Product Service Specifications
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document establishes the formal product and service specifications for QA Touch, a cloud-based SaaS Test Management Platform. It provides auditors, engineers, and stakeholders with a structured and authoritative description of platform capabilities, functional boundaries, and non-functional requirements, supporting SOC 2 Type II Trust Service Criteria for Processing Integrity (PI1) and Availability (A1).
- Applicable to all QA Touch production services and customer-facing features.
- Reviewed annually and upon every material feature release or architectural change.
- Serves as the definitive reference for what the system is designed to do and the controls governing its behaviour.
2. Platform Overview
QA Touch is a multi-tenant, cloud-native SaaS platform enabling software QA teams to manage the complete software testing lifecycle from requirements through defect closure. Every customer organisation operates within a logically isolated workspace. Data is encrypted at rest and in transit and replicated across multiple availability zones.
| Attribute | Value / Standard |
|---|---|
| Deployment Model | Multi-tenant SaaS — Cloud-hosted (AWS / GCP [VERIFY]) |
| Access Method | Web browser (HTTPS), REST API, Mobile browser |
| Authentication | Email/password, SSO (SAML 2.0 / OIDC), MFA (TOTP / push notification) |
| Availability Target | 99.9% monthly uptime [VERIFY with engineering] |
| Tenant Isolation | Logical isolation per workspace; no cross-tenant data access permitted |
| API Standard | RESTful JSON API; OAuth 2.0 and API key authentication |
| Supported Browsers | Chrome (latest 2), Firefox (latest 2), Edge (latest 2), Safari (latest 2) |
| Data Residency | Region: [VERIFY — e.g., US-East, EU] — configurable for enterprise tiers |
3. Core Functional Specifications
3.1 Project Management
- Create, edit, archive, and delete projects with name, description, status, and custom metadata.
- Project-level role-based access control (RBAC): assign users with workspace or project-scoped roles.
- Milestones linked to projects with start/end dates and linked test item progress tracking.
- Custom fields configurable at project level to capture organisation-specific metadata on any entity.
- Project dashboard: real-time aggregate metrics — pass/fail trends, defect rate, milestone progress.
3.2 Test Case Management
- Create, edit, clone, delete, and bulk-operate on test cases within projects and test suites.
- Test case components: title, preconditions, test steps (action + expected result), tags, priority, type, status, and custom fields.
- Reusable test step library: shared steps referenced across multiple test cases to eliminate duplication and ensure consistency.
- Full version history: all changes tracked with actor identity and timestamp.
- Attachment support: screenshots, logs, and files attached to individual test cases.
3.3 Test Suites
- Hierarchical folder/subfolder organisation of test cases within projects.
- Drag-and-drop reordering; suite-level summary (total / passed / failed / blocked counts).
3.4 Test Plans and Execution Runs
- Test Plans: define scope, environments, build versions, milestones, and linked test suites.
- Test Runs: execute plans; testers record Pass / Fail / Blocked / Not Run / In Progress per step.
- Execution comments and defect linking at individual test step level.
- Real-time run completion percentage; bulk result entry for rapid execution.
3.5 Defect Management
- Full defect lifecycle within QA Touch or pushed to integrated trackers (Jira, Azure DevOps, GitHub, GitLab, Bitbucket).
- Attributes: title, description, severity, priority, status, assignee, screenshots, attachments, custom fields.
- Bidirectional status sync with integrated issue trackers.
3.6 Requirements and Traceability
- Create and manage requirements; link to test cases to establish Requirements Traceability Matrix (RTM).
- Import requirements from Excel/CSV; export RTM as PDF/Excel.
3.7 AI-Powered Test Generation
- Generate test cases from natural language prompts, Business Requirement Documents (BRDs), Jira stories, Figma/mockup images, and screenshots.
- Generate BDD (Gherkin) scenarios from natural language or feature descriptions.
- All AI output presented to the user for review and editing before any content is saved — no auto-commit.
- Prompts transmitted to a third-party LLM provider under a Data Processing Agreement [VERIFY provider].
ASSUMPTION: Specific AI provider identity, DPA terms, and prompt retention must be confirmed and disclosed in the Privacy Policy and AI feature pages.
3.8 Import and Export
- Import test cases and requirements from Excel (.xlsx) and CSV using downloadable templates.
- Export test assets, runs, and reports to Excel (.xlsx), CSV, and PDF.
- API-based import/export for programmatic and CI/CD integration workflows.
- Row-level import validation with error report showing row number and failure reason.
3.9 Integrations
| System | Direction | Data Exchanged |
|---|---|---|
| Jira | Bidirectional | Defects, issue status, field mappings, project keys |
| Azure DevOps | Bidirectional | Work items, test plans, pipeline triggers |
| GitHub / GitLab / Bitbucket | Bidirectional | Issues, repository events, CI/CD pipeline results |
| Slack | Outbound | Test run results, defect alerts, milestone notifications |
| CI/CD Pipelines | Inbound / Outbound | Trigger test runs; receive automation execution results |
| Automation Frameworks | Inbound | Push automated test results into QA Touch test runs |
| Figma | Inbound (AI) | Mockup images used as AI test generation input |
3.10 Reporting and Dashboards
- Project dashboard: pass/fail trends, defect rate charts, milestone burndown, team productivity.
- Test run reports: execution summary by status, tester, and suite.
- RTM report: requirement-to-test-case coverage gaps identified.
- All reports exportable to PDF and Excel; scheduled email delivery [VERIFY availability].
3.11 User and Workspace Administration
- Invite users by email; assign roles; deactivate or remove accounts; manage workspace settings.
- API key management: create, scope, rotate, and revoke API keys per user or service account.
- Workspace-scoped audit activity log viewable by administrators.
- Webhooks: configure outbound HTTP callbacks for custom event-driven integrations.
4. Non-Functional Requirements
| Category | Specification |
|---|---|
| Performance | Page load < 3 seconds; API response < 500ms p99 for standard CRUD operations. |
| Scalability | Horizontally scalable application tier; auto-scaling for peak load [VERIFY]. |
| Availability | 99.9% monthly uptime SLA; maintenance windows communicated 48 hours in advance. |
| Security | TLS 1.2+ in transit; AES-256 at rest; annual penetration testing; SOC 2 Type II (in progress). |
| Tenant Isolation | All queries scoped to workspace_id; cross-tenant joins architecturally prohibited. |
| Backup / Recovery | Daily automated backups; RTO 4 hours / RPO 1 hour [VERIFY]. |
| API Rate Limiting | Per-API-key rate limits; values documented in API reference. |
| Audit Logging | All user actions logged with actor, timestamp, resource, and change detail. |
| Accessibility | WCAG 2.1 Level AA target [VERIFY with product team]. |