Security and data handling
Local-first by design. Planned controls labelled planned.
This page describes the workspace as it is built, not as a compliance page would like it to be. Where a control ships, it is described. Where it is on the roadmap, it says so. No blanket compliance claim appears here because none has been earned yet.
Controls
What leaves the machine, what stays, and what protects it.
- Local-first storageShipped
- JSON documents under a data directory on your machine by default; PostgreSQL, keyed by user, when configured for a hosted deployment. Exports go to a local directory or an S3-compatible bucket.
- Outbound allowlistShipped
- The workspace contacts external hosts only when a market-data provider is used. Egress is an allowlist: HTTPS only unless a host opts out, every redirect re-checked, credentials in URLs refused, and any host that resolves to a loopback, link-local, multicast or private address refused.
- No telemetry in the workspaceShipped
- The frontend makes no request to any origin other than its own. Fonts are bundled; there is no analytics, telemetry or CDN.
- Credential store that never returns a valueShipped
- Provider keys resolve from environment variables first, then a server-side store. The API can report that a credential is configured and where it came from; it never returns the value. Every secret is redacted from logs, errors and provenance records before they are written.
- Sign-in, sessions and CSRFShipped
- Passwords use PBKDF2-SHA256 with a per-user salt; TOTP two-factor with backup codes; optional Google sign-in through server-side OpenID Connect with PKCE. A signed, HttpOnly, SameSite cookie identifies the session; every open session is listed and revocable; state-changing calls carry a CSRF token.
- Tenant and project isolationShipped
- The session sets the tenant for the request and every store reads and writes only that tenant's documents. A background job runs as the tenant that submitted it. Exports are namespaced by tenant. Projects isolate universe, data, runs and results.
- Rate limits and bot checksShipped
- Sign-in attempts are rate limited per client address, state-changing calls per user. Cloudflare Turnstile guards sign-up and password reset when configured; the rate limits apply regardless.
- Security headersShipped
- Every response carries a Content-Security-Policy, X-Frame-Options DENY with frame-ancestors none, X-Content-Type-Options nosniff, a referrer policy and a permissions policy; HSTS behind a TLS-terminating proxy.
- Audit and exportShipped
- An audit log with categories, an account export as JSON, and API keys stored as SHA-256 digests with an optional enforcement gate for programmatic callers.
- Uploaded files are not executedShipped
- CSV uploads are parsed as data with a strict column contract. Saved Results refuse any executable markup before storing rendered panels.
- Encrypted secrets at rest and durable audit persistencePlanned
- Listed in the workspace roadmap for hosted multi-user deployment.
- Supported on-premise or VPC deployment, SSO and SCIMPlanned
- Listed under the planned Institution plan. The workspace runs from a Python environment or Docker image on a machine you control today; a supported institutional deployment is design intent.
- Independent security assessmentPlanned
- Not yet commissioned. When one is, its scope and date will be stated here.
This website
What this site collects, which is little.
The marketing site is static. Forms post to a handler on the same host that stores the submission as a file outside the web root and emails it to the company. There are no analytics scripts and no non-essential cookies, so there is no consent banner. Your scheme and accent preferences are kept in your own browser's local storage and never sent anywhere.
Responsible disclosure
Report privately. Acknowledged within one working day.
Email support@quantcompose.com with the affected route or module, steps to reproduce, and the impact you believe it has. Please do not test against installations you do not own. Reports are read by the people who can fix them.
Questions a security team would ask? Ask them.
Institution enquiries get answers about deployment, data residency and what is design intent.