Teams & Security — Frequently Asked Questions

Can my company use QAEverest as a team?

Yes. An organisation gets its own workspace, with an organisation admin who creates user accounts, assigns them to projects, and suspends or restores access. Members sign in at the organisation's own login page, and what each person sees is scoped to their organisation and projects. Each email address belongs to one account on the platform.

To set one up, contact sales from the pricing page.

How is a team billed?

By usage credits, not by seat. An organisation's members draw from one shared pool of credits, and the plan is sized to your volume. There is a free plan to try the product.

What roles are there?

Five ready-made roles (admin, lead, member, viewer and tester) plus any custom roles you create from a catalogue of 28 permissions across eight groups: Projects, Test Cases, Execution, Automation, Quality Scans, Acceptance, Administration and Organisation. In the web app, permissions for generating test cases, runs, automation, scans, UAT and release gates are checked on the server. The Copilot and the public API don't check these roles. Managing projects, users, roles, billing and settings is limited to the organisation admin, whatever a role's permissions say.

Does QAEverest support single sign-on?

Yes, with SAML. An organisation admin enters the identity provider's details in Enterprise Configuration. A first-time user's account is created at first login, with the member role or the role your identity provider sends. They can't get in until an admin assigns them a project, and if the email already belongs to another QAEverest account, the login is refused. OpenID Connect and SCIM provisioning are not supported.

Is there an audit log?

Yes. It records sign-ins, lockouts, impersonation, role and single sign-on changes, and changes made in the organisation admin console, with who did it and when. It doesn't record members' test work. The organisation admin can filter it by person, category, status and date, and export up to 5,000 rows as CSV.

What happens after repeated failed logins?

After five wrong passwords in a row, an account locks for 15 minutes. Members signing in at their organisation's login page follow the organisation's own policy: five attempts and 30 minutes by default, and the organisation admin can change both. Lockout counts wrong passwords only, so Google, GitHub and single sign-on failures are not counted.

Can another customer reach my work?

Not through the app. Every run, suite, test case, test set, generation record, traceability link, report, test data record and device profile is checked on the server against the signed-in user before it is read, run or changed. Files are the exception: uploads and run screenshots and videos are stored at public links, so anyone holding a link can open them. Performance runs, security scans, accessibility scans and accessibility monitors are open only to the person who created them or, for an organisation member, to their own organisation. Within an organisation, the organisation admin can sign in as a member.

How are my integration tokens stored?

Tokens saved for Jenkins, GitHub, GitLab, Azure DevOps, Bitbucket, Jira, ClickUp, Postman and Slack stay on the server. Browsers only ever see a mask, and editing a setting never overwrites the saved secret.

Are secrets sent to the AI model?

Recognisable secrets are masked first. Before a prompt for test generation, story analysis, automation, the Copilot or code search reaches the AI model, private keys, cloud and SaaS access keys, bearer tokens and values labelled as passwords or API keys are swapped for placeholders and restored in the reply. Detection is pattern-based, so a secret with no recognisable format or label can still get through. Masking reads text only, so a secret visible in an uploaded image or screenshot reaches the model as it is.

Two kinds of AI call are not covered: AI agent testing, where the AI reads the policy you paste and your agent's replies as they are, and the search index behind learning from your past work, repository indexing and step-repair memory, which sends your stories, test cases and code unmasked.

Can QAEverest test an app on my private network?

QAEverest is a cloud service, so the app you test and your Git host must be reachable from the internet. Web runs stop with that reason on a target on localhost or a private network, and API requests to such a target are blocked. A private deployment inside your own network is discussed case by case: contact sales.