Data handling

Privacy and retention

Only administrators have locally provisioned username/password accounts. Existing encrypted MFA records are retained for future reactivation. Developer access uses keyed code verifiers and revocable session/security records; no email or developer password account is required. Organizations store explicit grants, project configuration and authorized test evidence. Private SSH/SDK credentials stay outside browser responses and evidence downloads.

Project evidence is private to its authorized members. The public demo uses the separately identified, already published QNX fixture cases. Your activity is not silently added to that demo.

AI processing requires project enablement and explicit request consent. Selected evidence and any separately consented source can leave the server for the configured provider. Provider/model, budgets and uncertainty must be disclosed. Disabled AI leaves deterministic testing available.

Organization evidence retention defaults to30 days, subject to explicit holds. Administrators can revoke codes or browser sessions immediately. Minimal grant, consent and security/audit identity records are retained to preserve evidence provenance; source and AI content have their separate30-day expiry. Administrator credential recovery is a protected local procedure, never email. Backups follow the documented operational retention.

For operator questions, use the repository contact link. Production operational settings and provider details must be reviewed before enabling their integrations.