Hosting
Amazon Web Services in the United States. The database sits in a private network with no internet access, with a standby in a second data center.
Trust center
What you need to qualify us as a supplier.
Where your data lives, how it's protected, who else handles it, and exactly where we are on independent audits. Nothing here is a certification we don't hold.
How we protect your data
Encryption
TLS 1.2 or later in transit, encrypted at rest, and each company's files and secrets under its own key, or one from your own AWS account.
Isolation
Every company's data is walled off by the database itself, checked by automated tests in every release.
Access
Two-step sign-in by default, single sign-on on every plan, and permission checks on the server for every request.
Vendor access
Our staff can't enter your workspace unless your admin approves it, for a set time and level; everything they do is in your audit trail.
Resilience
Point-in-time restore for 35 days, daily and monthly encrypted backups, and every infrastructure action logged.
AI, only if you choose it
The AI assistant is an add-on used only by people you give a seat. It reads what they can see, never changes or signs records, logs every use, and your data isn't used to train models.
Identity
Single sign-on with your identity provider on every plan; on Enterprise, required for everyone, with SCIM adding and deactivating people for you.
Integrations
API keys act as one person with their access, can't sign, and every change made with one is audited. Webhooks are signed, and only reach public https addresses.
Audits and certifications
Where we are, stated plainly.
| Item | Status | Notes |
|---|---|---|
| Validation report (IQ / OQ) | Every release | Requirements traced to automated tests, installation checks and deviations, signed off by our quality function. |
| 21 CFR Part 11 and EU Annex 11 | Supported | The technical controls, clause by clause, on the compliance page. There's no certification for software. |
| Supplier audits | Available | Questionnaires, document review and audits as part of onboarding. |
| Independent penetration test | Planned | The summary will be shared with customers when it's complete. |
| SOC 2 | Planned | Not yet audited. Type I first, then Type II. |
| HIPAA | Talk to us | Built with the Security Rule's technical safeguards in mind. Talk to us before storing protected health information. |
Documents
Available for your supplier qualification.
Ask and we'll send them, under a nondisclosure agreement where needed.
- Security overview: architecture, isolation, encryption, access, backups
- Part 11 and Annex 11 assessment, clause by clause, with what stays with you
- The current release's validation report (IQ / OQ), with checksums
- Prepared answers to supplier questionnaires
- A quality agreement template (negotiated on Enterprise)
- The requirements catalogue and the list of sub-processors
Sub-processors
Who else handles your data.
| Company | What for | Where |
|---|---|---|
| Amazon Web Services | Hosting, database, file storage, encryption keys and backups | United States |
| Amazon Web Services (Amazon SES) | Sending notification and account emails | United States |
| Anthropic | The AI assistant add-on only: the records and questions a person sends it (not used to train models) | United States |
Single sign-on goes through your own identity provider, chosen by you. We'll tell customers before adding a sub-processor.
Your data
Yours while you're a customer, and when you leave.
Never deleted
Records are archived, never hard-deleted, and published versions and files are kept, for as long as you're a customer.
Export any time
Any table as CSV or PDF, whenever you like. Every export is recorded in the audit trail.
A complete copy when you leave
Your records, files and audit trail, handed over in full.
Report a vulnerability
Found a security problem? Tell us.
Write to security@qualsted.com with the details. We'll confirm we've received it, keep you informed while we fix it, and won't take action against good-faith research.
For your quality and security teams