| QA project structure | Draft Available | Separate QA documentation site created |
| Test strategy | Draft Available | Needs QA owner review |
| Test environments | Needs Confirmation | Confirm staging/testing setup |
| Test accounts | Needs Confirmation | Confirm role-based users |
| Authentication tests | Draft Available | Not executed |
| RBAC tests | Confirmed by technical team; Evidence Pending Attachment | Test cases and manual testing confirmed |
| Scope/account isolation tests | Confirmed by technical team; Evidence Pending Attachment | Maqsafy is not SaaS; school/supplier/operator account isolation confirmed |
| Payment tests | Confirmed by technical team; Evidence Pending Attachment | Server-to-server status checks and single-update enforcement confirmed |
| Credential tests | Confirmed by technical team; Evidence Pending Attachment | Credential replacement is Admin-only |
| Backup/restore tests | Partial | Restore test performed approximately during the last month; exact date/environment/result pending |
| Monitoring/incident tests | Draft Available | Evidence required |
| API contract tests | Partial | Postman documentation exists; OpenAPI draft available; Swagger UI hosting pending decision |