Built for procurement, not around it
Shift-Left API was designed for regulated enterprises that can't ship API specs to OpenAI. This page documents what we ship today, what we're transparent about not yet shipping, and how to get the security questionnaire response your team needs.
This page covers how Shift-Left API protects your data. To test the security of your own APIs, see API security testing: OWASP-mapped checks generated beside your functional tests, available as a paid add-on and included in the trial.
Where your data lives
Two deployment shapes — self-hosted on your infrastructure, or multi-tenant SaaS managed by us. Both shapes treat your API specifications, credentials, and test traffic as sensitive by default.
| Data class | Self-hosted deployment | Multi-tenant SaaS |
|---|---|---|
| API specifications (OpenAPI / Swagger / WSDL) | Stays on your infrastructure | Stored in tenant-isolated MongoDB |
| AI prompts and generated tests | Sent only to the LLM endpoint you configure (Ollama / vLLM / LM Studio) | Sent to the LLM provider you select (BYO API key) |
| API credentials, tokens, secrets | AES-256-GCM envelope encryption at rest in your database | AES-256-GCM envelope encryption at rest, in a database per tenant |
| Test execution traffic (HTTP requests to your APIs) | Originates from your runner; never leaves your network | Originates from cloud runner; egress to your published API endpoints only |
| Audit logs | Stored in your database; configurable retention (Enterprise) | Stored per tenant; readable page by page through the API |
For deployment topology and runtime requirements, see the deployment page.
Identity, access, and audit
Role-based access control
Five built-in roles cover the typical enterprise testing org: Administrator, Contributor, Reviewer, Reader, and Environment Manager. Roles map to project assignments and govern who can author tests, approve API spec changes and view results.
Authentication
Local authentication with JWT tokens, AES-256-GCM encrypted credential storage, and email-based user invitations. Public REST API keys are scoped, never exceed their creator’s permissions, expire, rotate with a grace window, and sit behind platform-wide rate limiting.
Single sign-on
Enterprise plans and the Trial include SSO configuration: a Microsoft Entra ID preset, generic OIDC (Okta and other standards-compliant providers) and SAML 2.0, with a default role for new users, allowed email domains and group-to-role mapping. There is no SCIM provisioning. See the SSO row on the pricing comparison for plan details.
Audit & observability
Audit logs record changes with the user, IP address, device and before and after values, in a filterable viewer with statistics. Real-time logs and a system health dashboard surface platform metrics. A real-time activity feed streams team actions, and configurable retention (Enterprise and Trial) keeps history as long as your compliance policy requires.
AI governance: your specs, your LLM, your call
The single biggest reason regulated buyers move off cloud-only API testing tools: the AI features require shipping API specifications to a third-party LLM. We treat that as a configuration choice, never a default.
BYO LLM key
Cloud LLM access is always bring-your-own-key. We never broker credentials to OpenAI, Anthropic, Azure OpenAI, Gemini, or any other supported provider. Your key, your usage, your invoice.
Self-hosted inference
Run AI test and mock generation against an Ollama, vLLM, or LM Studio endpoint inside your perimeter — or any OpenAI-compatible URL you control. API specifications, prompts, and generated tests are sent only to the endpoint you configure. Available on the Trial and Enterprise plans.
Spec change approval
When an upstream spec changes, the platform lists every changed endpoint and field, classifies breaking changes, and waits for an explicit approval; approval creates new endpoint versions and never rewrites existing tests.
Compliance posture
Honest about what is shipped, what is on the roadmap, and what is configurable today. We will update this page as items move state.
SOC 2
RoadmapEngagement with an independent auditor is required before publishing a Type 1 target date. We will update this page when that engagement begins.
ISO 27001
RoadmapAligned with internal security governance; formal certification follows SOC 2.
GDPR / data residency
Self-hosted by defaultSelf-hosted deployment keeps API specs, credentials, and test data inside the residency boundary you choose. The multi-tenant SaaS has no region selection today.
Trust center
What procurement, legal, and security teams typically request during evaluation. Most items are shared on the architect call or under a one-page NDA — we don't gate this content behind a sales process.
SOC 2 report request
SOC 2 Type 1 is on the roadmap. Until the report is published, we share an internal control summary mapped to Common Criteria CC6 / CC7 / CC8 under NDA. Email security@totalshiftleft.com to request the packet.
Request control summary →Penetration test summary
Penetration-test summaries are available on request for active evaluations.
Request pentest summary →Software Bill of Materials (SBOM)
SBOM summaries are available on request for active evaluations.
Request current SBOM →Vulnerability disclosure
We accept coordinated vulnerability reports at security@totalshiftleft.com with PGP-encrypted submissions for sensitive findings. Acknowledgment within one business day, triage within five. Safe harbor for good-faith research per a published policy.
Read disclosure policy →Subprocessor list
A maintained list of subprocessors that touch customer data — by category (infrastructure, payment processing, identity), purpose, and region. Updated when subprocessors change; available on request.
Request subprocessor list →Data processing addendum (DPA)
GDPR-aligned DPA with EU Standard Contractual Clauses where required. Pre-signed copy available; or we sign yours after a brief legal review.
Request DPA →Security questionnaire response
Procurement and security teams typically ask for the same 30-50 control questions. We share a security questionnaire response, deployment topology diagram, and reference architecture upfront on the architect call — so your security team can review in parallel with the technical evaluation.
Email security@totalshiftleft.com with your questionnaire format, or book a demo and we'll share the standard response packet on the call.
Talk to our architect, not a sales rep
30-minute deployment and security review. We share questionnaire responses, topology diagrams, and reference architecture on the call.