Security, stated plainly.

What is in place

• All traffic over TLS; data at rest encrypted on managed cloud storage.
• Single sign-on across the product with short-lived sessions; API keys scoped per application with per-key rate limits.
• Every change is version-controlled, tested before it is committed, and reversible by revert or migration rollback. Required pull-request review and CI gating on the main branch are not yet enabled; we will say so here when they are.
• Personal data of customers is limited to what accounts and billing need; analytics runs cookieless.
• People who appear in our data have a rights path at /privacy-request, answered within 30 days.
• Our crawler identifies itself, honours robots.txt and machine-readable reservations, and is documented at /bot.

Service levels

A service-level agreement with an uptime commitment is available on Enterprise plans and is set out in that contract. On every other plan the service is provided as described in the terms, without an uptime guarantee.

Published policies

The policy suite is versioned, owned by the CEO, and reviewed annually. Customers may request copies under NDA.

• Information security. Program scope, data classification, roles.
• Access control. Least-privilege roles, MFA, sessions, offboarding.
• Change management. Version control, review, migrations, deploys, rollback — and its current-state note.
• Incident response. Severity levels, response times, communication, post-mortems.
• Vendor management. Sub-processor inventory, agreements, annual review, source terms.
• Data retention and disposal. Retention windows, deletion, backups, disposal.
• Business continuity and disaster recovery. Recovery objectives, failover, exercises.
• Risk assessment. Risk register, scoring, cadence.
• Subject rights. How requests from people in our data are handled.
• Privacy impact assessment. Purposes, sources, lawful basis, risks and mitigations for processing people in the news.

In progress

• SOC 2. Controls are mapped to the Trust Services Criteria and evidence is being collected. No report has been issued yet; we will say so here when one has.
• Data processing agreement. Available on request at legal@quantiveo.com; a standard form is being prepared for /dpa.

Reporting a vulnerability

Write to security@quantiveo.com. We acknowledge within two business days and keep you informed until the issue is closed. Please do not access data that is not yours or degrade the service while testing.