Trust and security

What we do with your data, where it lives, and what we do not yet hold. Written for the person whose job is to say no.

Controls

What is actually in place

Green means it is running today. We have listed the gaps as well, because a page of nothing but ticks is one nobody believes.

  • Data isolated per customerIn place

    Every table carries an organisation id and every query is scoped by it, enforced by row level security in the database rather than only in application code. A bug in a page cannot return another customer's rows.

  • Encryption in transit and at restIn place

    TLS on every connection. Data at rest is encrypted by our database and storage provider using AES-256.

  • Credentials never stored in readable formIn place

    API keys and ingestion tokens are stored as SHA-256 digests. The plaintext is shown once at creation and cannot be recovered by anyone, including us.

  • Least privilege on secret columnsIn place

    Columns holding third-party credentials are removed from the grants your session holds, so they are unreadable even to a signed-in member of your own organisation.

  • Access loggingIn place

    Authentication events and API key usage are recorded. Database access is logged by our provider.

  • Backups and recoveryIn place

    Daily automated backups held by our database provider, with point-in-time recovery available on the production tier.

  • Single sign-on with SAMLAvailable on request

    The application already treats identity as external and reads roles from your organisation record, so adding SAML is configuration rather than a rewrite. It needs an enterprise identity provider on your side and a paid tier on ours. Ask and we will turn it on for your account.

  • SOC 2 Type IINot yet

    We do not hold one. SOC 2 is an independent audit over an observation window, not a feature: it takes an auditor, several months of evidence, and a five-figure budget. We will start it when enterprise demand justifies it, and we would rather say so than imply otherwise on a page like this. In the meantime the controls above are real and we will answer any questionnaire in detail.

  • Penetration testNot yet

    No third-party test has been performed yet. Internal adversarial review is part of how changes ship, but that is not the same thing and we will not present it as one.

Where your data lives

Application hosting and the database are provided by our sub-processors, listed in full on the sub-processors page, which names every third party that can touch customer data and what each one does. Our data processing terms are in the DPA.

QUORIAN - F.Z.E is registered in Ajman Free Zone, Ajman, United Arab Emirates.

Reporting something

If you believe you have found a vulnerability, email info@quorian.com. Tell us what you found and how to reproduce it. We will confirm receipt within two working days. We do not currently run a paid bounty, and we will not pursue anyone who reports a genuine issue in good faith without accessing other customers' data.

Something not covered here? Email info@quorian.com and ask. Quorian answers security questionnaires.