Quin Security

Security Principles

Our security program is guided by the following principles:

• Least privilege by default – access is limited to what is necessary
• Defense in depth – multiple layers of technical and procedural controls
• Customer data isolation – strict separation between organizations
• Transparency – clear communication about our security posture
• Continuous improvement – controls evolve with scale and risk

Data Isolation & Access Control

Quin is a multi-tenant B2B platform designed to keep customer data logically isolated.

• Each customer organization's data is isolated from others
• Users can only access data associated with their organization
• Role-based access controls restrict actions based on assigned permissions
• Administrative access is tightly limited and logged

Support access to customer data is restricted, time-bound, and performed only when necessary to resolve issues or maintain service reliability.

Authentication & Authorization

We enforce strong authentication and authorization practices, including:

• Secure user authentication with encrypted credentials
• Session-based access controls
• Role-based permissions for organizational members
• Elevated access restricted to authorized personnel only

Where supported, customers are encouraged to use strong passwords and modern authentication mechanisms.

Encryption

We protect customer data using industry-standard encryption practices:

• In transit: All data is transmitted using encrypted HTTPS/TLS connections
• At rest: Data stored in databases and backups is encrypted
• Credentials: Passwords and sensitive secrets are stored using secure hashing and encryption mechanisms

Infrastructure & Hosting Security

Quin operates on secure, enterprise-grade cloud infrastructure providers.

Security measures include:

• Isolated production environments
• Restricted network access to backend systems
• Secure configuration and secrets management
• Regular infrastructure patching and updates

We rely on cloud providers that maintain recognized security certifications and undergo regular independent audits.

Application Security

Our application security practices include:

• Secure development practices and code reviews
• Input validation and structured APIs
• Monitoring for errors, misuse, and abuse
• Protection against common web vulnerabilities

We actively address security findings and continuously improve safeguards.

Monitoring, Logging & Auditing

We maintain monitoring and logging systems designed to detect and respond to security events:

• System and application logs for operational visibility
• Audit logs for sensitive actions
• Automated alerts for anomalous behavior and failures

Logs are retained in accordance with operational and legal requirements.

Vulnerability Management

We take a proactive approach to identifying and mitigating risks:

• Regular dependency updates and patching
• Ongoing review of infrastructure and application changes
• Evaluation of reported vulnerabilities

If you believe you've discovered a security issue, please report it responsibly (see “Reporting Security Issues” below).

Incident Response

Quin maintains an incident response process designed to:

• Identify and contain potential security incidents
• Investigate root causes and scope
• Remediate vulnerabilities or impacts
• Notify affected customers and authorities when required by law

We prioritize transparency and timely communication in the event of a confirmed incident.

Business Continuity & Backups

To support reliability and recovery:

• Encrypted backups are maintained for disaster recovery purposes
• Backup access is restricted and monitored
• Recovery procedures are tested periodically

Compliance & Risk Management

While Quin is an early-stage platform, we design our systems to align with common enterprise security expectations, including:

• SOC 2–aligned control design
• GDPR and CCPA data protection principles
• Contractual security obligations with service providers

Formal certifications may be pursued as the platform and customer requirements evolve.

Customer Responsibilities

Security is a shared responsibility. Customers are responsible for:

• Managing user access and permissions
• Protecting account credentials
• Ensuring data entered into Quin complies with applicable laws and agreements

Reporting Security Issues

We welcome responsible disclosure of security vulnerabilities.

Email: support@usequin.com

Please include:

• Description of the issue
• Steps to reproduce (if applicable)
• Any supporting evidence

We will acknowledge reports and work to address valid concerns promptly.

Contact

For security-related questions or documentation requests:

• Security: support@usequin.com
• Privacy: legal@usequin.com