Security controls and current limitations

How access works

• Every organization is isolated. Each request is checked against the signed-in person's organization, never against an ID sent by the browser.
• People see what their role allows. Developer, QA, manager, admin, and client roles have separate, enforced permissions.
• Clients see only what you share. A client sees a delivery only after you share its passport, and never sees your internal QA records, test runs, or quality scores.
• AI never approves its own work. An AI agent can propose a change. A person approves it before it runs, and a person or a real test run decides the result.
• Decisions are recorded. Approvals, returns, shares, and client decisions are recorded with who made them and when.
• Staff access is audited and visible. Cadlytic staff can only see your data inside a time-limited support session that requires a reason and a support ticket. Customers can see every staff access and action at any time (Settings → Cadlytic access).

How evidence is protected

• Test results, logs, and screenshots from a run are stored with a cryptographic SHA-256 hash.
• A Delivery Passport is sealed with a root hash of everything it contains, so a later change to the evidence shows as a broken seal.
• Evidence stays stored for your plan's retention period: 7 days on Free, 90 on Team, 365 on Enterprise.

Your code and the test runner

• Cadlytic connects to GitHub through a GitHub App you install on chosen repositories. It asks for: read and write to code contents (to create branches for proposed changes), read and write to pull requests, read checks, and read metadata.
• Tests run on a runner you operate (Connected mode): a small agent on your own machine or server with Docker. Your code is checked out there, not on Cadlytic's servers.
• Each run happens in a fresh container that is deleted afterwards: non-root user, read-only file system, at most 2 GB of memory and 1 CPU, no host folders mounted, and no elevated privileges.
• Not yet: Cadlytic-operated runners (Managed mode). They are being qualified on isolated virtual machines and are not offered until that is proven.

Where your data goes

Not yet (stated so you can plan around it)

We list these explicitly so your security and IT teams can plan without surprises.

• Single sign-on (SSO / SAML)
• SOC 2 or ISO 27001 certification
• Cadlytic-operated (Managed) runners
• Jira import or sync