Data Privacy & AI Safety Policy

QASyn is built for teams that need evidence, not black boxes. This policy describes the controls that protect customer data and the safeguards that govern AI-assisted quality engineering.

Data governance. Test credentials and integration secrets are encrypted at rest with AES-256-GCM. API tokens are stored as SHA-256 hashes and shown once at creation. Every data access is scoped to the requesting organisation, and administrative actions are recorded in the system audit trail.

Tenant isolation. Organisation-scoped queries and route-level authorisation checks prevent cross-tenant access. Enterprise deployments can run in a private environment with customer-managed network boundaries and dedicated storage.

AI safety. AI-generated tests and analyses are evaluated against OWASP LLM Top 10 red-team suites. Guardrails run on every agent response, grounding checks compare outputs with your own knowledge base, and high-impact changes remain subject to human review before merge.

Model training. Customer workspace content is not used to train shared or foundation models without explicit written consent. Prompts and outputs are retained only as needed to deliver the feature, investigate failures, and meet contractual obligations.

Incident response. Security events are triaged by the QASyn security team. Confirmed breaches affecting personal data are notified to affected customers without undue delay and within the timelines required by applicable law.

Contact. Security and AI-safety questions: info@qasyn.io or contact us.