Output Delivery Policies
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document defines the policies and procedures governing how QA Touch generates, validates, and delivers outputs to users and integrated systems. It ensures that all outputs — test reports, exported data packages, API responses, webhook payloads, notifications, and AI-generated content — meet completeness, accuracy, and timeliness requirements. Supports SOC 2 Processing Integrity criterion PI1.5.
2. Output Types and Delivery Mechanisms
| Output Type | Format | Delivery Mechanism |
|---|---|---|
| Test Case / Run Reports | PDF, Excel (.xlsx) | In-app download via time-limited pre-signed URL from object storage |
| Requirements Traceability Matrix (RTM) | PDF, Excel (.xlsx) | In-app download |
| Project Dashboard Summaries | Rendered charts and tables | Real-time within authenticated session; no file generated |
| Data Exports (test cases, runs, defects) | Excel (.xlsx), CSV | In-app download; API response for programmatic consumers |
| API Responses | JSON (REST) | HTTPS response to authenticated API consumer |
| Webhook Payloads | JSON (HTTP POST) | HTTPS POST to customer-registered endpoint with HMAC-SHA256 signature header |
| Email Notifications | HTML email | Via email delivery service (SendGrid / SES [VERIFY]); DKIM, SPF, DMARC enforced |
| In-App Notifications | In-app notification panel | Real-time via WebSocket or polling fallback |
| AI-Generated Test Cases | In-app review UI | Displayed within authenticated session; not auto-saved; user must confirm |
| Integration Sync Outputs | JSON (REST) | HTTPS API calls to Jira / Azure DevOps / GitHub etc. |
| Import Error Reports | In-app table + downloadable CSV | Displayed in Import/Export screen after processing; downloadable for 24h |
3. Output Completeness and Accuracy Controls
3.1 Report and Export Accuracy
- Reports and exports are generated from the live, authoritative database state at the time of request; no stale cache is used for record counts or status values.
- All report queries are scoped to the requesting user’s workspace and RBAC-permitted project set; cross-workspace data cannot appear in any output.
- Exported file column headers match exactly the field names displayed in the application for each entity type.
- Report generation logic is covered by the regression test suite; any discrepancy in record counts between reports and source data is a P1 bug.
3.2 API Response Accuracy
- API responses reflect the committed database state at request time (read-committed isolation minimum).
- Pagination enforced for list endpoints; total record count included in response metadata for client-side verification.
- Response schemas are versioned; breaking changes require a new major API version with a defined migration period.
3.3 Webhook Payload Integrity
- All webhook payloads include an HMAC-SHA256 signature header; receiving systems must verify the signature before processing.
- Each payload includes a unique event ID enabling consumer-side deduplication.
- Delivery retried up to 5 times with exponential backoff on non-2xx response; persistent failures alert the workspace admin.
3.4 AI Output Accuracy Disclaimer
- AI-generated test cases are clearly labelled as AI-generated in the review interface.
- Users are informed that AI output requires human review and editing before use in test execution.
- QA Touch does not guarantee the factual accuracy of AI-generated content; user editorial review and approval is mandatory before saving.
4. Output Timeliness Standards
| Output Type | Target Delivery Time | Alert Threshold |
|---|---|---|
| API response (standard CRUD) | < 500ms p99 | Sustained > 1,000ms p99 |
| Small report / export (< 1,000 records) | < 10 seconds | Sustained > 30 seconds |
| Large report / export (async) | < 5 minutes; user notified on completion | Sustained > 15 minutes |
| Email notification | < 2 minutes | Sustained > 10 minutes |
| In-app notification | Real-time (< 5 seconds) | Polling fallback at 30s interval if WebSocket unavailable |
| Webhook delivery (first attempt) | < 30 seconds of triggering event | Sustained > 2 minutes |
| AI generation response | < 15 seconds | Sustained > 60 seconds |
| Import error report | Immediately after import completes | N/A — synchronous with import process |
5. Output Retention and Expiry
- Generated report and export files stored in object storage with time-limited pre-signed URLs; automatically deleted after TTL (24–72 hours [VERIFY]).
- Pre-signed download URLs are scoped to the generating user’s workspace; access by other workspaces or unauthenticated users is not possible.
- API responses are generated on-demand from the database; not persistently stored by QA Touch beyond the serving request.
- Webhook delivery logs retained for 90 days.
- Email delivery logs retained for 90 days.
6. Output Delivery Failure Handling
- Export generation failures: user notified in-app with error message and option to retry.
- Webhook delivery failures: logged; workspace admin alerted after 3 consecutive failed delivery attempts.
- Email delivery failures: bounce handling via email delivery service; bounce events logged.
- API response failures: structured HTTP error response with status code and error description returned to client.