Quotinc Security
S Security & data protection
So we will be plain about it. Here is what protects your rates, your clients and your quotations today, what we are strengthening next, and exactly which companies ever touch your data. No security theater, no claims we cannot stand behind.
Last updated 1 July 2026 · We are pre-certification and we say so.
Every item below is live in the product right now. If it is on the roadmap instead, it is in the next section, not this one.
Each customer is a separate tenant. Every record is tied to a tenant identity that our servers derive from your logged-in session. It can never be set by a browser or an API call. Our backend enforces that boundary on every read and rejects any write that would cross it.
Your supplier rates never train a shared model, never benchmark you against another desk, and never get sold. They are your edge, not our dataset. This is a written promise, not a setting.
All traffic runs over TLS with HTTPS forced and HSTS with preload. Your structured data lives in managed Postgres, which encrypts it at rest.
Passwords are hashed with bcrypt and never stored or logged in the clear. Sessions ride cryptographically signed, HTTP-only, Secure cookies. Operator and customer logins are separate realms with separate credentials.
We record the security-relevant actions inside your workspace, sign-ins, failed sign-ins, permission changes, record changes, with the actor, the tenant and a timestamp.
Our AI assistant only ever reads the quotation you are actively editing and your own catalog, scoped to your tenant on the server. It cannot reach another customer's data, and it cannot write to the database. It proposes changes you approve, through the same audited path as a human edit.
Export every quote, rate, rooming list and total to XLSX, PDF and PPTX in one click. No export fee, no hostage data. We will delete your workspace on request. The way out is built in, so the way in is safe.
API keys and signing secrets are held as environment configuration on the server, never committed to our codebase and never shipped to the browser.
Every third party in the data path is listed on our subprocessors page, kept current. If that list changes, the page changes with it.
We would rather show you the roadmap than pretend it is finished. These are in build or scheduled, and we are happy to talk timelines on a call.
Not yet. We are a young company at design-partner stage and we will not pretend otherwise. We are building toward a formal audit, and in the meantime we will complete your vendor security questionnaire honestly and walk your security team through the architecture on a call.
Your structured data (quotations, rates, clients, catalog, audit logs) lives in managed Postgres. Uploaded files (attachments, images, receipts) are stored on our application infrastructure. Every external company that touches your data is listed on our subprocessors page.
No. Every request is scoped to your tenant, derived from your session on our servers and never trusted from the browser. Reads are filtered to your tenant and cross-tenant writes are rejected. We are also rolling out a database-level backstop so the same rule is enforced a second time, at the database itself.
To generate a suggestion, the assistant sends the quotation you are editing and your own catalog to Anthropic's Claude, our AI provider. It is used only to produce your result. It is not used to train shared models, and the assistant can only ever see your tenant's data. We can go through the specifics with your team.
Yes to both. Export every quote and rate to XLSX, PDF and PPTX yourself in one click, no fee. Ask us to delete your workspace and we will. Your data is yours.
We keep an audit trail to investigate quickly, and we commit to notifying affected customers without undue delay. Reach us at sales@quotinc.com.
Yes. Send it over, or ask us for ours. We will also complete your security questionnaire.
Talk to us directly. At this stage you get the founders on the call, not a ticket queue, and real influence over what we build next.