Security

Encryption

At rest

PostgreSQL on Supabase managed infrastructure with encryption at rest. API keys and integration secrets are encrypted with Fernet symmetric encryption before storage.

In transit

TLS 1.2+ for all client and service-to-service traffic.

Tenant isolation

Postgres Row-Level Security (RLS) on tenant-bound tables. Cross-tenant reads are blocked at the database layer, not only in application code.

Authentication

Customer accounts authenticate via Supabase Auth (email/password and OAuth providers such as GitHub) with JWT session tokens. Enterprise plans add SSO / SAML / SCIM (roadmap item for regulated teams — contact us for current availability).

Repository connectors use OAuth 2.0 with the minimum scopes required for the workflows you enable. OAuth tokens are stored server-side and are not exposed through customer-facing APIs.

Data residency

Database region

EU — Supabase managed PostgreSQL (European region).

Observability

Operational telemetry and AI workflow traces may be processed by EU-hosted or contractually EU-compliant subprocessors. Enterprise customers can discuss self-hosted or region-locked observability during procurement.

Repository and customer data

QualityMax reads repository metadata and file contents transiently to generate tests, run scans, and post results back to your CI — we do not maintain a permanent mirror of your codebase.

Customer data and AI-generated test output are not used to train foundation models. If we ever introduce opt-in features that use your data differently, they will be described separately at the point of opt-in.

Test artifacts, run history, and audit logs are scoped to your workspace and retained for your operational and compliance needs. You can request deletion via contact@qualitymax.io or through account settings where self-service export/delete is available.

Production safety

1. Sandboxed execution

Browser-based test execution runs in isolated cloud sandboxes with resource limits and automatic teardown. Local execution via qmax-code runs on infrastructure you control.

2. Least-privilege repository access

GitHub App and GitLab integrations request only the permissions needed for the features you enable (e.g. checks, comments, workflow dispatch). Read-only analysis paths do not require write access to your default branch.

3. Rate limiting and abuse controls

API endpoints are rate-limited. Automated abuse detection can temporarily block IPs that exceed fair-use thresholds.

4. Deterministic security gates

SAST, dependency scanning, and secret detection run as deterministic CI workflows — separate from probabilistic AI review — so security findings do not depend on model hallucination.

5. Audit trail

Test runs, PR gate decisions, and key workflow events are logged for review inside the product. Enterprise plans add extended audit logs and export.

Audits and certifications

QualityMax is not currently SOC 2 or ISO 27001 certified. We are preparing controls aligned with SOC 2 Type II expectations and will publish an “in audit” status on this page when a formal audit begins.

For a current subprocessor list and DPA terms, see our Privacy Policy.

Incident history

No customer-impacting security incidents to report as of July 2026.

For incident-history requests, contact contact@qualitymax.io.

Responsible disclosure

We welcome good-faith security research. Report vulnerabilities to contact@qualitymax.io.

• SLA. We target 48 hours for triage and acknowledgement.
• Safe harbor. We will not pursue legal action against researchers who act in good faith, avoid service degradation, respect scope, and give us reasonable disclosure time (90 days default, negotiable).
• Out of scope. DDoS against marketing pages, social engineering of staff, and physical attacks.

Canonical disclosure file: /.well-known/security.txt

Status

Live service status: qualitymax.io/status. For urgent security questions outside published incidents, email contact@qualitymax.io.