Built to run inside your organization
Tenant isolation, encrypted credentials, audit logs and a runner that only makes outbound connections. Stakari is in early access, and some controls below are planned.
Isolation and access
- All data is isolated per organization at the database level, and that isolation is checked by automated tests.
- Organizations have members in Owner, Admin, Member and Viewer roles.
- Project-scoped API keys for CI and the CLI are revocable and shown only once.
- Multi-factor authentication.Coming soon
- SSO and SCIM.Coming soon
Security and secrets
- All traffic uses TLS. Credentials and integration tokens are encrypted at rest with authenticated encryption and a managed key store.
- Secrets never appear in logs, prompts, evidence or error reports, and an automated scan verifies it.
- The runner guards against server-side request forgery from user-supplied URLs.
- Dependencies are scanned for known vulnerabilities, and container images are minimal and non-root.
Control and audit
- An audit log records member, credential, policy and approval changes.
- Every outbound request is recorded: time, run, scenario, method, host, path, status and duration.
- Kill switches exist per run, per organization and globally.
- Production safe mode allows only read-only scenarios by default. Loosening it takes an Admin and is audit-logged per endpoint.
Runs in your network
- The runner ships as a Docker image and a CLI, and runs the same on a laptop, in CI, in the Stakari cloud and inside your network.
- The runner authenticates with a scoped token and makes only outbound connections.
- Hosted runners block requests to private address ranges, link-local addresses and cloud metadata endpoints. Customer-hosted runners may reach private ranges.
- Browser and executor processes run in isolated containers with no access to the runner host's files or credentials.
Privacy
- Stakari stores only test results, evidence and configuration. The product tells you to use test data, not real customer data.
- You can delete your project data and evidence.
- Customer data is not used to train or fine-tune models.
- Data processing terms and a subprocessor list, including LLM providers.Coming soon