Testing that produces evidence, not arguments
Record a flow once. Run it as a regression test, a load profile, an OWASP security scan and a WCAG 2.2 audit. Every confirmed security finding arrives with the request that proved it. Every heal to a broken selector waits for a person to approve it. The intelligence runs inside your tenant on local models, so your code never reaches a third-party AI.
Free plan, no credit card. 14-day trial on paid plans. Demo requests are answered by an engineer within one business day.
We test Dokimore with Dokimore. Read how our own release pipeline runs on the platform. Every claim in it is checkable in our repository.- Proving request
GET /search?q=%3Csvg%2Fonload%3D…%3E- Response
200 · text/html · payload present at byte 4812- Proof
- Replayable request attached. No out-of-band callback needed for this class.
- Cross-reference
- Recorded step 7 ·
req_0012·elem_0031 - Remediation
- Encode
qfor the HTML context; ship a Content-Security-Policy withoutunsafe-inline. - Gate
- Fails the pipeline at severity medium or above.
Unconfirmed observations are shown too, labelled as such, and never fail a gate.
Five subscriptions, five logins, one test suite to maintain
Most teams run an API client, a recorder, a load tool, a scanner and an accessibility checker. Each one holds its own copy of your environments, credentials and selectors. Here they share a single set.
Local, Private Intelligence
Smart selection, self-healing and failure analysis run on local open-source models inside your tenant. Your code and test data are not sent to a third-party AI provider, and none of it trains a model.
Security Testing Built In
OWASP Top 10 (2025) and API Security Top 10 scanning against targets you have proven you own. Confirmed findings ship with the proving request and a replayable proof; everything else is labelled an observation.
Smart Test Selection
Maps a change to the tests that can reach it and runs only those, with a written rationale per decision and a confidence score that tells you when to run everything instead.
Self-Healing Tests
15+ locator strategies propose a repair; a person approves it in a review queue; the shared element repository learns from the approval, so one fix reaches every test that used that element.
Accessibility & Compliance Evidence
WCAG 2.2 A/AA/AAA scanning, VPAT generation, and tamper-evident audit logs your compliance team can hand to auditors.
Replace Your Tool Sprawl
API studio (REST, GraphQL, gRPC, SOAP), recorder, performance, security, and accessibility share one login, one test asset base, and one bill.
Engines, intelligence and governance, all built in-house
No reseller wrappers and no third-party scanner behind the curtain. That is why findings carry evidence you can export, and why nothing leaves your tenant.
Intelligence & Automation
- Smart Test SelectionImpact analysis runs only affected tests
- Self-Healing + Heal ReviewAuto-repair with human approval queue
- Intent-Based Load TestingDescribe traffic in English, get a load config
- Document IntelligenceAsk your documents and database, answers cite their sources
Testing Engines
- Security EngineOWASP 2025, red-team, evidence bundles
- Performance EngineJMeter-equivalent; export to k6, JMeter, Locust
- Visual EngineVisual regression and element-drift detection
- API EngineREST, GraphQL, gRPC, SOAP, mock server
Team & Governance
- Team Console & RBACPer-feature access grants, invites, sessions
- Tamper-Evident Audit LogIntegrity-attested activity trail
- Project ManagementWork items, sprints, traceability, worklog
- Alerting IntegrationsSlack, Teams, Opsgenie, PagerDuty, webhooks
Works With Your Stack
Record once,
reuse everywhere
A recorded flow is not locked to one runner. The same captured session drives a regression run, a load profile, a security scan and an accessibility audit, because all of them read from one element repository instead of four private ones.
- Intelligence that stays localLocal models run inside your tenant. No external AI calls.
- Selectors that survive refactors15+ locator strategies propose a fix; a review queue means you approve it, not the machine
- Evidence, not just findingsSOC 2-aligned controls, tamper-evident audit logs, and exportable evidence bundles
- Failures that explain themselvesEvery run links the failing step, the locator it used, and the request it made
Sixteen modules, one project
Every module reads the same environments, credentials and elements. Nothing here is an integration you have to configure and keep in sync.
Natural Language Testing
Describe a test in plain English; the platform builds it and runs it.
In developmentAPI Testing
REST, GraphQL, gRPC and SOAP in one client, with schema and response assertions.
Read the guideMobile Testing
Run the same suites against local iOS and Android devices and emulators.
In developmentPerformance Testing
Find the breaking point before your users do. Exports to k6, JMeter and Locust.
Read the guideSecurity Testing
OWASP Top 10 and API Top 10 scanning that outputs evidence bundles, not just a findings list.
Read the guideAgentic AI Testing
Agents explore the app on their own and report paths your suite never covers.
In developmentVisual Regression
Catch unintended UI changes across browsers before they reach a release.
Read the guideAccessibility Testing
WCAG 2.2 A/AA/AAA scans with VPAT export your compliance team can hand over as-is.
Read the guideCloud Execution
Fan suites out across parallel workers instead of queueing on one machine.
In developmentSmart Test Selection
Maps tests to changed code and runs only what that change can break.
Read the guideIntent-Based Load Testing
Describe the traffic you expect and get a runnable load profile out of it.
Read the guideTest Recorder
Record a browser session once, export it as Playwright, Cypress or Selenium.
Read the guideAI Assistant
Ask why a run failed and get the failing step and locator, not a stack trace.
In developmentAnalytics & Reporting
Pass rate, flake rate and duration trends per suite, per branch, over time.
Read the guideTest Data Factory
Realistic synthetic fixtures for any schema. No production data, no GDPR exposure.
Read the guideSecrets Management
Encrypted credential vault with rotation, so secrets never sit inside a test script.
Read the guideBuilt in, or bolted on
Most of these tools can reach most of these capabilities eventually. The question worth asking is how many plugins, integrations and separate invoices it takes.
| Capability | Dokimore | Selenium | Cypress | Katalon | BrowserStack |
|---|---|---|---|---|---|
| AI-assisted test authoring | Built in | Not offered | Via add-on | Built in | Built in |
| Security scanning (OWASP Top 10) | Built in | Not offered | Not offered | Via add-on | Not offered |
| Accessibility testing + VPAT export | Built in | Via add-on | Via add-on | Via add-on | Built in |
| Visual regression testing | Built in | Via add-on | Via add-on | Built in | Built in |
| Load and performance testing | Built in | Not offered | Not offered | Via add-on | Built in |
| Self-healing locators | Built in | Not offered | Not offered | Built in | Built in |
| Impact-based test selection | Built in | Not offered | Via add-on | Via add-on | Via add-on |
| API testing | Built in | Not offered | Via add-on | Built in | Built in |
| No-code test authoring | Built in | Not offered | Not offered | Built in | Built in |
| UI, API and security under one login | Built in | Not offered | Not offered | Via add-on | Via add-on |
Reflects each vendor's out-of-the-box capability as published in their own documentation, last reviewed August 2026. “Via add-on” means the capability exists but ships as a plugin, integration, or separately-priced product. Spotted something out of date? Tell us and we will fix it.
The questions your reviewers ask, answered before the call
Written the way a vendor questionnaire reads. Where something is still in progress, the answer says so.
- Hosted in Mumbai, India. Stated plainly in the privacy policy. Enterprise runs on-premise or air-gapped with feature parity.
- No third-party AI. Selection, healing and analysis run on local open-source models inside the platform. No customer data trains any model.
- Passkeys, 2FA, per-feature grants. Active scanning is its own grant. SSO and SAML on Enterprise.
- Tamper-evident audit log. Integrity-attested and exportable. Every heal approval and every scan authorisation is an entry.
- Evidence you can hand over. The proving request on every confirmed finding; VPATs generated from real scans; SOC 2-aligned controls, not yet certified.
- Disclosure and status. A vulnerability disclosure policy at /.well-known/security.txt and a public status page.
- Where is our data stored, and does it leave the region?
- Cloud tenants are hosted in Mumbai, India, so EU and UK customer data is transferred to India. Executed Standard Contractual Clauses and a transfer impact assessment are in progress; we will tell you where they stand rather than imply they exist. Enterprise customers can run the platform on their own infrastructure instead.
- Does any of our code or test data go to an external AI provider?
- No. Smart test selection, self-healing proposals, failure analysis and document intelligence run on local open-source models inside the platform. Nothing is sent to OpenAI, Anthropic, Google or Meta, and no customer data is used to train any model.
- How do you stop someone scanning a system they do not own?
- Active security scans run only against targets whose ownership has been proven by DNS TXT record, meta tag, file upload, email or API callback. The authorisation is recorded with a signature, and the decision to skip it is never made by the person requesting the scan.
- What compliance evidence can you give us today?
- A tamper-evident audit log, evidence bundles on every confirmed security finding, VPATs generated from real accessibility scans, and a documented set of SOC 2-aligned controls. We are not certified under SOC 2 and do not print the badge; a certification audit is on the roadmap.
- What happens if we leave?
- Recordings export as Playwright, Cypress or Selenium code; load profiles export to k6, JMeter or Locust; API collections export in open formats. Account data can be exported and deleted on request.
- Is there SSO, SCIM and an SLA?
- SSO and SAML are included on Enterprise. SCIM provisioning is not available today; invitations are manual or through SSO sign-in. Uptime commitments are contract terms on the Enterprise plan, and the public status page shows what is actually happening.
Full detail, including what is not done yet: Security and data handling. Comparing vendors? The 30-question evaluation checklist prints without a sign-up and includes our own answers, including the five we cannot answer yes to.
Three steps to your first run
Nothing to install, no CI changes needed to try it. A URL is enough to begin.
Point it at your app
Give it a URL. The crawler maps your reachable pages and catalogues the elements it finds on each one.
Record a flow
Click through the journey once in a real browser. Every step, selector, network call and assertion is captured as you go.
Run it four ways
Replay it as a regression test, a load profile, a security scan and an accessibility audit, all from the same recording.
Start free. Upgrade when you outgrow it.
Published quotas, enforced in the product. The numbers below are the actual entitlement limits, not a marketing summary of them.
Free
Try the platform. Solo use, with monthly caps.
- 100 Recordings/month
- 1,000 API Test Calls/month
- 10 Security Scans/month
- Analytics & Reports
- 1 User
Solo Pro
The full solo toolset for individual developers
- 1,000 Recordings/month
- 50,000 API Test Calls/month
- 100 Security Scans/month
- 500,000 AI Tokens/month
- AI Tools & Visual Regression
- Credentials Vault & Projects
- 14-Day Free Trial
Team
Up to 16 seats (1 admin + 15 members), pooled quotas
- Up to 16 Users
- 10,000 Recordings/month (pooled)
- 250,000 API Test Calls/month
- 500 Security Scans/month
- QA Workflows & Scheduling
- Team Console, RBAC & Audit Log
- 14-Day Free Trial
Enterprise
Unlimited quotas, every feature, custom deployment
- Unlimited Users & Quotas
- Every Platform Feature
- SSO & SAML
- Dedicated Support
- On-Premise / Custom Deployment
- 30-Day Trial
Why we built this
I started building this in Mumbai because shipping one release with confidence took five tools, five logins and five bills, and not one of them could show a reviewer why a finding was real. So the rule for everything here is simple: a result has to carry its own evidence. A security finding ships with the request that proved it. An accessibility report says which criteria a machine checked and which a person must. A heal to a broken selector waits for someone to approve it.
Some things we refuse to do, and you can hold us to them. We do not put customer logos on this page that we do not have. We do not print a SOC 2 badge we have not earned. We do not send your code to a third-party AI to make a feature easier to build. And when a capability is still in development, its card says so instead of pretending.
Where your data lives: cloud tenants are hosted in Mumbai, India, and test intelligence runs inside your tenant on local models. Teams that cannot accept that transfer can run the platform on their own infrastructure with full feature parity. We test Dokimore with Dokimore, so every release you use passed through the same pipeline we sell.
SivaganeshFounder, Dokimore · Mumbai
Talk to the people who build it
Try it against your own app
The free plan needs no credit card. Point it at a URL, record one flow, and see what four different test types make of it.