Security & Trust
How the NexGen QA platform protects your data
About our compliance language. NexGen QA does not hold a FedRAMP authorization, a FedRAMP Ready designation, a DoD Impact Level authorization, a SOC 2 report or an ISO 27001 certificate. Framework names on this site describe evidence or control mapping features. Ask us at contact@qa-automation.com for our current attestation status. This page describes the platform at app.qa-automation.com; how we handle personal data is covered by our Privacy Policy.
What you control, and what NexGen QA runs
- Bring your own OIDC or SAML identity provider, on domains you verify by DNS, and require SSO for your whole organization with a break-glass owner.
- Keep generated reports, datasets, multimodal artifacts, visual-regression screenshots, evidence snapshots and exports in your own S3, R2 or S3-compatible bucket, chosen per type, for data written after you enable it.
- Set retention per data type. Export your organization's data as a ZIP with an expiring link. Delete it with a verified, signed receipt.
- Choose which AI providers and models may run, set a monthly spend limit (estimated), and choose whether evaluation and trace prompts and responses are stored in full, redacted, or as metadata only.
- Stream your audit log to your SIEM over signed HTTPS webhooks, with at-least-once delivery.
NexGen hosts the application, its database and orchestration. The controls above decide what is stored, where your bucket-backed files live, and who can sign in; they do not move the service into your cloud.
Authentication
JWT-based authentication with SHA-256 session hashing. Multi-factor authentication (TOTP, RFC 6238) with backup codes. On Pro, bring your own OIDC or SAML identity provider, on domains you verify by DNS, and require SSO for your whole organization with a break-glass owner.
Authorization (RBAC)
Role-based access control with admin, tester and viewer roles, organization-level roles (owner, admin, member) and route-level authorization middleware on protected endpoints.
Encryption
AES-256-GCM encryption for sensitive database fields (such as MFA secrets and integration tokens). Passwords hashed with bcrypt (12 rounds). TLS for all data in transit, with HSTS.
Audit logging
Audit trail of authentication attempts, authorization failures and security events, with request-ID (X-Request-ID) tracing and structured JSON logs.
Infrastructure security
Helmet security headers (CSP, X-Frame-Options DENY, HSTS, nosniff), CORS origin allow-list, rate limiting (300 requests/min general, 20/min for AI endpoints, per IP), CSRF protection, and SSRF prevention that blocks private, loopback and cloud-metadata addresses.
Compliance support
NIST 800-53 control mapping with POA&M tracking, and evidence export for SOC 2, HIPAA and other frameworks. These help you prepare your own assessment; they are not an authorization or certification.
Responsible disclosure
If you discover a security vulnerability in our website or platform, please report it to contact@qa-automation.com with enough detail for us to reproduce it. We aim to acknowledge reports within 2 business days and to prioritize fixes by severity. Please test only against accounts and data you own, avoid privacy violations and service disruption, and give us reasonable time to fix an issue before disclosing it.
Contact
Security reports: contact@qa-automation.com
General and privacy inquiries: contact@qa-automation.com
Techtonic Innovations LLC · Reston, Virginia, USA