Quvant

Security and data control

Security alone is not enough. Enterprise organizations require demonstrable control: over every access, every analysis, every output. Quvant is designed for this.

Where your data lives

Primary database is configured on MongoDB Atlas with provider-declared region AWS eu-south-1 (Milan). Application hosting is configured on Railway with provider-declared region EU West (Amsterdam). Both are provider-declared regions. We do not publish an EU-only processing claim without per-workload proof. Transfers to extra-EEA LLM sub-processors, where applicable, are governed by DPA/SCC and disclosed in the sub-processor list.

Each customer operates in a logically isolated space. Analyses, evidence packs, and logs of one organization are never accessible to another.

Enterprise: BYOC (Bring Your Own Cloud) is on the roadmap — custom evaluation only; not a generally available feature today.

Audit trail and SHA-256 hash-chain

Evidence records are SHA-256 hash-chained to make subsequent alteration detectable. An independent digital signature is not currently applied.

RFC 3161 TSA (Enterprise): RFC 3161 timestamping of exported PDF evidence is on the roadmap; it is not currently applied. Broader evidence-pack manifest anchoring is on the roadmap.

Compliance and certifications

  • GDPR: we process data necessary to deliver the service under a legal basis and DPA; we do not declare 'no personal data by design' as an absolute guarantee.
  • Quvant has not completed a SOC 2 audit. A supplier attestation does not certify Informis Labs or Quvant.
  • Quvant has not completed a SOC 2 audit.
  • Quvant's security programme takes ISO/IEC 27001 controls and principles as a reference. Documentation of implementation status is available during enterprise evaluation.

Authentication and access

  • Access via email and password, with optional additional factor verification (MFA). Passwordless access via one-time magic link, valid 15 minutes, is also available.
  • SSO/SAML (Enterprise): on the roadmap; available via custom evaluation — not a standard self-serve feature.
  • Optional 2FA on Professional plan, mandatory on Enterprise plan.

Sovereignty Scale

Sovereignty Scale

  1. Model
    Managed (provider-declared EU regions)
    Plan
    Assisted engagement
    Data residency
    Atlas eu-south-1 configured (UNKNOWN until proven)
    Control
    Standard
  2. Model
    BYOC (roadmap / custom)
    Plan
    Enterprise (evaluate)
    Data residency
    Customer-controlled (if offered)
    Control
    Custom
  3. Model
    Single-tenant (roadmap / custom)
    Plan
    Enterprise (evaluate)
    Data residency
    Dedicated tenant (if offered)
    Control
    Custom
Sovereignty Scale
ModelPlanData residencyControl
Managed (provider-declared EU regions)Assisted engagementAtlas eu-south-1 configured (UNKNOWN until proven)Standard
BYOC (roadmap / custom)Enterprise (evaluate)Customer-controlled (if offered)Custom
Single-tenant (roadmap / custom)Enterprise (evaluate)Dedicated tenant (if offered)Custom

BYOC and single-tenant options are on the roadmap; contact Enterprise for custom evaluation.

Compliance Roadmap

Our path toward third-party attestations. Self-assessed items reflect the current internal posture; certifications in progress are subject to independent audit.

Compliance Roadmap

  1. Certification
    SOC 2 Type I
    Status
    Not certified — no audit completed
    Target
    —
  2. Certification
    ISO 27001
    Status
    Not certified — ISO/IEC 27001 reference
    Target
    —
Compliance Roadmap
CertificationStatusTarget
SOC 2 Type INot certified — no audit completed—
ISO 27001Not certified — ISO/IEC 27001 reference—

Vendor Security Assessment

A pre-filled Vendor Security Assessment Questionnaire (VSAQ) is available for procurement evaluations and vendor onboarding.

Download VSAQ (PDF)View / print online

Data Processing Agreement

Download our standard DPA (template v1.0) for your legal team to review before signing any MSA.

Download DPA (Markdown)

Security architecture

  • No dedicated per-tenant compute is claimed.
  • The Evidence Pack™ hash is computed server-side with SHA-256 hash chaining.
  • No training on customer data.
  • No public duration for audit logs.

Responsible AI commitments

  • The Blind Validator is designed to receive the original input and the candidate conclusion, not the debate that produced it.
  • Every stop is recorded in the process state, with declared limits. We do not describe a store of dissenting content.
  • The confidence score is always visible, no black-box output.

Trust posture

Quvant does not claim certifications it does not hold.

  • No training on customer datalive
  • SHA-256 hash-chainedlive
  • ISO/IEC 27001 referencecontrol reference
  • No SOC 2 audit completedin progress
  • Blind Validatorlive
  • Decision Support System, the final decision is humanlive

Every claim above is recorded in the Trust Ledger with its status. The status is the ledger status, not a certification.

Frequently asked questions

Do incident data leave the EU?
Primary storage is configured on MongoDB Atlas with a provider-declared AWS EU region (eu-south-1); this is not an instrumental guarantee that data never leaves the EEA. Some LLM inference involves extra-EEA subprocessors; where transfers apply they are covered by DPA/SCC and disclosed. On Enterprise with a dedicated tenant, localization is contractually configurable. Do not treat 'no data leaves the EU' as a product guarantee without instrumental proof.
Is Quvant ISO 27001 certified?
Security controls are designed with reference to ISO/IEC 27001. Quvant holds no ISO 27001 certificate and has not completed a SOC 2 audit.

Demonstrable control, from your first analysis.

Evaluate Quvant on your data and verify every piece of evidence before proposing the budget.

Talk to usContact