The short version.
- Assay never signs in to Okta and holds no Okta password, token or admin role.
- It works from files you export. Runs arrive only if you set Okta to send them.
- An export file is never sent to a language model.
- One thing can write to Okta, and only when a person chooses it: on Enterprise, Lens can add flows Assay Studio built to the folder open in that person’s own console session. It adds new flows only and switches nothing on.
- Each hosted workspace is its own instance. Assay staff can open it only while its owner has support access switched on.
1. What Assay can reach
Assay has no connection into Okta. There is no API token, OAuth grant or admin account for it to use, so it cannot read or change anything in your org by itself. Everything it knows arrives in one of four ways, each started by you:
- An export you upload. A folder or flow exported from the Workflows console. Okta removes connection credentials when it exports.
- Runs Okta sends. If you want run monitoring, you set Okta to send each run to your workspace with a key Assay gives you. Okta sends; Assay never asks.
- Lens, in your own browser. The Chrome extension reads the flow open in the designer and, with your consent, the names of the groups, apps, roles and policies a design needs. It holds no Okta password and works inside your own signed-in session.
- Your own flows, pipelines or agents. They can call your workspace with a connector key to read reports, send an export, or ask before a bulk change.
One feature writes to Okta, and only when a person chooses it: on Enterprise plans, Lens can add flows that Assay Studio built to the folder open in the console, using that person’s own browser session. It adds new flows only and never switches one on.
2. Where your data goes
Assessment, the grade, the architecture, change comparison, run alerts, the evidence pack and the Migrate inventory are computed in your workspace by fixed rules. No model is involved in them.
3. What goes to a language model
Only Assay Studio uses a model, and only when someone asks it to design, build, rebuild or review. The model is given:
- To design and build: the request typed in, the folder name, your answers to its questions, and the names Lens read for that design.
- To review a flow’s logic: what the flow must achieve and an outline of it: card names and types, which card feeds which, table names and the values typed into the cards.
- To rebuild a flow: its name, how it starts, its inputs and outputs, the names of its cards and of the other flows in the folder.
- To read a migration wave: the source of the objects you chose, after anything that looks like a secret is removed, and only after you agree on screen.
Never sent to a model: an Okta Workflows export file, a report, your runs, or anyone’s login or email. Assay does not train any model on what you send.
The build service processes these in memory and does not keep them. The one exception is a design and its price, kept for up to 72 hours so that building it produces exactly what you were shown. A workspace may connect its own model instead of Assay’s; that provider is then yours, under your agreement.
4. Where it runs and who can open it
- Each hosted workspace is its own instance, with its own data and its own secrets. A saved report lives only in the workspace that made it.
- Assay staff cannot sign in to a workspace unless an owner turns on support access, for a fixed time. Everyone signed in is told while it is on, and what support did is listed.
- Your people sign in with your own Okta or a password, and each has a role: viewer, developer, assessor or owner.
- Encryption in transit, least-privilege access for the people who run the service, and multi-factor authentication on every administrative account.
- Self-hosted, for Enterprise: the workspace runs inside your own network, with your own retention and region. The only thing that leaves it is an Assay Studio request, and only if an owner chooses to use Studio.
Assay operates from India, on servers rented from the hosting provider named below. Transfers from the UK and the EEA rely on the standard contractual clauses described in the privacy policy.
5. How long things are kept
| What | Kept |
|---|---|
| The free preview of an export | Not kept. It is processed in memory and discarded. |
| A saved report and the export it was made from | Until an assessor or owner deletes it, or the workspace is closed. |
| A flow checked by Lens | Not kept. Counts and a keyed hash are kept so the same finding can be recognised next time. |
| Runs sent by Okta | For the window set on that workspace, then deleted. |
| Kept versions of flows | For the window set on that workspace, and deleted with the org when you delete it. |
| What the build service receives | Not kept, except a design and its price for up to 72 hours. |
| Share links for an auditor | Until the date you chose. They can be revoked at any time. |
The full schedule, including engagements and billing records, is in section 5 of the privacy policy.
6. Who processes data for us
| Processor | What for | What it receives |
|---|---|---|
| Hostinger | The servers the website, the application and the build service run on | Everything a hosted workspace holds |
| Anthropic | The language model behind Assay Studio, when Assay’s own model is used | The request and outline in section 3; never an export file |
| An email delivery service | Invitations, Lens key confirmations and account recovery | The recipient’s address and the message |
| Razorpay | Card payments for Pay as you go credit | Your card details, on its own payment page. Assay never sees them. |
| An accounting service | Invoicing | Billing data |
The named list with locations is available from privacy@theassayco.com and comes with every order form. The website itself loads nothing from third parties.
7. Signed reports
A report can be signed with Ed25519. The signature covers the conclusions, not only the file, so changing a finding breaks it, and anyone with the public key can verify a report offline without an Assay account. A signed report states configuration facts as of the export’s time. It is not a security certification of your org.
8. What we do not have yet
Assay is a young company and says so. It has not yet had an independent security audit or certification such as SOC 2 or ISO/IEC 27001, and this page will say when that changes. Until then, the controls above are described, not attested. Security questions are answered directly at security@theassayco.com.
9. Reporting a security issue
Write to security@theassayco.com. We acknowledge within two working days and do not pursue good-faith security research.
Okta and Okta Workflows are trademarks of Okta, Inc. Assay is independent of Okta.