Security Policy

Last updated: March 27, 2026

1. Overview

QVANTUS Agent, operated by QVANTUS CAPITAL LLC, is committed to protecting the security of our platform, user data, and third-party integrations. This policy outlines the technical and organizational measures we implement.

2. Encryption

In Transit

All data transmitted between clients and our servers is encrypted using TLS 1.2 or higher (HTTPS).

At Rest

Sensitive data (passwords, API tokens, OAuth credentials) is encrypted using AES-256 or hashed with bcrypt.

3. Access Control

Role-based access control (RBAC) enforced across all systems.
Multi-factor authentication (MFA) required for administrative and production access.
Principle of least privilege applied to all employees and contractors.
Access reviewed quarterly and revoked immediately upon termination.

4. Infrastructure

Hosted on EU-based servers (Hetzner) with ISO 27001-compliant data centers.
Network segmentation and firewall rules to isolate services.
Daily encrypted backups stored separately, retained for 30 days.
Backup restoration tested regularly.

5. Monitoring & Logging

Continuous infrastructure monitoring for anomalies and threats.
Audit logs for user actions, authentication events, and API usage.
Logs retained for 12 months.
Automated alerts for suspicious activity.

6. Incident Response

Security incidents documented and investigated within 24 hours.
Affected users notified within 72 hours in case of data breach (GDPR compliance).
Post-incident reviews conducted to prevent recurrence.
Report security issues: security@qvantus.ai

7. Vulnerability Management

Regular security audits and penetration testing.
Dependency monitoring (npm audit, GitHub Dependabot).
Responsible disclosure program for security researchers.

8. Compliance

Our security practices align with:

GDPR (EU 2016/679)
Meta Platform Data Policy
Google API Services User Data Policy
ISO 27001 principles