Security

Last updated: April 2026

Our approach

QACrow is built by engineers who have shipped production systems for over a decade. Security isn't a checkbox; it's how we design every feature.

Infrastructure

• All services run on hardened cloud infrastructure with isolated network segments.
• Test execution happens in ephemeral, single-tenant browser sessions that are destroyed after each run.
• All data in transit is encrypted using TLS 1.2+.
• All data at rest is encrypted using AES-256.

Authentication

• Magic link and Google OAuth sign-in.
• Sessions are stored server-side with rotating tokens.
• API keys are scoped, revocable, and never logged in plaintext.
• Workspace roles enforce least-privilege access to resources.

Test data

• You can store credentials in encrypted secret variables, never visible in run logs.
• Screenshots and run artifacts are retained for the period specified in your plan and then deleted.
• You can request immediate deletion of any run, plan, or workspace at any time.

Reporting a vulnerability

We welcome responsible disclosure. Please email security@qacrow.com with details. We respond within two business days and will keep you in the loop until resolution.

Compliance roadmap

SOC 2 Type II is in progress. ISO 27001 and HIPAA-aligned controls are on the roadmap based on customer demand. Reach out if you need a specific compliance posture for procurement.