Your browsers, your network, your data

Healing runs locally. That is an architectural choice, not a pricing tier — and it has consequences worth knowing about. This page lists what the product actually does with your data. It is a description of mechanisms, not a set of badges.

Nothing is shipped out to heal

When a locator breaks mid-run, the repair is computed from candidates and DOM snapshots you already hold: the ranked locators captured at record time, the crawled model of your application, and the snapshot stored per step. Your DOM is not sent to a third party to be analysed. The whole healing cascade — primary, fallbacks, app model, semantic scan — is deterministic and runs inside the engine.

Because of that, no outbound call is required for a run to succeed. QAright works on isolated networks and behind strict egress rules, and the Enterprise plan can be deployed self-hosted or fully air-gapped.

AI is last, and it never sees your page

The AI-assisted repair phase is the fifth and final phase of the cascade: it is consulted only after every deterministic phase has already failed. What it receives is the broken locator, the action and the error text — never the page. On qaright.com that call runs against our model endpoint; a self-hosted install calls the one its operator configures.

A separate, smaller set of features is explicitly AI-powered: generating a test from a description, the crawler that explores your app to propose tests, plain-English step summaries, and root-cause analysis of a failure. Those send the page content involved to a model only when you invoke them, never as a side effect of running a test. The privacy page names the model provider and the other sub-processors, and says what each one holds.

One organisation cannot see another

Every account belongs to an organisation, and every read the product makes — suites, runs, screenshots, environments, data profiles, specs, API keys — is scoped to the caller's organisation at the data layer. The filter is applied in the query, not checked afterwards, so another organisation's records are not fetched and then hidden; they are never returned at all.

The one deliberate exception is the community board, which is shared across organisations by design and readable without an account. Nothing about your tests, runs or environments is on it unless you post it there.

Secrets in environments are masked

URLs and credentials live in an environment, never in the test. A variable you flag as secret is masked in every response the API returns, including to a read-only viewer in your own organisation, and the editor is built to hand the mask back rather than the value — saving an environment with an untouched secret restores the stored value instead of overwriting it with the placeholder.

Exports never carry your secrets

Every suite exports to a self-contained C# Playwright project. The exported engine resolves {{env.KEY}} from the operating-system environment of the machine running the test, and from nothing else. No environment values, no data-profile values and no secrets are written into the bundle. An unresolved token is left visible in the step so that it fails where someone can see it, rather than running with an empty value.

API keys are hashed, and shown once

CI/CD triggers authenticate with an API key. The raw key is shown once, at creation, and is then stored only as a SHA-256 hash; it is never logged and cannot be recovered from the product afterwards. Comparison against the hash is fixed-time. Each key is scoped to an organisation, optionally to a single project.

A revoked key, an expired key, an unknown key and a missing key all receive the same 401 with the same error code, so a probe learns nothing about whether a key ever existed; a key id from another organisation answers like an unknown one, a 404 rather than a 403, for the same reason. Revoking is separate from deleting: revoking stops a key working immediately and keeps the record that explains why, and a live key cannot be deleted without being revoked first.

Signing in

Passwords are stored as salted hashes. Sessions are JSON Web Tokens, and the same token authorises the real-time connection that streams a run to your browser. Access inside an organisation is role-based, from admin down to a read-only viewer, with version history on every test case and an audit log of who changed what — including every locator the engine promoted on your behalf. Enterprise customers can sign in through Microsoft Entra ID.

What this page does not claim

There are no compliance logos here because a logo is not a mechanism. What is above is what the code does today. If your procurement process needs a questionnaire answered, or your network needs the self-hosted deployment, write to hello@qaright.com and you will get a straight answer about what the system does.