Security and Privacy

Your workspace is yours

• Every read and write of customer research is scoped to the workspace and organisation it belongs to, on the server. Hiding a screen is never the control.
• The scoping is checked automatically on every release, by tests that seed more than one organisation, and in production by an isolation check that looks for any record whose organisation disagrees with its parent.
• Plan limits and permissions are enforced on the server for every screen, export and API route.
• Inside our own console, each staff role sees only the modules it is granted, and changes made there are written to an audit log.

Signing in

• Sign-in is through Microsoft Entra ID, Google, or a single-use email link. We never hold a password for you.
• Sign-in links are stored only as a hash and work once.
• Sessions end after 15 minutes without activity and after 8 hours at most.

Secrets and payments

• Credentials live in the hosting provider’s environment settings, never in the source code or the browser. The build fails if a credential is found in the code or in what is sent to the browser.
• Card details are entered on the payment provider’s own form and never reach our servers.
• All traffic to the site and the application is encrypted in transit.

Personal data

• The privacy policy says what we collect, why, for how long, and what you can ask us to do.
• People named in research are recorded only in their professional capacity, with the document that named them, and anyone can ask to be removed. Removal is kept on a do-not-collect list so it lasts.
• Analytics and advertising cookies wait for consent in the European Economic Area, the United Kingdom and Switzerland, and can be turned off anywhere from Cookie settings.
• Advertising tags never run inside the product or the console.

Suppliers and where data goes

• Every supplier that receives personal data is on the subprocessors page, with what it receives, where, and what its own terms provide.
• The application is hosted in the United States. QuikSync Technologies LLP is based in India. Data from Europe is therefore transferred, and the subprocessors page says which supplier terms carry the European Commission’s standard contractual clauses.

Certificates the company holds

QuikSync Technologies LLP holds an ISO/IEC 27001:2022 certificate (number 305025030440IS, issued by QRO, certified 4 March 2025, expiring 3 March 2028) and an ISO 9001:2015 certificate (number 305025030358Q). The scope stated on the certificates is the company’s software development, consultancy, services and maintenance, mobile application development, QA testing and IT outsourcing. They do not name the QuikSignal platform’s operation separately, and neither is a certification under the GDPR. Copies are available on request.

Asking for more

For a security questionnaire, the supplier list in a spreadsheet, a copy of the certificates or our customer data processing agreement (currently in draft), write to sales@quiksync.com. For anything about your own personal data, write to grievance@hello.quiksynctech.com. To report a security problem, see our security.txt.