On this page
Your organization's boundary
Quaspar is multi-tenant with isolation enforced in the backend on every query — never trusted to the browser.
- Every record belongs to exactly one organization, and every API request is checked against the caller's organization server-side.
- Attempts to reach another organization's resources return "not found" — foreign resources don't exist as far as any tenant can observe.
- Continuously attack-tested: our CI creates two organizations and attempts cross-tenant access against every critical endpoint on every build. Any success fails the release.
A request carrying Organization A's session can never resolve Organization B's records. Our CI runs this exact attack against every critical endpoint on every build.
Sign-in and sessions
- Passwords are stored only as bcrypt hashes, with strength requirements, login rate-limiting, and brute-force lockout.
- Multi-factor authentication (authenticator apps) is available on every account, and workspaces can require it for administrators.
- Sessions are short-lived tokens with refresh rotation. Changing your password immediately revokes every session on every device.
- The server refuses to start in production with a default or missing signing secret — misconfiguration fails loudly, before it can fail silently.
- Role-based access control (owner, admin, editor, viewer) is enforced on every endpoint.
Encryption
- In transit: TLS for everything — browser to API, API to database, API to cache (private network, TLS + authentication).
- At rest: all data encrypted at rest; PHI-bearing fields carry an additional application-layer encryption key.
- Credentials: connector secrets live in a managed secret store and are write-only — no API response ever returns a stored secret.
Encrypted on every hop. Connector secrets are write-only — no API response ever returns a stored secret.
Protected Health Information
- Uploaded file bytes are never stored: text is extracted, originals discarded, and files are validated by content, not by declared type.
- PHI used during a live workflow is scrubbed from stored run state when the run completes, on configurable retention windows.
- Worker learning stores redacted patterns — never patient identifiers.
- PHI is processed under Business Associate Agreements; our infrastructure subprocessors offer HIPAA-eligible services under BAA. Contact us to execute a BAA before connecting live patient data.
- Your data is never used to train AI models and is never sold.
AI workers, held to a higher standard
AI that acts needs stricter controls than AI that chats.
Which tools, which data, read vs. write — compiled at creation, reviewable at any time, enforced by the backend. The model never decides its own permissions.
An automated pass audits each new worker's design; risky capabilities default to approval-required.
Outbound messages, submissions, and connected-system writes wait for a person until your organization grants autonomy per capability — revocable at any time.
Per-run tool-call caps, run timeouts, and per-organization daily AI spending caps.
Any run can be cancelled mid-flight, and any worker suspended instantly by an administrator.
Established evidence, AI inference, and hypothesis are never mixed unlabeled in research outputs.
Nothing consequential leaves Quaspar without a person approving it — until your organization explicitly grants autonomy for a specific capability, which stays revocable.
Audit trail
Every security-relevant event is recorded — sign-ins and failures, MFA and password changes, permission changes, every worker run and every tool call, approvals and rejections, exports, cancellations, suspensions, deletions — each with who, what, when, and outcome.
Illustrative shape only. This is the record HIPAA's audit-control requirement asks for, and it's how your compliance team answers "what did the AI do, and who approved it?"
Application and API hardening
- Rate limiting on all surfaces, with stricter limits on sign-in, and request-size caps.
- Strict security headers (CSP, HSTS, frame denial), input validation on every endpoint, and sanitization of user-supplied text.
- Generic error responses — no stack traces, no internals. Signed webhooks (HMAC, per-webhook secrets) and an explicit CORS allowlist.
- Dependency vulnerability scanning and secret scanning in our pipeline, plus a pre-release audit that gates deploys on vulnerable dependencies, leaked secrets, and the full test suite — tenant-isolation attacks included.
Infrastructure
Managed container services on a major cloud provider, in U.S. regions.
Managed PostgreSQL and Redis on private connectivity with no public endpoints. Only the HTTPS API is reachable from the internet.
Automated daily backups with point-in-time recovery and tested restores.
Your data, your control
Export your workspace data at any time via API.
Delete your account yourself — password-confirmed. Workspaces where you are the sole member are permanently erased from every table, including audit and learning data.
Disconnect any connector and its stored credentials are deleted.
The complete inventory of what we store, why, for how long, and which subprocessors receive what is available on request.
Subprocessors
Cloud infrastructure · AI processing providers · payments (card data never touches Quaspar) · additional AI providers only when your organization selects them · your own connected systems, only as your workflows direct · public research databases (PubMed, ClinicalTrials.gov, and similar) receive search queries only — never patient data.
Reporting a vulnerability
Email bhavesh@quaspar.com — we acknowledge within 2 business days and engage in good faith with researchers. Please test only with accounts you control.
What's ahead, labeled honestly
SOC 2 Type I engagement · independent penetration testing · SSO/SAML for enterprise · expanded anomaly monitoring · public status page. We are not SOC 2 certified today and will not claim it until we are. We publish progress here as it lands — this page only ever claims what's true.
Questions, BAA requests, or a security review for your organization: bhavesh@quaspar.com