03 Do you train AI models on our data?
No. Katalon does not use customer prompts, test artifacts, or generated outputs to train its own or third-party AI models. Model providers operate under zero-data-retention agreements.
04 How is tenant isolation enforced?
Cloud infrastructure controls and application-level authorization logically separate each organization’s data and limit access to the appropriate tenant.
05 Can we run tests in restricted or self-hosted environments?
Yes. Katalon supports Docker-based local execution for isolated, customer-controlled test runs. SaaS and cloud features may still require network connectivity, depending on the product and configuration.
06 How can we access Katalon’s security documentation?
Visit the Katalon Trust Center to browse security, compliance, and privacy documentation. Public resources are available immediately; confidential materials show their document-specific request and NDA requirements.
See how Katalon supports security requirements in your industry
Financial services
Support regulated releases with traceable evidence and deployment options that keep execution and associated test data within your selected environment or region.
Common frameworks relevant to this industry
MAS, TRMRBID, DORA, APRA CPS 234, PCI DSS
- Deployment options you control: Self-hosted and Docker-based local execution for runs on your own infrastructure, with regional cloud hosting as an alternative. Availability varies by product and plan.
- Evidence for release decisions: Exportable run history, approvals, and defect links help internal audit and regulatory teams review the evidence behind each release.
- Evidence for third-party review: The standard Customer Data Processing Agreement is public. SOC 2 and penetration-test materials are listed in the Trust Center, with availability shown for each document.
Multi-layered security and a secure SDLC
Platform layers
Infrastructure
Hardened cloud baseline, private networking, no public database endpoints, continuous configuration monitoring.
Data
AES-256 at rest, TLS 1.2 or higher in transit, and field-level encryption for credentials and secrets in test artifacts.
Identity
SSO via SAML or OIDC, SCIM provisioning, project-scoped roles, and administrator MFA through configured identity policies.
Execution
Each TestCloud session runs in an ephemeral container, isolated by organization and destroyed after the run.
Detection & response
Centralized logging and 24/7 alerting support a documented incident-response process and defined customer-notification timelines.
Secure SDLC
- Threat modeling
New services and material architectural changes undergo threat modeling before implementation begins. - Secure code review
Code changes require peer review and pass automated SAST checks before merge. - Dependency & SBOM
Dependencies are scanned continuously, and an SBOM is generated for each release. - Pre-release testing
DAST and container scanning act as security gates in the release pipeline. - Annual pentest
Independent testing with a customer-shareable summary. - Vulnerability SLA
Critical findings are remediated within the published SLA and tracked through closure.
Need the architecture diagram?
Network, data-flow, and deployment diagrams are available in the Katalon Trust Center. Browse the Trust Center to find the relevant resources; each confidential document shows its sharing and NDA requirements.
Security controls and supporting evidence
Review the controls that protect your Katalon workspace, understand how they work, and identify the supporting evidence available for your assessment.
| Control | How it is enforced | Evidence |
|---|---|---|
| Single sign-on | SAML 2.0 and OpenID Connect (OIDC), configured per organization | SOC 2 · CC6.1 |
| MFA through your identity provider | Customers can enforce MFA for administrators and users through configured SSO and identity-provider policies | SOC 2 · CC6.1 |
| Role-based access | Project- and organization-level roles help limit access based on user responsibilities | ISO 27001 · A.5.15 |
| User provisioning | SCIM 2.0 support helps automate user provisioning and deprovisioning where configured | SOC 2 · CC6.2 |
| Encryption at rest | Customer data is encrypted at rest using AES-256 with AWS KMS-managed keys | SOC 2 · CC6.7 |
| Encryption in transit | Data in transit is protected with TLS 1.2 or higher | SOC 2 · CC6.7 |
| Audit history | Available product activity and audit records support security review, compliance evidence, and investigation workflows | ISO 27001 · A.8.15 |
| Backup & recovery | Customer data is backed up using encrypted AWS-native backup controls | SOC 2 · A1.2 |
Choose the deployment model that fits your security requirements
Compare Katalon-managed and customer-controlled options to understand where test execution runs, how data is protected, and which model best fits your organization’s operating requirements.
| Deployment model | Data residency | Key management | Network | AI availability |
|---|---|---|---|---|
| Managed cloud Katalon-operated SaaS | Regional hosting options for your Katalon environment | Katalon-managed encryption with AWS KMS | Secure cloud connectivity with allowlisting options where supported | Available when enabled by administrators |
| Dedicated cloud options Available by agreement | Region-specific environments are available for eligible customers | Encryption options are defined by the agreed deployment scope | Private-connectivity options are available by agreement | Configured to the customer’s governance requirements |
| Customer-controlled execution Runs in your infrastructure | Test execution and associated data remain in the customer-controlled environment | Customer-managed environment and key controls apply | Customer network and perimeter controls apply; some SaaS features may require connectivity | Optional, based on configuration and deployment model |
How Katalon supports your regulatory and compliance requirements
Compliance is a shared effort. Each entry explains the customer responsibility and the Katalon capabilities or evidence that can support your compliance program.
Customer responsibility The requirement applies to your organization Shared Katalon also has processor or vendor responsibilities Independent assurance Independent evidence is available on request
| Region | Regulation | Customer Responsibility | How Katalon helps |
|---|---|---|---|
| Singapore · APAC | MAS TRM Guidelines | Supervisory guidance for MAS-regulated entities | Self-hosted deployment in a region you choose, timestamped run history and release-gate reports per change record. |
| India · APAC | RBI Master Direction on IT Governance | Auditable change management and testing before deployment | On-premises or in-country deployment; in self-hosted mode no test data leaves your environment. |
| EU | DORA (Reg. 2022/2554) | Applies to financial entities | Resilience regression suites and documentation that supports your ICT third-party register are available through product evidence and Trust Center resources. |
| EU | GDPR | You are the controller; Katalon acts as processor | DPA with Art. 28 terms, EU data region, and guidance for keeping personal data out of test fixtures. |
| Australia · APAC | APRA CPS 234 | APRA-regulated entities must assess the information security capability | Pentest summary, control mapping and an evidence pack for your assessment file. |
| Malaysia · APAC | BNM RMiT | Requires financial institutions to test changes | Self-hosted or in-region deployment; release-gate evidence per change, and a security documentation pack for your third-party assessment. |
| Malaysia · APAC | PDPA 2010 (as amended) | You are the data user; Katalon acts as data processor | Standard public data processing agreement and guidance for keeping personal data out of test fixtures. |
| Hong Kong · APAC | HKMA SPM TM-G-1 | Technology risk principles for authorized institutions | Segregated approver roles, run records tied to approvals and an exportable sign-off trail. |
| United States · AMER | NYDFS Part 500 (23 NYCRR 500) | Covered financial entities must run a written cybersecurity program | Control mapping, pentest summary and exportable run and approval records for your third-party assessment file. |
| Canada · AMER | OSFI Guideline B-13 | Federally regulated financial institutions | Self-hosted or Canadian-region deployment, documented test evidence and a control mapping for your assessment. |
| Global | PCI DSS 4.0 | Live PANs must not be used in test or development environments | Tokenized test-data guidance and network isolation for payment regression suites. |
| Global | ISO/IEC 27001 · 27017 · 42001 · SOC 2 Type II | Your vendor file needs evidence that Katalon’s own security controls operate effectively. | Current certificates and the SOC 2 Type II report are listed in the Trust Center, where each document shows its availability and any NDA requirement. |
AI privacy and control stay in your hands
Katalon AI helps teams move faster without using customer data to train AI models. AI assistance is grounded in relevant workspace context, and administrators control whether and how AI features are enabled across the organization.
- Zero-data-retention agreements with Katalon-managed model providers.
- Customer data, prompts, and artifacts are not used to train AI models.
- Administrators can disable AI per project or across the organization.
- Supported AI experiences can reference the run, test, or file used as source context.
Grounded
AI responses use relevant Katalon context - such as tests, runs, and artifacts - to provide practical, workspace-aware assistance.
Cited
AI-assisted answers can reference the source context behind the response, helping reviewers validate where an answer came from.
Controlled
Administrators manage AI availability, provider settings, and supported AI keys to align with internal security policies.
Contained
Organizations can enable, restrict, or disable AI features based on their governance, deployment, and compliance requirements.
Find the security evidence required for your review
Browse Katalon’s security, compliance, and privacy resources in the Trust Center. Public documents are available immediately. Confidential materials show a document-specific request process and any NDA requirements.
SOC 2 Type II report By request
ISO 27001 · 27017 · 42001 certificates By request
Penetration test summary By request
Data processing agreement (standard) Public
Architecture whitepaper By request
Looking for something else? Browse the full library of security policies, control summaries, compliance documents, and completed questionnaires. Each item shows how it can be accessed.