Where your code lives
Your code never leaves your repository. All test code is committed to a directory in your own GitHub/GitLab — we work inside your repo, not a copy of it.
We request read access to application code and write access only to the test directory and CI config. You see every permission in the GitHub app grant screen.
No QAShift-side mirrors or forks. Revoke the app and our access ends instantly — your tests stay behind, fully runnable without us.
Who can access what
Exactly two people can access your account: your dedicated QA engineer and one named backup. Both are listed in your onboarding doc with LinkedIn profiles.
Access is granted per-engagement through SSO with hardware-key MFA, and logged. No shared credentials, no pooled support team browsing customer code.
Production data access: none. Tests run against your staging environment with synthetic test accounts you provision.
What we sign
Mutual NDA is standard and signed before we see anything — our template or yours, no negotiation needed for ours.
Data Processing Agreement (DPA) available for GDPR and India DPDP compliance, included with every plan, not an enterprise upsell.
IP assignment is explicit in the MSA: every line of test code we write in your repo is your property from the moment it is committed.
Data retention
Test artifacts (screenshots, videos, traces) are retained for 90 days, then hard-deleted. You can export everything at any time.
Report history lives in your Slack and your dashboard for the life of the contract; on termination you get a full export, and we delete our copies within 30 days.
We store no end-user personal data. Test accounts are synthetic; if a screenshot inadvertently captures real PII, our pipeline blurs and flags it.
How we run infrastructure
Test runners are ephemeral, isolated containers — spun up per run, destroyed after, never shared between customers.
Secrets (staging credentials, API keys) live in a dedicated vault, encrypted at rest, scoped per customer, never in test code or logs.
All traffic is TLS 1.2+; infrastructure is hosted in AWS Mumbai (ap-south-1) with EU hosting available on request.
Our own testing, on ourselves
We run our own OWASP ZAP and Snyk scans on QAShift infrastructure nightly — the same scans we sell.
Third-party penetration test annually; summary letter available under NDA.
SOC 2 Type I is on our 2026 roadmap. We will not claim it until the report is in hand — and that honesty applies to everything on this page.