What we protect and how.

The AI model that generates your test cases (Qwen 3 Coder 30B, via Ollama) runs on the workspace owner's workstation — not on shared cloud infrastructure. When you paste a requirement document or import a browser recording, it is sent to that local model over a private VPN (Tailscale). It is not transmitted to OpenAI, Anthropic, or any third-party AI API.

Generated test cases — the output of the model — are stored in QAMind's database (Supabase / PostgreSQL). The input documents themselves are not stored after the generation request completes.

QAMind uses Supabase Auth for all authentication. Two sign-in methods are available:

• Email + password — passwords are hashed with bcrypt. Plain-text passwords are never stored. Email confirmation is required before access is granted.
• Google OAuth 2.0 — no password is stored. QAMind receives only your email and public profile name from Google.

Sessions are managed via Supabase JWT tokens. Signing out clears the session and all in-memory state.

All workspace data is stored in a PostgreSQL database hosted by Supabase. Row Level Security (RLS) is enabled on all 12 tables. Every query from the application is scoped to the authenticated user's workspace — cross-workspace data access is blocked at the database level, not just the application layer.

Workspace membership is verified server-side via a helper function (is_workspace_member) that runs as part of every RLS policy. A user who is not a member of a workspace cannot read, write, or enumerate any data in that workspace.

• In transit — all connections use TLS 1.2 or higher. The application is served over HTTPS only.
• At rest — database storage is encrypted at the Supabase infrastructure layer.
• Passwords — bcrypt with appropriate work factor. Never stored or logged in plain text.

QAMind has a super admin panel for platform-level operations. Access requires a separate email whitelist and a master password (SHA-256 hash stored in the database). Password resets require consensus from all whitelisted super admins simultaneously.

Super admins can read and modify data across all workspaces. This access is used for support operations only. All super admin actions go through server functions with explicit audit trails.

Deleting your account cascades through all owned data — workspaces, projects, test suites, test cases, runs, bugs, recordings, and sprints are permanently deleted. Deletion is blocked if you are the sole owner of a workspace with other active members; you must transfer ownership first.

Server logs are retained for 30 days on a rolling basis and are deleted automatically.

If a breach affects your personal data, we will notify you within 72 hours of becoming aware of it. Material security issues can be reported to info@qamind.ai.