Security
How we handle your data.
In plain language.
Quoinmark handles the regulatory brief your team reads each Friday. That covers your account, your seats, your declared product surface, and the records of what you read. This page is the answer to “how do you handle my data” for security and procurement teams during evaluation — send this link directly to your reviewer.
- Hosting
- US, single region
- Encryption
- TLS 1.2+ / AES-256
- Uptime target
- 99.9% monthly
01 — Hosting
Data residency and hosting model.
Your data lives in a single primary cloud region in the United States. We do not offer a region picker yet.
Platform runs on a single primary cloud region (US) with multi-AZ replication inside that region.
Workspace data is logically isolated at the query layer; queries are scoped per user on every request.
PII is scoped to the product surfaces you declared — we do not pool workspaces into a shared tenant lake.
Region pinning outside the US is not productized today. If your team requires EU or UK residency, the platform is not yet a fit.
02 — Encryption
Encryption in transit and at rest.
TLS 1.2+ for everything in motion. AES-256 at rest on the database and object storage. Secrets never sit in the repo.
All client and inter-service traffic is TLS 1.2 or higher, with HSTS-style modern certificate posture.
Database volumes and object-storage buckets are encrypted at rest with AES-256, using cloud-managed keys.
API credentials and signing keys are stored in the platform secret proxy, never in application source or environment files.
Per-tenant key partitioning is not yet offered — encryption keys are cloud-managed and shared across tenants inside the region.
03 — Access
Access controls and admin roles.
Built on role-based access control (RBAC). Admin and reader are separate roles. MFA is required for admin accounts.
Two roles ship today: admin (workspace management) and reader (brief access). Role is enforced on every authenticated request.
MFA is required and enforced for accounts in the admin role; reader accounts can opt in.
Session tokens rotate on a fixed expiry; revoked sessions are invalidated server-side at logout.
Every data-plane query is scoped `where: { userId: user.id }` — one user cannot read another user’s row through the API.
04 — Backups
Backup and restore posture.
Daily logical backups, multi-AZ replication, and quarterly restore drills. Point-in-time recovery is not claimed.
Daily logical backups of the primary database, retained for thirty days, written to a separate availability zone.
Restore-from-backup is exercised on a quarterly cadence against a sandbox, not against production traffic.
Multi-AZ replication carries live traffic; backups are isolated from the live database so a tenant-side deletion cannot wipe the backup set.
Point-in-time recovery (PITR) is not productized today — restore granularity is the most recent successful daily snapshot.
05 — Uptime
Uptime and availability commitment.
99.9% monthly availability is the published target. Monitoring and incident communication run on the same channel admins receive.
Published commitment: 99.9% uptime measured monthly, excluding planned-maintenance windows announced at least 48 hours ahead.
Internal availability monitoring runs continuously across the API, the brief-delivery pipeline, and the dashboard.
Incident notifications go to workspace admins by email during an active incident; post-mortems are published within five business days.
A public status page is not yet productized — for now, the incident channel is direct email to admins of affected workspaces.
Honest abouts
What this page does not claim.
These are the limits a security or procurement reviewer should know up front. If any of them describes a hard requirement, the brief is not yet a fit — and we will say so from the first call rather than after procurement has spent a quarter on the evaluation.
No SOC 2 today
SOC 2 Type II is not yet certified. A Type I report is in scope for the next reporting window; the trust team will share the timeline on a call.
Single region
Region is US-only. EU and UK residency are not productized. If your buyer requires a region picker, the platform is not yet a fit.
MFA on admin only
MFA is required on admin accounts. Reader accounts can opt in to MFA but it is not enforced on every read-only seat.
No point-in-time
Backups are daily logical snapshots, not PITR. Restores resolve to the most recent successful daily snapshot, with a known-write boundary.
No public status page
A public status page is not yet productized. Incident notifications are direct-email today; the trust team will share live status on call.
Keys: shared per region
Encryption keys are cloud-managed and shared across tenants inside the region. Per-tenant customer-managed keys (CMK / BYOK) are not yet offered.
Need a deeper dive?
We’ll share the architecture diagram,
the data-flow map, and our standard MSA addenda.
On a security call, the team walks through the request path, the data-flow map for the brief-delivery pipeline, and the standard MSA and DPA addendas we send on request. Reply within one business day.