Security policy

Last Updated: October 2026

1. Encryption and Access Controls

Applied uniformly:

• Encryption in transit using TLS 1.2+ for all data communications.
• Encryption at rest using AES-256 for all stored data, including backups and archives.
• Multi-factor authentication (MFA) enforced for all internal access to systems and client data.
• Least-privilege access controls ensuring team members only access systems and data required for their specific role.

2. Monitoring and Vulnerability Management

Maintained continuously:

• Continuous monitoring of all infrastructure, applications, and network traffic for anomalous or unauthorized activity.
• Patch management processes to ensure all systems are updated promptly against known vulnerabilities.
• Regular penetration testing conducted by qualified security professionals to identify and remediate potential weaknesses.

3. Incident Response

In the event of a security incident that affects client data, we are committed to prompt and transparent communication:

• Affected customers will be notified within 72 hours of confirmed incident discovery, in accordance with applicable regulations.
• Immediate containment measures will be deployed to minimize impact and prevent further exposure.
• A full post-incident report will be provided, including root cause analysis, scope of impact, and remediation actions taken.

4. Vendor and Infrastructure Security

• Vendor contracts include strict data protection clauses, confidentiality obligations, and regular audit rights.
• We conduct periodic reviews of vendor security practices and compliance status.

5. Shared Responsibility

Security is a shared responsibility between QuantumSpirit AI and our clients:

• Our responsibility: We secure the platform, infrastructure, AI systems, and all data processing environments under our control.
• Client responsibility: Clients are responsible for protecting their own access credentials, managing user permissions within their organization, and reporting any suspected security concerns promptly.

We provide guidance and best-practice recommendations to support clients in maintaining their security posture.