Trust and security
We ask clients for their policies, their system inventories and sometimes samples of their customer data. That places an obligation on us that is heavier than the one most vendors carry. This page states what we do about it, and what we have not yet done.
How client documents are handled
Documents are stored in private object storage. There is no public bucket and no guessable path. Access is granted through signed links that expire after five minutes, and every view and download is written to an access log with the user, timestamp and IP.
Deliverables are never attached to email. A release notification contains a link to the portal and nothing else.
Uploads are checked against an allowlist of file types by inspecting the file's actual contents rather than trusting its extension, capped at 25MB, and scanned before they are made available.
Fields marked sensitive at intake are encrypted at rest. In the staff interface they are masked, and revealing one is a deliberate action that is written to the audit log.
Separation between clients
Every table holding client data enforces row-level security in the database itself, not in application code. A signed-in user's queries are constrained by the database to the organisations they belong to, and further constrained by their role within that organisation.
A test suite proves this on every change: it seeds two organisations, then asserts across every tenant table that a member of one cannot read a single row belonging to the other. The suite blocks deployment. It is itself verified by deliberately introducing a cross-tenant leak and requiring the suite to fail — a test that passes against broken isolation is worse than no test.
Sub-processors
Third parties that process client data on our behalf. This list is maintained and clients are notified before a new one is added.
| Sub-processor | Purpose | Region |
|---|---|---|
| Supabase | Database, authentication and document storage | EU (Ireland) |
| Vercel | Application hosting and content delivery | Global edge, EU primary |
| Microsoft Azure | Document text extraction and analysis services used in preparing deliverables | EU / UK |
| Resend | Transactional email delivery | EU / US |
| Inngest | Background job orchestration | EU / US |
| Paystack | Payment processing | Nigeria |
| Sentry | Error monitoring | EU |
| PostHog | Product analytics, cookie-consented | EU |
Data residency
Client data is held in the European Union by default. We say this plainly because several African regulators expect either local storage or a specified region, and a vague answer is not usable in a regulatory filing.
Storage region is configurable per organisation. If your licence conditions require Nigerian residency, raise it before the engagement starts rather than after.
Our own certifications
Qantid does not currently hold ISO/IEC 27001 certification or a SOC 2 report. Both are being pursued. We state this rather than omitting the section, because a firm selling assurance should be held to the standard it sells, and you are entitled to know where we actually stand before you engage us.
Professional indemnity cover, SCUML registration and partner firm accreditation details will be published here as they are put in place. Until each is confirmed, it is not listed.
Reporting a vulnerability
If you believe you have found a security issue in this platform, write to security@qantid.com. We will acknowledge within one business day. We do not pursue researchers who act in good faith, stay within their own account, and give us a reasonable window to fix the issue before disclosing it.