The controls in place across Site Qwality, and what each one covers.
What is in place
Controls, and what they cover
Authentication
Passwords are hashed with Argon2 and never stored in plaintext. Two-factor authentication works with an authenticator app or a passkey. Authenticator secrets are encrypted with AWS KMS, and recovery codes are stored as keyed hashes.
Roles checked by the server
Six roles: super admin, admin, billing admin, member, viewer and auditor. The server checks them on the request itself, so a refused action is refused, not just hidden in the interface. API keys carry scopes instead of a role.
API keys we cannot read back
Each key is 96 random hexadecimal characters. We keep its SHA-256 digest, never the key itself, so a lost key can be revoked and reissued but not recovered.
Tenant scoping
Every data-plane read is scoped to an account before it reaches storage. On an ordinary request that account comes from your verified session, not from anything the caller sends. Partner access to a client account and our staff tools are checked separately before use.
Parameterized queries
PostgreSQL access uses parameterized statements with bind parameters, with no string-concatenated SQL on that path.
Encryption in transit
Every connection between you and Site Qwality is HTTPS. Our public API hostnames and this site require TLS 1.2 or later, and so do five of our six content-delivery distributions.
Encryption at rest
All ten of our object-storage buckets are encrypted with AES-256 and block public access. The volume that holds logs, metrics, traces, RUM data and the session-replay index is encrypted at rest too.
Check bodies captured on failure only
A successful HTTP check stores no response body. When a check fails we keep a short snippet with the result and the full body in encrypted object storage, so you can see what went wrong.
An audit log you can read
Changes you and your users make, and denied attempts, are logged with the actor, the action, the IP address and the user agent. Admins and auditors can read the last 90 days in the dashboard.
Staff actions
Changes our staff make to your plan or account go to our internal staff log. A staff member acting as one of your users appears in your own audit log, under their own name.
How our own staff reach production
Our staff tools sit behind an IP allowlist, a server-verified origin token and the staff role on the session. Staff can use passkeys and authenticator-app two-factor authentication.
Impersonation is explicit and bounded
Staff can open your account as one of your users only through a tool that records who did it, which user and why. The session can be read-only, and it ends after 60 minutes.
Card data never reaches us
Card details go into a payment form served by Stripe and never touch a Site Qwality server, database or log. We keep Stripe’s customer and subscription IDs.
Alert email that is not rewritten
Alert email goes out through Amazon SES with DKIM, SPF and DMARC. Link tracking is off, so links in an alert are never rewritten, and bounces are recorded so a suppressed address shows up instead of failing quietly.
Vendor review
The short answers
Certifications: Site Qwality holds no SOC 2 report or ISO 27001 certificate of its own. Amazon Web Services, which we run on, holds both.
Testing: we have no third-party penetration test or vulnerability-scanning program. Report issues to the address below.
Encryption at rest: it covers the stores named above, not every store we run.
TLS: one content-delivery distribution, which serves status-page logos and images, still permits TLS 1.0.
Audit log: logging never blocks your request, so an outage of the log store can leave a gap. Incident actions taken from email and SMS links are not in it.
Data location: our own infrastructure stores your data in AWS us-east-1, in the United States, and we offer no EU or UK data-residency option. HTTP, TCP port, ping and browser checks run from the locations you choose and send their results back to us-east-1; our Subprocessors page gives each provider’s processing location.
Content delivery: our six content-delivery distributions, including the ones for status pages and our staff portal, terminate connections at edge locations that include Europe. None of them keeps access logs.
Deletion: some operational records have no enforced deletion window. Our Data Retention page lists each category.
Filling in a vendor assessment? Write to the address below and we will answer it.
Responsible Disclosure
Found a vulnerability?
Tell us. An engineer reads every report and will work with you on a responsible fix. There is
no bug-bounty program.