Security at QAcove
How we protect your account, your content, and your payments.
Encryption in transit and at rest
All communication with QAcove is encrypted over HTTPS, with HSTS enabled to force a secure connection even on the very first request. Your password is never stored in plain text — it's hashed with bcrypt. Tokens for external integrations (like GitHub) are encrypted in the database with AES-256-GCM before they're saved.
Infrastructure
QAcove runs on Vercel (application) and Neon (managed Postgres database), two cloud infrastructure providers with their own physical and operational security practices. Neon provides automated backups and point-in-time recovery for the database.
Payments
QAcove never receives or stores your full card number. Payments are processed directly by Wompi; we only receive confirmation of whether a payment was approved.
Sessions and access
Your session is stored in an httpOnly cookie, inaccessible from JavaScript, which also requires a secure connection in production. If a session sits idle for more than 4 hours, it closes itself even if the user never logged out.
Browser protections
The site sends standard security headers: MIME-sniffing protection, clickjacking protection (QAcove can't be embedded in someone else's iframe), and a restrictive referrer and permissions policy, with no access to camera, microphone, or location.
How we work
Every code change goes through type checking and a successful build before it's deployed to production. Operations that affect plan limits, like creating projects, test cases, or inviting people, are protected against race conditions with database-level locks.
Found a security issue?
Email us at soporte@qacove.com with the details — we review it as soon as possible.