Security at QuoteWorthy
Security and privacy are part of every release. This page summarises how we protect the digests you forward and your expertise profile, who we work with, and the one guarantee that sits at the centre of the product: it never sends a pitch on your behalf.
Compliance
SOC 2 Type IIPlanned
On the roadmap. Audit window starts when we cross 50 enterprise customers.
GDPRIn progress
Data subject rights, consent records, and sub-processor transparency are live. Data Processing Agreement available on request; formal sign-off pending legal review.
CCPA / CPRAIn progress
Do Not Sell or Share, Global Privacy Control, and the rights to know, delete, and opt out are implemented. Final policy review pending.
PECR / ePrivacyIn progress
Cookie consent is enforced before any non-essential cookie loads, with a published cookie inventory. Final review pending.
Security controls
Encryption at rest
All data in Postgres is AES-256 encrypted at rest. BYOK keys are additionally AES-GCM encrypted at the application layer with a key never stored in the database.
Encryption in transit
TLS 1.3 enforced on every endpoint. Strict-Transport-Security with preload.
Authentication
Email + password with strong rules, OAuth (Google, GitHub, Facebook, LinkedIn, Twitter), TOTP-based MFA, and WebAuthn passkeys.
Authorisation
Postgres RLS on every table. Permission-string RBAC at the account level with custom roles on Agency.