QATesty legal
Security Overview
The security principles and operational controls used to protect QATesty accounts, workspaces, test targets, and evidence.
Security model
QATesty uses layered controls across identity, authorization, target access, application runtime, data storage, and operational monitoring.
Identity and access
Sessions use hardened cookies, sensitive actions require authorization, and workspace permissions are scoped by roles and project membership. Customers are responsible for maintaining accurate membership and protecting credentials.
Target and browser safety
User-influenced target URLs are validated, private-network and metadata destinations are restricted, and browser requests are checked to reduce server-side request-forgery risk.
Data protection and resilience
Deployments use encryption in transit, controlled database access, structured security logging, backups, and recovery procedures appropriate to the environment and service agreement.
Vulnerability reporting
Report a suspected vulnerability privately through the Contact page. Include reproducible steps and impact, avoid accessing other users' data, and allow reasonable time for investigation before disclosure.