Security

We don't hold a SOC 2 or ISO 27001 certification today, and we don't run a formal bug bounty program or publish third-party penetration test reports.

Our production servers and database are hosted in the European Union. Some of the third-party services we rely on to operate QuikRing — see our Sub-processors page — are located outside the EU/EEA; where that's the case we rely on Standard Contractual Clauses with those providers, as described in our Privacy Policy.

• Encrypt traffic in transit with TLS.
• Hash passwords with bcrypt, and check new and changed passwords against a database of known-breached passwords before accepting them.
• Support optional two-factor authentication for individual accounts, and org owners can require it for every member of their organization.
• Keep an audit log of membership and settings changes that organization owners and admins can review and export.
• Rate-limit login, signup, and password-reset endpoints against automated abuse.
• Expire sessions after a fixed maximum length rather than keeping them valid indefinitely.
• Offer a signed Data Processing Agreement on request for GDPR compliance — see our Privacy Policy.

• Card payments are processed by Stripe. We never see or store your card number.
• Payments go through 3-D Secure verification when your bank or our fraud checks ask for it.
• You can delete your account, and your call recordings, yourself, at any time.

If you believe you've found a security vulnerability in QuikRing, please email security@quikring.com with enough detail to reproduce it. We'll acknowledge your report and won't pursue legal action against good-faith research that doesn't access, modify, or destroy other users' data. Please give us a reasonable chance to fix an issue before disclosing it publicly.

See our Privacy Policy for how we handle personal data, or our Sub-processors page for the third parties we rely on. For a vendor security review, contact support@quikring.com.