Security

QA Note keeps your QA data safe and secure

Last updated: March 25, 2026

Overview

QA Note prioritizes customer data protection. We maintain enterprise-grade security and comply with GDPR standards.

Compliance

PIPA 2025: Compliance with key provisions
GDPR: EU General Data Protection Regulation compliance
ICT Network Act: Communication privacy and spam prevention
Cloud Computing Act: User data protection and portability
Public privacy policy
Cookie consent management

ISMS-P Certification Roadmap: We plan to pursue KISA Information Security Management System certification as the service grows.

Data Encryption

In transit: TLS 1.2+ (HTTPS enforced)
At rest: AES-256-GCM encryption
Passwords: argon2id hashing
Tokens: Encrypted storage

Infrastructure Security

Hosting: Vercel (AWS-based, SOC 2 certified)
Database: Supabase (AWS, SOC 2 certified)
File storage: Cloudflare R2 (Enterprise-grade security)

All infrastructure providers hold industry-standard security certifications.

Access Control

RBAC (Role-Based Access Control): Organization (Owner, Admin, Member) · Project (Admin, Member, Viewer)
Principle of least privilege applied
Independent permissions per project
Invitation-based member onboarding

Data Ownership

Customer data is entirely owned by the customer
Data is never sold or shared with third parties
All data permanently deleted 30 days after account deletion (including R2 files)

Sensitive Data Protection

Automatic sensitive data filtering in network requests
Auto-masking of auth headers, API keys, tokens, and session IDs
Removal of sensitive fields from URL parameters and request/response bodies

Backup & Recovery

Supabase automatic backup (Point-in-Time Recovery)
Multi-availability zone replication
Automatic cleanup per data retention policy

Monitoring & Auditing

Security audit logging (failed logins, permission changes, account deletions, etc.)
Security alerts on risky events

Integration Security

OAuth 2.0 standard (GitHub, Google)
Slack integration: OAuth V2 authentication
API: Rate limiting applied
Strict CORS policy

Payment Security

Payment processing: PortOne (PCI DSS Level 1 certified)
Card information is never stored directly
All payment communications encrypted

AI Data Policy

No training: User data is never used to train our own or third-party AI models
Minimal transfer: Only minimal metadata is sent when using AI features
Immediate deletion: Transferred data is deleted immediately after processing

Vulnerability Reporting

If you discover a security vulnerability, please contact us at security@qanote.app. We support Responsible Disclosure. Reported vulnerabilities are prioritized.