No AI at run time
Steps compile once into deterministic code and test runs hold no AI credentials. No model call can happen inside a run.
Pass the security review before the pilot
Your security team sets where AI may run, which model and region it uses, and who approves. Every action is recorded and ready for audit.
- AI off, suggest or generate
- No self-approval, ever
- Every action audit-ready
| Scope | AI policy | Model and zone |
|---|---|---|
| Retail | Generate with approval | Azure OpenAI, EU data zone |
| Claims | Suggest only | Amazon Bedrock, US region |
| Payments | Off | None. No model call possible. |
| Reporting | Suggest only | Local model |
Guardrails the platform enforces
No self-approval
The author of a test, heal or AI draft is never its sole approver. That holds for people and agents alike.
Earned autonomy
AI permissions grow only on evidence and drop back automatically when a rule is breached.
Trust center
AI policy per scope
Each scope gets one setting, so a regulated line of business and an internal tool follow different rules on one platform.
- Off: no model configured, no model call possible
- Suggest: AI recommends, a person decides
- Generate with approval: drafts wait for a reviewer
- Azure OpenAI, Amazon Bedrock, Google Vertex, Anthropic, a local model or none
Human approvals
Administrators decide how far AI may go in each scope. Approving a heal always stays with a person.
- Drafts go to a reviewer who is not the author
- Agents propose but never approve
- Risky suite changes need sign-off
Identity and access
Access works the way your identity team already runs it, and is denied by default.
- Single sign-on with SAML or OIDC
- User provisioning with SCIM 2.0
- Tailored roles plus rules by line of business or environment
Data protection
Data is encrypted in transit with TLS and at rest. Prompts and outputs stay in the residency zone you pin each scope to.
- Credentials stay in HashiCorp Vault or Azure Key Vault
- Tests hold a reference, resolved only when a step runs
- Security documentation shared during evaluation
Audit export
Every action is recorded with who, what, when and why, and exports to your SIEM.
- Covers people, pipelines and agents
- Trace a requirement to its evidence and sign-off
- One policy across Studio, agents and Quality View
Questions
How do I report a vulnerability?
Email contact@qventis.ai with "Security" in the subject. We acknowledge your report, keep you updated and ask for reasonable time to fix before disclosure.
Can AI be fully disabled for one line of business?
Yes. Set its policy to off. With no model configured, no model call is possible.
Can we review your security documentation?
Yes. Ask during your evaluation and we walk your security team through it.
Bring your questionnaire
Leave with answers
We walk your team through AI policy, approvals and audit on your own scenarios.