Samples are encrypted
before they reach us
Stubsmith generates privacy-safe API stubs from real traffic; samples are encrypted before they leave your infrastructure.
How it works
From real traffic to test fixtures in four steps — privacy preserved throughout.
Capture real traffic
Add the Stubsmith SDK to your service with a single line. It intercepts outbound HTTP calls and records request/response pairs into a local capture buffer.
SDK masks and encrypts at the edge
Before a byte leaves your infrastructure, the SDK applies your anonymizer rules (field masking, redaction) and then encrypts the payload with your project's public key. The server receives only ciphertext it cannot decrypt without your private wrapping key.
Stubsmith stores only encrypted samples and fingerprints
Stubsmith persists the ciphertext blob and a structural fingerprint of the request/response shape. The fingerprint contains no payload data — only enough structure to detect duplicates and organize stubs.
Generate stubs, fixtures, and replay in CI
Export stubs as OpenAPI, JSON fixtures, WireMock mappings, or MSW handlers. Wire them into your test suite and replay against your CI pipeline — no live API calls needed, no token leaks, deterministic results.
Built for the privacy-conscious team
Every design decision starts with the question: what happens to production data?
Privacy-safe edge encryption
Samples are encrypted client-side in the SDK. The server and platform staff never see plaintext request or response bodies — by design, not by policy.
Stubs from real traffic
Capture the APIs your service actually calls, not an approximation. Stubs reflect real schemas, error shapes, and timing behavior.
Record and replay
Record a session in staging or production, then replay deterministically in your CI pipeline. No flaky network calls, no test tokens.
Fingerprint deduplication
Stubsmith deduplicates traffic by structural fingerprint, so you get one canonical stub per API shape — not thousands of near-identical captures.
Per-org encryption keys
Each organization gets its own encryption context. Business plans include a dedicated KMS key — enabling crypto-shredding on offboarding.
EU-sovereign hosting
Compute runs on Scaleway in the EU. Encryption keys are managed by Scaleway Key Manager in Amsterdam. No data reaches US-based services.
The test-fixture problem has a privacy problem
Most teams solve the test-fixture problem by copying production data. That copies PII, credentials, and confidential payloads into developer laptops, CI logs, and staging databases — where they stay indefinitely.
Stubsmith's approach is different: encryption happens at the SDK, before the data leaves your network. The stub generation server sees structure, not content. Your stubs are accurate without your data ever leaving your perimeter in readable form.
- No production data in CI. Encrypted blobs are useless to an attacker without the private key your infra controls.
- Accurate stubs, not hand-crafted mocks. Generated from the real API — schema drift is caught at the next record cycle, not six months later in a prod incident.
- Retention windows, not indefinite storage. Samples expire on plan schedule. Fingerprints and stubs are yours to keep.
Frequently asked questions
- Does Stubsmith see my API request/response bodies?
- No. The SDK masks and encrypts samples at the edge before they leave your infrastructure. Stubsmith stores only ciphertext — our servers and staff can never read sample bodies.
- What's a fingerprint?
- A fingerprint is a structural signature of a request/response shape. Stubsmith deduplicates traffic by fingerprint and tracks them per plan. Fingerprints are capped by plan — when you hit the cap, new shapes are rejected at ingest with a clear error and dashboard banner. Existing fingerprints are never deleted; they are your durable asset.
- How long are samples kept?
- Sample retention depends on your plan: 24 hours (Free), 7 days (Solo), 30 days (Team), 90 days (Business). Fingerprints, request types, and generated stubs are kept indefinitely — they are the output, not temporary data.
- Where is my data hosted?
- All infrastructure runs in the EU. Compute is on Scaleway (Paris/Amsterdam) and encryption keys are managed by Scaleway Key Manager in Amsterdam. No data transits to US-based services.
- How does billing and VAT work?
- Prices are shown including VAT by default. EU B2B customers can supply a VAT ID at checkout for reverse-charge zero-rating. We use Mollie for payment processing; invoices are emailed automatically. Annual plans (Solo) are available at a discount.
Start with the free plan
One project, 50 fingerprints, no credit card required. Evaluate the full flow on a single service.