AI platform for engineering QA
Sahasa.AI sits between the code your team writes and the code you ship. Its agents write tests in the frameworks you already use, run them against your real UI, flag bugs and security holes before merge, and tell you plainly what was checked and what wasn't.
Nothing to migrate. Runs in your cloud. Your AI keys.
| Run | Trigger | Tests | Findings | Evidence | State |
|---|---|---|---|---|---|
| #1042 payments-service | PR #482 | 14 UI · 6 unit | 1 bug · 1 threat | measured 4 generated 1 | passed |
| #1041 checkout-web | nightly | 88 UI | — | measured 88 | passed |
| #1040 ledger-api | PR #219 | 22 contract | 2 bugs | measured 22 | failed |
| #1039 payments-service | load report | — | — | n/a | no k6 report |
The gap
Every developer has an assistant that produces a test in seconds. It compiles. It's green. Nobody can say whether it proves anything, whether the code under it is safe, or whether the requirement it claims to cover was actually built. That is the job we do.
of developers use or plan to use AI coding tools
Stack Overflow, 2025
say they highly trust what those tools produce
Stack Overflow, 2025
is where test automation stalls in most organisations
Forrester, Dec 2025
01 / Tests as code
No proprietary step language, no recorder, nothing locked inside our tool. The agent reads your code and your live app, writes Playwright, Cypress, Selenium, pytest, Jest, JUnit or Cucumber, and opens a PR. Your engineers review it like any other.
// Generated for PAY-114 · selectors verified on staging 09:41 test('refund above limit requires second approver', async ({ page }) => { await loginAs(page, 'ops.manager'); await page.goto('/refunds/new?charge=ch_7f21'); await page.getByLabel('Amount').fill('12500'); await page.getByRole('button', { name: 'Submit refund' }).click(); await expect(page.getByTestId('approval-banner')) .toContainText('Second approver required'); await expect(page.getByRole('button', { name: 'Approve' })).toBeDisabled(); });
02 / UI and UX checks
Every step gets a screenshot. Visual regression, WCAG accessibility, broken links, console errors and failed requests come back with it. Works behind your login and SSO.
03 / Bugs and security
A UI tool only finds the bug a test happens to hit. We read the changed code: twelve categories of bugs, each with a fix; static analysis, dependency CVEs, leaked secrets, live DAST; and a STRIDE threat model where each threat is checked against a real finding, not just listed.
When charge.splits has more than one entry, merchant_id is read from the first split only, which is None for platform-collected fees.
src/payments/refund_handler.py · line 212 · introduced in this PR
- merchant_id = charge.splits[0].merchant_id + merchant_id = charge.primary_merchant_id or charge.splits[0].merchant_id
Route is public to authenticated users and calls the payment provider synchronously. Corroborated by the route table and by the absence of a limiter middleware in the dependency graph.
04 / Traceability and evidence
Requirement to scenario to test case to test to code. We resolve every link against your repository, so "covered" means a test exists, points at real code, and ran. Anything we couldn't check is marked as such. No false greens.
| Req | Requirement | Tests | Status |
|---|---|---|---|
| PAY-114 | Refund over limit needs a second approver | 14 UI · 6 unit | verified |
| PAY-115 | Approver cannot approve own request | 3 UI | verified |
| PAY-118 | Refund audit log retained 7 years | 1 unit | shallow |
| PAY-121 | Partial refunds across split charges | 0 | uncovered |
Where we sit
We don't write your application, run your pipeline or host your devices. We take what your engineers and their AI assistants produce and prove it before release. Everything around us stays yours.
Jira, BRDs, specs
yours
Engineers with Claude Code, Copilot, Cursor
yours
Tests written and run. Bugs, threats and traceability. An evidence state on every result.
the verification step
Your pipeline, runners, device farms
yours
Deployment, monitoring, incidents
yours
Said plainly
Vendors in this space tend to claim everything. We'd rather you know where we stop before you buy.
Tests run in your CI, on your grid, or in a browser we control for live checks. Mobile goes through Appium on your devices or a cloud grid you already pay for.
We execute what we generate. Your current suites keep running exactly as they do today. We'll triage their failures from your CI reports, but we won't rewrite them.
We write into them. Results go to your pipeline, your tracker and your dashboards.
We make both shorter by handling code-level findings and the threat model first. Your people and your pen-testers still make the call.
Deployment
Same platform in each case. Your code and results stay wherever you put them, and AI calls go to the provider you choose on your own keys.
We host it in an isolated tenant. Connect a repository and a requirements source, run the same day.
for teams that want to start this week
Containers in your AWS, Azure, GCP or data centre. Nothing leaves your network. Licence file, audit trail, your branding if you want it.
for regulated and large enterprises
Our engineers run and extend the platform inside your organisation: adapters, connectors, quality gates.
for organisations that want outcomes, not a tool to operate
Track record
Low-code platform vendor
We built and ran it. Authoring moved from specialist engineers to the wider delivery team, and regression became a gate on every release rather than a project.
Read moreLow-code product company
Sahasa.AI runs from requirements to suites on every change. Code-level security and the threat model are handled before the pen-test starts.
Read moreLarge Canadian retailer
Their standards, their modules, their language. AI-led engineering across requirements, generation, security and traceability.
Read moreNext step
A demo runs on your code, not ours. Forty-five minutes, one service, real findings. If it's useful, we go into a four-week pilot inside your CI.