Security at QA Touch
QA Touch is an AI-powered test management platform, built by testers for testers, and used by QA teams in more than 100 countries. Our customers trust us with their test cases, defect records, release evidence, and the requirements behind them — information that sits close to the core of how their software is built and shipped.
We treat that responsibility seriously. This page explains how we protect customer data, how our platform is built and monitored, and what we expect from our own teams.
QA Touch is operated by DCKAP Inc., doing business as QA Touch.
Security Overview
Security at QA Touch is built into how we design, release, and operate the platform rather than added at the end. Our approach rests on a few principles:
- Defense in depth. Controls are layered across infrastructure, application, and process, so no single failure exposes customer data.
- Least privilege. People and systems receive only the access their role requires.
- Continuous improvement. We release on a regular bi-weekly cycle, which lets us ship security fixes and improvements promptly rather than batching them into infrequent releases.
- Transparency. We describe our practices in plain terms and answer customer security questions directly.
No platform can eliminate risk entirely. Our commitment is to reduce it deliberately, verify our controls, and respond quickly when something needs attention.
Data Protection and Privacy
Customer data ownership
Customers own their data. QA Touch processes customer data to deliver, maintain, and improve the service, as set out in our SaaS Services Agreement and Privacy Policy. We do not sell customer data.
Data minimization
QA Touch is designed for test management, not for storing regulated personal data. Our terms ask customers not to upload government identification numbers, financial account or payment card details, credit information, or health and medical records into the platform. Keeping this data out of test management systems reduces risk for everyone.
Data subject requests
We support privacy rights requests through our published privacy channels, including access and deletion requests. Details are available on our Privacy Policy and Privacy & Data pages.
Data retention and deletion
Customer data remains available throughout an active subscription. When a subscription is cancelled, access to the account is removed, so we recommend exporting any data you wish to retain before cancelling. Should QA Touch ever discontinue the service, our agreement commits us to advance notice and a defined window for customers to retrieve their data.
Infrastructure and Hosting Security
QA Touch runs on established cloud infrastructure providers operating hardened, professionally managed data centers with physical access controls, environmental protections, and redundant power and networking.
Environment separation
Production, staging, and development environments are separated. Customer production data is not used for routine development or testing work.
Network protection
Platform components are deployed behind network controls that restrict inbound traffic to what the service requires. Administrative interfaces are not openly exposed to the public internet.
Availability
Our service level terms target 99.9% monthly availability, measured as described in the QA Touch SaaS Services Agreement. Scheduled maintenance is communicated in advance wherever practical.
Access Control and Authentication
Customer-side access control
QA Touch gives administrators granular control over who can see and do what within their workspace:
- Custom roles and role-based permissions, so access can be scoped to a user’s actual responsibilities.
- Project-level assignment, allowing teams, clients, and contractors to be limited to relevant projects.
- Audit logs, which record key activity in the platform — what changed, when, and by whom — supporting internal review and investigation.
Single sign-on
QA Touch supports enterprise single sign-on through Okta, Microsoft Azure, and Google, allowing organizations to apply their own authentication policies, multi-factor requirements, and centralized provisioning and deprovisioning.
Internal access control
Access to production systems is restricted to personnel whose roles require it, granted on a least-privilege basis, and revoked when someone changes role or leaves. Administrative access uses individually attributed accounts, never shared credentials.
Encryption and Secure Data Transmission
In transit
All traffic between users and QA Touch — through the web application, our API, and our integrations — is encrypted using TLS. Connections over unencrypted HTTP are redirected to secure equivalents.
At rest
Customer data stored by the platform, including database contents and backups, is encrypted at rest using industry-standard algorithms.
Credentials and secrets
Account passwords are stored using one-way cryptographic hashing and are never retrievable in plain text — not by customers, and not by QA Touch staff. Integration tokens, API keys, and other application secrets are stored using protected secret-management mechanisms rather than in source code or configuration files.
Application Security
QA Touch is built by a team whose profession is finding defects, and we apply that discipline to our own product.
Secure development
Security considerations are part of design and code review. Changes are peer-reviewed before release, and our regular release cadence keeps the deployed platform close to the reviewed and tested state of our codebase.
Common web vulnerabilities
We develop with reference to widely recognized application security guidance, including the OWASP Top 10, and design against common classes of vulnerability such as injection, broken authentication, cross-site scripting, and insecure direct object references. Input validation, output encoding, and authorization checks are applied at the application layer.
Dependency management
Third-party libraries and components are tracked and updated. We monitor for disclosed vulnerabilities in our dependencies and prioritize updates based on severity and exposure.
Integrations and API
Our API and our integrations with tools such as Jira, GitHub, GitLab, Slack, Jenkins, and others authenticate using scoped tokens or credentials that customers control and can revoke at any time.
Vulnerability Management
We identify, triage, and remediate vulnerabilities through a defined process.
Identification
Vulnerabilities are surfaced through internal security testing, automated scanning of our applications and dependencies, monitoring of vendor and community advisories, penetration testing, and reports from customers and external researchers.
Triage and remediation
Each finding is assessed for severity, exploitability, and exposure, then assigned an owner and a remediation target. Critical and high-severity issues are prioritized ahead of planned work and, where warranted, released outside our normal cycle. Lower-severity findings are scheduled into upcoming releases.
Verification
Fixes are verified before a finding is closed. Where a vulnerability was identified through penetration testing or an external report, we retest against the original finding rather than relying solely on the fix being merged.
Penetration Testing
QA Touch engages qualified independent security specialists to perform penetration testing of the platform at least annually. In addition to this annual cycle, we conduct targeted testing following significant changes to our architecture, authentication mechanisms, or infrastructure — changes that materially alter the platform’s attack surface.
Scope and methodology
Testing covers the QA Touch web application, our public API, authentication and authorization flows, and the supporting infrastructure. Engagements follow recognized industry methodologies, including OWASP testing guidance, and combine automated tooling with manual testing by experienced security practitioners — because automated scanning alone does not find business logic and authorization flaws.
Findings
Findings are triaged by severity and entered into our vulnerability management process, with remediation prioritized accordingly and verified through retesting. Results inform not only immediate fixes but our engineering standards going forward.
Customer requests
Enterprise customers and prospects conducting security reviews may request a summary of our most recent penetration testing under a mutual non-disclosure agreement. Contact us at info@qatouch.com to begin that process.
Security Monitoring
Logging
Platform and infrastructure activity is logged centrally, including authentication events, administrative actions, and system-level events. Logs are retained to support investigation and are protected against unauthorized modification.
Detection and alerting
We monitor our systems for availability, errors, and anomalous behavior, with alerting that routes issues to the responsible engineering team. Monitoring covers both performance and security-relevant signals such as unusual authentication patterns.
Customer visibility
Within the product, the QA Touch audit log gives administrators their own view of activity in their workspace, so security oversight is not solely dependent on us.
Backup and Data Protection
Customer data is backed up regularly, and backups are encrypted and stored separately from primary systems.
Restoration
We maintain and periodically exercise restoration procedures. A backup is only as good as the last time someone proved it could be restored, and we treat verification as part of the process rather than an assumption.
Customer-side export
We encourage customers to maintain their own copies of critical data. QA Touch supports export of test cases, test runs, issues, and reports, and our API allows programmatic extraction for teams that want independent archives. Customers remain responsible for their own backup practices, particularly ahead of subscription changes or cancellation.
Employee Security and Confidentiality
Screening and agreements
Personnel with access to customer data are subject to background verification consistent with local law and are bound by written confidentiality obligations that survive the end of their employment.
Training
Team members receive security awareness training covering data handling, phishing and social engineering, credential hygiene, and incident reporting. Engineering staff receive additional guidance on secure development practices.
Access lifecycle
Access is granted on joining based on role, reviewed as roles change, and revoked promptly on departure. Company devices used to access production systems are configured with disk encryption, screen locking, and endpoint protection.
Confidential reporting
QA Touch maintains a published Whistleblower Policy, giving employees and contractors a route to raise concerns — including security and ethical concerns — without fear of retaliation.
Security Incident Response
Our process
We maintain an incident response process covering detection, containment, investigation, eradication, recovery, and post-incident review. Incidents are assigned a severity, an owner, and a communication path from the moment they are identified.
Containment and investigation
Our first priority is limiting impact. We then establish what happened, what data or systems were involved, and what is required to restore normal, secure operation.
Customer notification
If an incident affects the confidentiality, integrity, or availability of customer data, we notify affected customers without undue delay. Notification includes what we know, what we are doing, and what action — if any — customers should take. We would rather share an incomplete picture promptly and update it than delay communication until an investigation concludes.
Learning from incidents
Every significant incident is followed by a review that examines root cause and contributing factors, with resulting actions tracked to completion.
Customer Security Responsibilities
Security is shared. QA Touch secures the platform; customers control how it is used within their organization. We recommend that customers:
- Enable single sign-on through Okta, Microsoft Azure, or Google, and enforce multi-factor authentication through your identity provider.
- Apply least privilege using QA Touch custom roles, granting administrative rights only where genuinely needed.
- Review access regularly, particularly for contractors, clients, and departed team members.
- Keep regulated data out of the platform — no payment card data, government identifiers, health records, or similar regulated personal information in test cases, defect reports, or attachments.
- Manage integration credentials carefully, rotating API tokens periodically and revoking those no longer in use.
- Use the audit log as part of your own periodic security review.
- Export data before cancelling a subscription, since access ends when the subscription does.
Security Contact and Reporting
Reporting a vulnerability
If you believe you have found a security vulnerability in QA Touch, we want to hear from you. Please email info@qatouch.com with enough detail to reproduce the issue, including affected URLs or endpoints and the steps involved.
We ask researchers to report privately and give us reasonable time to remediate before public disclosure, and to avoid actions that would degrade the service or access data belonging to other customers. We investigate every report we receive and will keep you informed of our findings. We do not pursue legal action against researchers who act in good faith and in accordance with these guidelines.
Security questionnaires and reviews
For security reviews, vendor assessments, or questions during procurement, contact info@qatouch.com and our team will respond.
Reporting a suspected incident
If you believe your QA Touch account has been compromised, contact support@qatouch.com immediately and, where possible, revoke affected credentials and API tokens from within the platform.