Security you can put in a questionnaire
We build a product that answers security questionnaires, so we know what your procurement team will ask. These are our answers.
Core controls
- Encryption
- All traffic is encrypted with TLS, and data is encrypted at rest with AES-256 by our database provider.
- Workspace isolation
- Every request is scoped to the workspace on the signed-in user's account record, never to an id the browser sends. Documents, answers and embeddings are queried per workspace.
- No training on your data
- Quenaire never uses your documents to train models. To draft an answer, only the passages it needs are sent to the language model.
- Access controls
- Role-based access with fine-grained permissions, so users, integrations and API keys get only what they need.
- Answer history
- Every change to an answer is kept as a version, with who made it and when, so you can see how a response evolved before it was sent.
- Data residency
- Enterprise customers can discuss data residency requirements with our team.
Certifications and frameworks
Where we stand today, stated plainly. Ask us for documentation at [email protected].
An audit is on our roadmap. Contact us for our current security posture and documentation.
Certification is on our roadmap. Contact us for our current security posture.
A Data Processing Agreement is available on all paid plans, with subprocessors listed in it.
Contact us to discuss HIPAA requirements and agreements for Enterprise customers.
Data deletion requests are fulfilled within 30 days.
Infrastructure
- Hosting
- Railway, Singapore region, behind Cloudflare
- Database
- PostgreSQL, encrypted at rest
- Vector search
- pgvector in the same database, queried per workspace
- Network
- Cloudflare traffic filtering and rate limiting
- Security contact
- [email protected]
How we build it
- Automated tests run on every change, including tests that one workspace cannot reach another's data.
- Dependencies are scanned for known vulnerabilities in the build pipeline.
- Secrets are kept out of source control and supplied by the hosting platform at runtime.
- Uploaded file names are sanitised and confined to the storage directory.
AI and your data
Quenaire calls a language model through its API to draft answers. Ask us which model provider serves your workspace and its data terms.
- Only what is needed
- Each request carries the passages retrieved for one question, not your whole document library.
- No model training
- Your documents are used to answer your questionnaires and nothing else. Quenaire does not train or fine-tune models on them.
- Isolated retrieval
- Retrieval searches only your workspace's documents, so one customer's content never appears in another's answers.
Reporting a vulnerability
Email [email protected] with the details. We respond within 48 hours and work with you to verify and fix the issue. We do not pursue legal action against researchers who report in good faith.