Software Testing Data Policy

Purpose

This policy defines RunWhen’s approach to safeguarding production data while ensuring test environments remain robust and realistic. It explicitly prohibits the use of production data in non-production environments and specifies how test data is generated, controlled, and reviewed.

Scope

This policy applies to all environments used for software testing, including development, staging, QA, and integration systems. It covers all test scenarios used to validate RunWhen functionality, such as failure simulations and resilience testing.

Policy Statement

RunWhen strictly prohibits the use of production data in non-production environments. All test data is either:

• Generated using internal infrastructure and applications in development and staging environments.

• Sourced from approved sample applications (e.g., Kubernetes Online Boutique, Azure Contoso, Kubernetes Voting App) to simulate real-world failure modes and usage patterns.

Test Data Generation & Controls

• Data Creation: All test data is produced in-house from non-production systems and applications, ensuring no customer or operational data is exposed.

• Failure Simulation: Sample applications are intentionally manipulated to recreate error conditions, allowing thorough testing of RunWhen’s automation and resilience.

• Access Control: Non-production environments are protected via role-based access controls through Kubernetes RBAC, cloud IAM, and GitOps-managed policies.

• Auditability: All configuration and test data changes are recorded in Git to provide complete traceability and accountability.

Governance

This policy is jointly owned by the Head of Engineering and Head of Security/Compliance, and it is reviewed at least annually or whenever test practices evolve significantly.

For any questions or clarifications regarding this policy, please contact the Security or Engineering leadership team.