Security at TestTale

TestTale works with your tickets, source code and test environments, so security is designed into the architecture. This page summarises the controls in place.

Human approval for every change

The AI agent and the assistant have read-only tools: they can read and search the repositories, tickets and tools you connect, but they cannot change anything on their own. Pull requests, Jira bugs and comments, new test cases and write actions in connected tools happen only after a member of your workspace reviews them and clicks to approve.

Test execution

By default, generated tests run in your own GitHub Actions, through a workflow you add to your repository with one reviewed pull request, so your code and test environment stay inside your own CI. Each run receives only the test environment variables you configure for the project, never platform credentials. Self-hosted deployments can instead run tests in a fresh, resource-limited container that is discarded after each run.

Data protection

• TLS for all traffic; encryption at rest for databases and storage.
• Integration tokens and test secrets are additionally encrypted with AES-256-GCM before storage, and redacted from execution logs.
• Per-workspace data isolation: every record is scoped to a workspace and every request is authorised against it.
• Role-based access (owner, admin, member) and an audit log of significant actions.

Integrations

• GitHub access uses a GitHub App with least-privilege permissions on the repositories you select; installations are verified against the installing user.
• Jira access uses Atlassian OAuth 2.0 with scoped tokens that you can revoke at any time.
• Webhooks are signature-verified.

AI processing

Content is sent only to the AI model provider your workspace configured, with your own API key, and only to perform the task you requested. Keys are encrypted at rest and never shown again after you save them. Text from tickets, pull requests and logs is treated as untrusted data, and the agent is instructed to ignore instructions embedded in it.

Reporting a vulnerability

Please email steadyqateam@gmail.com with details. We aim to acknowledge reports within two business days and ask that you give us reasonable time to fix issues before disclosure.