Security
Security at QAAura
QAAura is an early-stage product, so this page lists what we actually do today and is honest about what we do not have yet.
Encrypted in transit
The website, the app and the API are served over HTTPS.
Passwords are hashed
Passwords are stored as salted hashes (bcrypt), never in plain text.
Separate workspaces
Each company's projects, sessions and runs are checked against its own account on every request.
Team roles
Team members can be owners, editors or viewers, and sign-in attempts are rate limited.
Stored credentials are encrypted
Authentication details saved for API tests are encrypted at rest (AES-256).
Not certified yet
We do not currently hold SOC 2 or ISO 27001 certification. If you need a security questionnaire or have a requirement, tell us.
Found a vulnerability, or need a security questionnaire answered? Email hello@qaaura.com and we will reply personally.