## Security FAQs algoQA's security commitments cover data encryption, access control, backups, customer-specific deployment, session management, auditability, and configurable AI guardrails. Yes, algoQA can provide an audit trail. Yes, algoQA maintains logs along with their corresponding timestamps. Yes, algoQA includes a backup and restore feature. Yes, data is stored throughout the retention period. Yes, each build follows the algoQA release process. Yes, it is protected. Yes, algoQA data is encrypted. No, algoQA testing is not invasive unless you want to do something with unit testing. - Data Backups: Regular backups prevent data loss and ensure secure storage. - Access Control: Rules set by the algoQA admin grant access to authorized users only to access the generated test scripts. - Customer-Specific Deployment is supported. - Session Management: Prevents simultaneous access with the same credentials, enhancing account security and data protection. algoQA implements several security measures to protect customer data and tests: 1. Access Control: Rules set by the algoQA admin grant access to authorized users only to access the generated test scripts. 2. Customer-Specific Deployment: Each customer's environment is isolated, ensuring data security. 3. Session Management: Prevents simultaneous access with the same credentials, enhancing account security and data protection. Amazon Bedrock provides baseline safety and security controls out of the box through model-level protections and AWS security defaults. However, Bedrock Guardrails can be configured additionally to define and enforce content, privacy, and policy requirements. AWS provides infrastructure-level auditability by default. Application level AI activity logging is intentionally avoided, however it can be implemented as a customer design choice. - REST APIs: Encrypted via HTTPS/TLS (supported). - SOAP APIs: WS-Security message-level encryption (upcoming). algoQA supports all commonly used industry-standard authorization mechanisms, including: - Basic Authentication: Username and password-based authentication. - Bearer Token Authentication: Token-based access commonly used in REST APIs. - OAuth 2.0: Supports secure, token-driven authorization flows used in modern applications. Agents operate with limited permissions: - Scripting Agent: Has file read/write permissions for scripting-related actions only. - Test Authoring Agent: Has browser permission to navigate web applications. Both agents operate using the client's own approved LLM rather than external models. AlgoShack is currently evaluating the applicable assessment requirements and plans to complete them as part of its security and compliance process. For on-premises deployments leveraging the client's own approved LLMs, no significant additional risk is anticipated, as all AI processing remains within the client's controlled environment. Yes. algoQA can address any specific concerns. Only impact-based testing uses code analysis, leveraging trusted static code analyzers. Auto-healing and routine scenario automation remain non-invasive, typically requiring only UI/URL access. algoQA can be deployed in the customer's own environment (such as AWS VPC) so no business data leaves the corporate firewall. Multi-tenant SaaS is optional. Evals and human oversight are essential — AI can generate or modify output but should not certify its own correctness without checking. Every autonomous change must be traceable: what changed, why, what evidence was used, and whether expected behavior is still being tested. In regulated environments, accountability rests with the people responsible for quality and release decisions.