Encrypted in transit
Traffic to molar.it, app.molar.it and api.molar.it uses TLS. The app and API send HSTS headers so browsers only connect over HTTPS.
How Molar protects your data.
This page lists the security controls Molar runs today and the ones it doesn’t have yet. Molar is a beta. We do not hold SOC 2 or ISO 27001 certification, and no independent penetration test has been done yet.
- Your browser runMicrosoft AzureCentral IndiaRun records, screenshots, video, saved logins (encrypted)
- AI modelAzure OpenAI ServiceSouth IndiaYour goal, page content and screenshots, for each step
- Account emailResendUnited StatesYour email address and the message
- Test inboxesInkboxUnited StatesMessages your app sends to Molar test inboxes
- Product analyticsPostHogUnited StatesUsage events and dashboard recordings, with all text and media masked
Separated by organization
Row-level security in Postgres limits every database request to the organization you are signed into. The API also checks the organization in your signed session.
Saved logins encrypted
Saved logins and saved browser sessions are encrypted at rest (Fernet: AES-128 with HMAC-SHA256). The API never returns a saved secret: you can rotate or delete it, not read it back.
Hosted browsers run in locked-down workers
Hosted browsers run inside a separate worker container with a read-only file system, all Linux capabilities dropped, no privilege escalation, and memory and CPU limits. An egress guard checks every request the browser makes, including each redirect, and blocks private, loopback, link-local and cloud-metadata addresses. Hosted runs can’t reach your internal network; to test localhost or a private app, run the Molar CLI with local execution.
- Separate worker container
- Private addresses blocked
- Every redirect checked
app.yourcompany.comProject base URLCan open pagesstaging.yourcompany.comAllowed host you addedCan open pagescdn.example.netImage or script on a pageLoads, can’t be opened10.0.0.12Private networkBlocked169.254.169.254Cloud metadataBlockedRuns stay on your hosts
A run opens pages only on your project’s base URL and the hosts you add to its allowed hosts. Pages can still load images, scripts and other files from public hosts. Saved logins and protected values are typed only on those same hosts, and API keys can’t create saved logins. Hosted runs come from one static IP address, 52.140.93.245, so you can allowlist it on a staging server.
- Pages open only on project hosts
- Saved logins typed only there
- One static IP to allowlist
app.yourcompany.com/loginProject base URLTypedsso.yourcompany.comAllowed host you addedTypedlogin.othersite.comNot in the projectNever typedWhat the AI model sees
For each browser step, Molar sends your goal, the page content and a screenshot to Microsoft Azure OpenAI Service to choose the next action. Our deployment is in Azure’s South India region; as a global deployment, Microsoft may process requests in other Azure regions. We do not train AI models on your content.
The agent acts like a person
The agent clicks, types and submits forms the way a person would. It does not pause for confirmation before a purchase or a delete in the browser. Point runs at test accounts, Stripe test mode or the Stripe clone, never at an account that can move real money.
Access controls
Multi-factor sign-in is optional for each user, with an authenticator app or a passkey. Organizations can’t require it yet, and SSO (SAML) isn’t available yet. If you have multi-factor sign-in on, saving or rotating a saved login, regenerating recovery codes and exporting the audit log ask for a fresh check from the last 15 minutes. Owners and admins can read the audit log: sign-ups, invitations, role changes, member removals, API token creation and revocation, settings changes and MCP tool calls. Tool arguments are stored as a hash, never their values.
Backups and retention
Databases are backed up every 6 hours to Azure Blob Storage, outside the application server, with encryption at rest, versioning and soft delete. Backups are kept for 365 days. Run artifacts (screenshots, videos, HAR files and Playwright traces) are deleted automatically after 5 days, and run records (goal, status and step summary) after 90 days. Exported Playwright tests stay in your account. The product is hosted in Microsoft Azure’s Central India region.
Product analytics
PostHog records how the dashboard is used, including session recordings of layout, clicks and navigation. Recordings mask all text and every input value, block screenshots, video and other images, and drop query strings from every URL, so run goals, step descriptions, the sites you test and run media are never recorded. Our servers send PostHog the hostname of the site each run tested, never page content, screenshots, credentials or test inputs. The privacy policy and the subprocessors list cover every provider.
See our subprocessorsWhat we have not done yet
Molar has no SOC 2, ISO 27001 or other third-party certification. An independent penetration test is planned and has not been done. SSO and organization-wide multi-factor enforcement aren’t available yet. We will update this page when any of these change.
Report a vulnerability
Email pratik@molar.it with “Security” in the subject. Include the steps to reproduce and the impact you saw. We acknowledge reports within 2 business days. If a confirmed breach affects your data, we tell you within 72 hours. Please give us time to fix the issue before you disclose it, and do not access other customers’ data or disrupt the service while testing. Our /.well-known/security.txt lists the same contact.
Frequently asked questions
Need a security questionnaire filled in?
Email us
Do you have SOC 2 or ISO 27001?
No. Molar is a beta and holds no third-party certification yet. We can answer security questionnaires on request.
Where is my data stored?
In Microsoft Azure’s Central India region. AI model requests go to Azure OpenAI in South India and may be processed in other Azure regions. Account email (Resend), test inboxes (Inkbox) and product analytics (PostHog) are processed in the United States. The subprocessors page lists each provider.
Can a hosted run reach my internal network?
No. Hosted browsers block private and internal addresses. To test localhost or a private app, run the Molar CLI with local execution.
Which IP address do hosted runs come from?
Hosted runs use one static IP address, 52.140.93.245. Allowlist it to let Molar reach a staging server.
How long do you keep screenshots and recordings?
Run artifacts are deleted automatically after 5 days, and run records after 90 days. Exported Playwright tests stay in your account.
Ask a security question.
Email pratik@molar.it for security questionnaires, a signed Data Processing Addendum, or anything this page doesn’t answer.
Free during the beta. No card.