How we protect your data, and what we do when something goes wrong.
Infrastructure security
Qintr's application and database run on Railway. Data in our database is encrypted at rest and in transit, with automatic backups. Uploaded media is stored on Cloudflare R2 — not on the application server's local disk.
Application security
- All user input is validated and sanitised server-side
- Database queries use parameterised statements
- CSRF protection on authenticated endpoints
- Rate limiting and bot detection on public forms
- Dependencies are reviewed for known vulnerabilities
- Workspace-level isolation: every query is scoped to the authenticated user's organization
Payments
Card data is handled by Stripe (PCI DSS Level 1). We never store card numbers.
Responsible disclosure
Report to security@qintr.com with description, impact, and reproduction. We acknowledge within 48 hours. Don't access other people's data or run denial-of-service tests.
Incident response
In a confirmed breach affecting personal data, we'll notify affected customers and relevant authorities within 72 hours of becoming aware.