Security
A short summary for your IT and security teams. For more detail, write to [email protected].
Data residency
Section titled “Data residency”The application and all its data run in Microsoft Azure’s North Europe region (Ireland). Data is not moved outside the EU.
Encryption
Section titled “Encryption”- In transit: all traffic uses TLS 1.2 or later. The database refuses unencrypted connections, and file storage accepts HTTPS only.
- At rest: the database and file storage are encrypted on disk with Azure’s platform keys.
- Field level: deal chat messages and IBANs are encrypted again inside the application (AES-256-GCM), so someone reading the database does not see them in plain text.
- Integration keys are never stored. Only an HMAC of each key, under a server key, is kept; the key is shown once, when it is issued. Webhook signing secrets are not stored either.
Isolation between companies
Section titled “Isolation between companies”Every query is limited to your company’s own data. This is enforced by the application and, underneath it, by row-level security in the database (PostgreSQL FORCE ROW LEVEL SECURITY). An integration key reads only what your company owns or is a party to; anything else answers 404.
Integration API controls
Section titled “Integration API controls”- Open on every plan, with the same security features on every plan. The Quatlas team can switch it off for a company at once.
- Every company is invited and checked by the Quatlas team before it gets an account. If sign-up ever opens to anyone, live integrations will sit behind the same company check (legal identity and billing details) before the first live key; the sandbox stays open.
- Keys work only on
/api/integrations/v1; every other part of the platform refuses them. - Each key acts as its integration’s own service identity, limited to its scopes, and can be limited to an IP allowlist.
- Every key expires within 12 months, with reminders 30, 7 and 1 days before, and can be rotated without downtime or revoked at once.
- An optional OAuth-only mode, with 15-minute access tokens.
- Webhooks are signed (HMAC-SHA256) and time-stamped, sent only over HTTPS on port 443 to public addresses; private, internal and cloud metadata addresses are refused, and redirects are not followed.
What is logged, and for how long
Section titled “What is logged, and for how long”| Record | What is kept | Kept for |
|---|---|---|
| Integration call log | The key, method, route template, status code, duration, time, and a hash of the idempotency key | 365 days; your Owner and Admins can export it as CSV |
| Key audit trail | Creation, rotation, revocation, scope and IP allowlist changes, with who made them and why | Kept as an audit trail, visible to your Owner and Admins |
| Webhook delivery log | The event, the target host, the result, the duration and the first 256 bytes of your answer | 365 days, exportable as CSV; the delivery’s body 30 days, for redelivery |
| Platform staff actions | Every write a Quatlas staff member makes on a customer, with the reason | Permanently |
| Application and access logs | Request lines | 30 days |
The call log keeps the route template (for example /api/integrations/v1/deals/{id}), never the path values, query string, headers or body of a call.
Never logged
Section titled “Never logged”These never appear in any log or record:
- integration keys,
- OAuth access tokens,
- webhook signing secrets,
- request bodies.
Reporting a security issue
Section titled “Reporting a security issue”Write to [email protected] with “Security” in the subject line. If an integration key may have leaked, your Owner or an Admin can revoke it at once in Settings > Integrations.