← All features

Testing

Secure test data

Production messages make the best test cases, but they contain payroll, payment and customer data that contractors must not see.

Figaf builds test cases from real production messages, because they contain all the variations in your data. Secure test data protects those messages when they are confidential, so integration teams, including external contractors, can run and review the tests without seeing sensitive content. It works for SAP PI/PO and SAP Cloud Integration.

How it works

• Mark a system as confidential. You select any connected SAP PI/PO or Cloud Integration system and specify that it is confidential. All test cases created from that system are then marked as confidential.
• Role based viewing. Only users with the role IRTSensitivePayloadViewer can view the original data. Other users see a scrambled version, where for example the name Daniel is shown as Xxxxxx.
• Errors stay visible. Users with the masked view can still see which field differs in a test, so they know something is wrong without seeing the value. If they need more, they can ask an admin to view the difference.
• Secured systems only. Tests on confidential data can only run on systems marked as secured, which are configured so users cannot view the payloads being processed.
• Obfuscated test cases. As a second option, you can take the input messages and replace part of them with obfuscated data to create test cases.
• Other preventive measures are built in to block users from viewing the test data.

Business value

• Test with real data and stay compliant. Production data is often subject to GDPR or SOX. Masking lets you use it for regression testing without giving every developer access to it.
• Outsource testing safely. Contractors and external consultants can run your test cases and handle configuration, for example in an SAP PI/PO migration, without access to confidential payloads.
• Better test coverage. Teams do not have to fall back on hand-made test data for sensitive interfaces such as HR or financial payments, so those interfaces are tested with the same variety as the rest.
• No manual anonymization per interface. You do not need a developer to work out what is sensitive in each message, which would be hard to do across all interfaces in a migration.

Good to know

• Secure test data is part of testing in the Figaf DevOps Suite and the Figaf Testing Tool.
• You should perform your own assessment of the security to check that it meets your requirements.
• Related features: regression testing, service mocking.

Learn more

• Figaf Testing Tool