Version: TP.15112025.01
Last Review: 15/November/2025
Overview
Vansah is a modern, cloud-native Test Management solution built for the Atlassian ecosystem. Designed for organizations operating within complex regulatory, security, and operational environments, Vansah emphasizes privacy-by-design, defense-in-depth security, and enterprise-grade governance across all operational layers.
Vansah is developed by Testpoint Pty Ltd a reputable Australian company registered in 2008 with a physical address: Level 35, Tower One, 100 Barangaroo Ave, Barangaroo, 2000, NSW, Phone number +61 2 89166176 , Website: Website
An Atlassian marketplace app, Vansah integrates deeply with Jira and Confluence while maintaining a clear separation of responsibilities regarding data storage, privacy, and access controls. Vansah’s architecture, processes, and roadmap are governed by its policies to protect customers with our commitment to meet and exceed enterprise risk expectations.
Enterprise Risk Assessment Questions & Answers
To support your evaluation of Vansah, we have consolidated and clearly documented our responses across all key security assessment areas including security controls, data residency, privacy practices, AI governance, operational resilience, and platform architecture.
This comprehensive Q&A listed below is designed to streamline customer evaluations and provide full transparency into Vansah’s enterprise-grade capabilities.
Contact Information
If you have any questions about this assessment or have further questions, please contact us through our support portal alternatively you may send an email to [email protected]
AI Usage for Test Case Generation
1. How is AI implemented in Vansah for generating test cases?
Vansah Intelligence uses a secure, context-limited AI engine to generate structured, high-quality test cases directly from Jira items. Only the Jira fields intentionally provided by the user such as Summary, Description, Labels, Components, Priority, and permitted custom fields are processed. No credentials, secrets, or unrelated project data are accessed.
The workflow is transparent and auditable: users trigger AI from a Jira work item, select coverage scope, and receive draft tests containing objectives, steps, expected results, traceability links, and metadata. A human-in-the-loop approval process ensures users can refine, regenerate, or reject content before saving it.
All output becomes Vansah test cases with full provenance, and Vansah enforces quality guardrails such as naming standards, field completeness checks, and style preferences. AI prompts and results follow data residency rules aligned to the customer’s Jira region, and usage is logged for auditability.
2. What data is processed by AI engines?
Vansah’s AI processes only the minimal Jira context needed to generate the requested test artefacts. AI interactions:
Are not used for training or shared with external parties
Remain strictly within the customer's Vansah environment
Exclude sensitive fields such as secrets, tokens, or logs
Are fully auditable for compliance
Only Jira work item text fields and explicit user prompts are considered, ensuring alignment with privacy-by-design principles.
3. Are there data privacy considerations when using AI features?
Yes - Vansah implements a strict privacy framework. Only relevant Jira fields are processed, never entire projects. Sensitive fields are anonymized where applicable, and customers may configure exclusions.
Vansah uses OpenAI APIs in a zero-training configuration, ensuring no prompt or output is used to improve models.
All AI features comply with GDPR principles and align with ISO 27001 and SOC 2 controls. Customers are encouraged to follow best practices such as avoiding sensitive PII in issue descriptions and using synthetic data during test authoring.
Data Storage & Security
4. Where are sensitive data stored?
Vansah does not store Jira user credentials or passwords. Authentication is handled by Atlassian. Vansah applies administrative, technical, and physical safeguards and encrypts all sensitive data in transit using SSL/TLS.
5. What security measures protect stored data?
Vansah employs defense-in-depth security including RBAC, audit logging, secure coding standards, continuous patching, network security monitoring, compliance-aligned policies (ISO 27001), and industry-standard encryption at rest and in transit.
6. Are passwords and secrets encrypted at rest and in transit?
Yes - TLS secures all data in motion, and AES-256 or equivalent encryption protects stored data.
7. What compliance standards does Vansah follow?
Vansah aligns with ISO 27001 and SOC 2 principles and adheres to Atlassian Marketplace security requirements. Data residency is available across multiple global regions including US, EU, UK, Australia, Singapore, Germany, and Canada.
Data Processing Location
8. Are data processed in Jira or external servers?
Vansah Testing data (test cases, runs, scripts, attachments, reports) is stored securely on Vansah-managed infrastructure (AWS and DigitalOcean).
Jira provides only metadata required for functionality; PII remains within Atlassian systems.
9. What is Vansah’s data retention policy?
Data is retained for up to 6 months after subscription expiration. Early deletion can be requested at any time.
Compliance, Governance & Controls
10. Are you ISO 27001 certified?
Vansah is actively progressing toward full ISO 27001 certification. Its current controls and governance already align with ISO/NIST frameworks. Hosting providers are ISO 27001 certified.
11. Are you SOC 1 / SOC 2 compatible?
Vansah aligns with SOC 2 principles, and its hosting providers are SOC 2 certified.
12. Do you run IT General Controls (ITGC)?
Yes - Vansah maintains structured ITGC practices including access management, change control, backups, DR readiness, and continuous audit support.
GDPR, Incident Response & Breach Procedures
13. Are you GDPR compliant?
Yes - Vansah and its supporting infrastructure comply with GDPR. No personal data is processed directly by Vansah; all PII remains within Atlassian.
14. What is your security breach procedure?
Vansah follows NIST-aligned incident response: detection, containment, investigation, customer notification, and remediation. Threat detection is continuous and supported by automated tooling and the Atlassian Cloud Fortified framework.
15. Do you notify and cooperate with customers during security incidents?
Yes. While Vansah does not process personal data, it maintains full cooperation processes for any incident affecting customer-owned testing data.
16. What is your notification SLA for breaches?
Vansah notifies impacted customers within 24 hours of confirming a breach.
Data Isolation, Multi-Tenancy & Customer Data Handling
17. Does Vansah store data outside Jira?
Yes - test cases, scripts, runs, plans, reports, and attachments are stored in Vansah in the same Jira region to provide full testing capability.
18. Is customer data used internally for development or testing?
No - Vansah does not access or use customer production data. Support access requires explicit customer consent and time-limited authorization (via expiring JWT).
19. How is customer data segregated?
Each customer is a distinct tenant with unique identifiers. Logical isolation prevents data overlap.
20. Does Vansah use anonymized test data for product improvement?
No - Customer data is never used for internal development. Only Vansah-owned data is utilized.
21. Can data types be restricted from being stored externally?
Not currently; however, Vansah applies strong encryption, tenant isolation, RBAC, audit logging, and secured encrypted backup processes retained within the same region.
Access Control, Logging, and Encryption
22. Who can access our data?
Only limited authorized Vansah staff under strict approval conditions: Customer-authorized support, legal requirements, or enforcement of terms.
Zero-trust principles apply. All access is logged along with two senior approvals.
23. Does Vansah’s AI model use customer data for training?
No - AI interactions are request-only and never retained for model training.
24. How is data encrypted at rest?
AWS-managed AES-256 and LUKS encryption secure all managed database clusters.
25. Who manages encryption keys?
Atlassian manages Jira-side keys; Vansah manages keys for Vansah-stored data. JWT tokens support app authentication.
Availability, Backups, and Business Continuity
26. Are backups stored in a separate secure environment?
Yes. Backups are regionally redundant and isolated, with AWS replication and encrypted standby nodes.
27. What are your RTO/RPO expectations?
Vansah’s Cloud Fortified status requires 99.9% uptime, rapid response (<24h), and minute-level restore points.
Permissions, RBAC & Auditability
28. Does Vansah support role-based access control (RBAC)?
Yes
29. Are audit logs exportable?
Full user action logs are maintained. Export capability is planned for March 2026
30. Do you offer data retention & deletion compliance?
Yes. Vansah provides a recycle bin with 6-month retention and permanent deletion options, including automated delete after uninstall.