Security

We don't hold a SOC 2 or ISO 27001 certification today, and we don't run a formal bug bounty program or publish third-party penetration test reports. We'd rather tell you that plainly than imply otherwise. Below is what we actually do.

Our production servers and database are hosted in the European Union. Some of the third-party services we rely on to operate QuikRing — see our Sub-processors page — are located outside the EU/EEA; where that's the case we rely on Standard Contractual Clauses with those providers, as described in our Privacy Policy.

• Encrypt traffic in transit with TLS.
• Hash passwords with bcrypt, and check new and changed passwords against a database of known-breached passwords before accepting them.
• Support optional two-factor authentication for individual accounts, and org owners can require it for every member of their organization.
• Keep an audit log of membership and settings changes that organization owners and admins can review and export.
• Rate-limit login, signup, and password-reset endpoints against automated abuse.
• Expire sessions after a fixed maximum length rather than keeping them valid indefinitely.
• Offer a signed Data Processing Agreement on request for GDPR compliance — see our Privacy Policy.

If you believe you've found a security vulnerability in QuikRing, please email [email protected] with enough detail to reproduce it. We'll acknowledge your report and won't pursue legal action against good-faith research that doesn't access, modify, or destroy other users' data. Please give us a reasonable chance to fix an issue before disclosing it publicly.

See our Privacy Policy for how we handle personal data, or our Sub-processors page for the third parties we rely on. For a vendor security review, contact [email protected].