System Specifications Requirements
| Field | Value |
|---|---|
| Version | 1.0 |
| Effective Date | April 2026 |
| Review Cycle | Annual |
| Document Owner | Chief Information Security Officer (CISO) |
| Classification | CONFIDENTIAL — Internal Use Only |
| Applicable Standard | SOC 2 Type II — Security, Availability, Confidentiality |
1. Purpose and Scope
This document provides the technical specifications and requirements governing how data and items are stored, processed, and maintained within QA Touch. It serves as the authoritative technical reference for engineering, operations, and SOC 2 auditors, supporting Processing Integrity (PI1), Availability (A1), and Confidentiality (C1) Trust Service Criteria.
2. Application Tier Specifications
| Component | Specification [VERIFY all values] |
|---|---|
| Application Framework | [e.g., Node.js + Express / Ruby on Rails / Django / Spring Boot] — verify with engineering |
| API Protocol | RESTful HTTP/JSON; OpenAPI 3.0 specification maintained and published |
| Authentication Framework | Server-side session tokens + JWT for specific flows; OAuth 2.0 for SSO and integrations |
| Background Job Queue | [e.g., Sidekiq / Celery / BullMQ / AWS SQS] — used for async notifications, sync, export |
| Real-time / WebSocket | [e.g., ActionCable / Socket.io / Pusher] — used for in-app notifications and run progress |
| Containerisation | Docker containers orchestrated via Kubernetes (EKS / GKE) or ECS [VERIFY] |
| Service Mesh / mTLS | [e.g., Istio / AWS App Mesh] — mTLS for inter-service communication [VERIFY adoption] |
| Search Engine | Elasticsearch / OpenSearch [VERIFY] — full-text search for test cases and defects |
3. Database Tier Specifications
| Specification | Value [VERIFY] |
|---|---|
| Primary DBMS | PostgreSQL [VERIFY version] — managed service (RDS / Cloud SQL) |
| ORM / Query Layer | [e.g., ActiveRecord / SQLAlchemy / TypeORM] — all queries parameterised |
| Connection Pooling | PgBouncer or managed connection pooler [VERIFY] |
| Read Replicas | Minimum 1 read replica in separate availability zone [VERIFY] |
| Automated Failover | Managed service failover; RTO < 60 seconds for DB failover [VERIFY] |
| Point-in-Time Recovery | PITR enabled; minimum 7-day retention window [VERIFY] |
| Character Encoding | UTF-8 enforced across all tables |
| Transaction Isolation | Read Committed (default); Serializable for concurrent critical operations [VERIFY] |
| Multi-tenancy Enforcement | workspace_id column on all customer data tables; enforced at ORM and query layers |
4. Object Storage Specifications
| Specification | Value [VERIFY] |
|---|---|
| Provider | AWS S3 / GCP Cloud Storage [VERIFY] |
| Durability | 99.999999999% (11 nines) per provider SLA |
| Bucket Versioning | Enabled for attachment and backup buckets |
| Public Access Block | Enabled at bucket-level and account-level policies |
| Pre-signed URL TTL | 24–72 hours for exports; shorter for AI input files [VERIFY] |
| Lifecycle Policies | Auto-deletion: import staging (24h); export packages (72h); log archives (per retention schedule) |
| Cross-Region Replication | [VERIFY if configured for DR purposes] |
| Encryption | AES-256 SSE-S3 or SSE-KMS [VERIFY] |
5. Network and Security Specifications
| Specification | Value [VERIFY] |
|---|---|
| CDN / WAF | Cloudflare / AWS CloudFront + WAF; OWASP Core Rule Set enabled |
| Load Balancer | Application Load Balancer (ALB / Cloud LB); TLS termination at load balancer layer |
| VPC / Network Isolation | Application in private subnets; database and cache not exposed to public internet |
| Ingress Rules | Port 443 (HTTPS) only from internet; all other ports restricted to VPC internal traffic |
| DDoS Protection | Managed by CDN / WAF provider |
| DNS | [Route 53 / Cloud DNS]; DNSSEC enabled [VERIFY] |
| Internal Network | Private subnets for application and data tiers; no direct internet access from internal services |
6. Data Storage Format Requirements
| Data Type | Storage Format | Location | Size Constraint |
|---|---|---|---|
| Test case text fields | UTF-8 VARCHAR / TEXT | Primary DB | Title: 255; Description: 10,000 chars |
| Test steps | JSON array of step objects | Primary DB | Per step: 5,000 chars action + 5,000 expected [VERIFY] |
| File attachments | Binary in object storage; metadata in DB | Object Storage + DB | 20 MB per file [VERIFY] |
| Import files (upload) | Original binary in temp object storage | Object Storage (temp) | 10 MB per file [VERIFY] |
| Export files | Generated .xlsx / .csv / .pdf | Object Storage (TTL) | Generation timeout applies [VERIFY] |
| Audit log events | JSON document; append-only | SIEM / Log store | No per-record limit |
| Session tokens | Opaque random string; server-side store | Redis cache | < 1 KB |
| Integration credentials | Encrypted; stored in secrets store | Secrets Manager | N/A |
| AI prompts | Transient transmission; minimal QA Touch storage [VERIFY] | LLM provider / minimal DB [VERIFY] | Per prompt max length limit |
7. Processing and Maintenance Requirements
- All customer data changes must be written within ACID database transactions; no partial state allowed.
- Async job queues process events in-order within workspace context; out-of-order processing prohibited for state-changing operations.
- Search index updates must not block the primary write path; eventual consistency acceptable for search.
- Reports query the primary database (not read replicas) for current record counts to guarantee accuracy.
- Database vacuuming and index maintenance scheduled during off-peak hours (assumption: 02:00–04:00 UTC).
- SSL/TLS certificate renewal automated (Let’s Encrypt / ACM [VERIFY]); expiry alert raised 30 days before deadline.