Security and hosting, in plain terms

Who hosts it

Modali hosts Axl Engine and Modali Accelerate. You don't install anything for a pilot.

Where data is stored

Project data, run results, reports and evidence are stored in the United States, in AWS us-west-2 (Oregon), through our database provider Supabase.

Where test runs execute

Test runs execute on Modali's runners on Cloudflare's network. Today the runners are shared across Modali's clients and not pinned to a particular region. If you need a dedicated or client-hosted runner, we can discuss running test execution inside your own environment.

Test accounts

Axl signs in to Ivalua with test accounts that you provide for each environment. Passwords are stored encrypted; Accelerate can't read them, and each one is used only for runs on its environment.

We recommend dedicated test accounts with only the permissions the tests need.

Production environments

Production environments are read-only for Axl Test. Tests that create records run only on non-production environments you name for it.

A person approves every run

Every hosted test run, and every check of a test account, waits for a Modali operator to approve it before it reaches your Ivalua environment. Only one run uses an environment at a time; a second one waits in a queue.

Who can see what

Access follows the Accelerate project's members and roles. People from the client organization can read and request scenarios by default; starting runs or approving them is a project setting. Changes to access are recorded in the audit log. Pipeline tokens are shown once, limited to the environments and suites you choose, and can be revoked at any time.

Screenshots and evidence

Runs capture screenshots of your Ivalua environment as evidence. Reports can mask areas of a screenshot that are declared as personal data, but the original captures are stored unmasked as run evidence, and defect drafts can link to them. Use test data without real personal data wherever you can, and tell us about any data that needs special handling before a pilot starts.

There are no self-service retention or deletion settings yet. Talk to us about your retention requirements when we scope the pilot.

AI models

Run results and screenshots are not sent to an AI model. More detail is available under NDA as part of your security review.

Certifications

Modali does not hold SOC 2 or StateRAMP today. Available on request: our current controls and a description of how data flows through Axl Engine. If your program requires a certification we don't hold, tell us early so we can work out together what is possible, including client-hosted execution.