# Security

Last updated: April 2026

## Our approach

QACrow is built by engineers who have shipped production systems for over a decade. Security isn't a checkbox; it's how we design every feature.

## Infrastructure

- All services run on hardened cloud infrastructure with isolated network segments.
- Test execution happens in ephemeral, single-tenant browser sessions that are destroyed after each run.
- All data in transit is encrypted using TLS 1.2+.
- All data at rest is encrypted using AES-256.

## Authentication

- Magic link and Google OAuth sign-in.
- Sessions are stored server-side with rotating tokens.
- API keys are scoped, revocable, and never logged in plaintext.
- Workspace roles enforce least-privilege access to resources.

## Test data

- You can store credentials in encrypted secret variables, never visible in run logs.
- Screenshots and run artifacts are retained for the period specified in your plan and then deleted.
- You can request immediate deletion of any run, plan, or workspace at any time.

## Reporting a vulnerability

We welcome responsible disclosure. Please email [security@qacrow.com](mailto:security@qacrow.com) with details. We respond within two business days and will keep you in the loop until resolution.

## Compliance roadmap

SOC 2 Type II is in progress. ISO 27001 and HIPAA-aligned controls are on the roadmap based on customer demand. Reach out if you need a specific compliance posture for procurement.