Security & Compliance

Identity & access

• MFA (TOTP) per user with recovery codes and disable flow.
• Organization MFA requirement to enforce MFA for org-scoped API access.
• API key scopes, optional expiry, revoke timestamp, and last-used audit fields.
• Scoped OIDC SSO with optional password-login enforcement by organization.

Data protection posture

On supported runtime paths (see EU AI Act readiness), teams can correlate policy decisions, enforcement events, and traces — including what was blocked or redacted before a model call. In workflow use cases, PII controls should run before model nodes. For self-hosted deployments, raw source data can remain inside the customer-controlled network boundary.

Runtime evidence integrity

• Enforcement and run-seal events append to a per-tenant hash-chained trace store — each entry carries the digest of the prior entry, so undetected alteration breaks the chain.
• Completed segments are batched into Merkle trees and their roots published to the public Sigstore Rekor log, so reviewers can confirm anchors independently — no Quantlix login or trust required.
• Audit bundles export as manifest-led PDF / CSV / JSON with a HOW_TO_VERIFY guide and a standalone verification script.

Verification steps and anchor lookup are documented on Evidence integrity in the Trust center; the model is explained on How proof works.

Access & operational controls

• Role-based access separates engineering, governance, leadership, and reviewer permissions per organization.
• A scoped external_reviewer role limits auditors and buyers to the AI register, evidence, and audit-bundle surfaces.
• Deployment stop and resume are audited lifecycle controls — each action is recorded with actor identity.
• Provider failover events are recorded on the enforcement spine, so per-request provider attribution survives routing shifts.

Posture summary and current certification status: Security & Trust posture.

Signed audit exports

Enforcement-event JSONL can be exported with hash chain and trailing HMAC signature metadata.

curl "https://api.quantlix.ai//enforcement-events/export?deployment_id=DEPLOYMENT_ID&format=jsonl&signed=true" \
  -H "X-API-Key: YOUR_API_KEY"

curl -X POST "https://api.quantlix.ai//audit/verify-signed-export" \
  -H "X-API-Key: YOUR_API_KEY" \
  -H "Content-Type: application/json" \
  -d '{"lines":["{...signed jsonl line 1...}","{...line 2...}","{...signature block...}"]}'

Note: signed export requires `AUDIT_SIGNING_KEY`.

GDPR data subject rights

Self-service export and erasure are available via authenticated auth endpoints.

curl "https://api.quantlix.ai//auth/gdpr/export" \
  -H "X-API-Key: YOUR_API_KEY"

curl -X POST "https://api.quantlix.ai//auth/gdpr/delete" \
  -H "X-API-Key: YOUR_API_KEY"

Erasure is blocked with `409` when the user is the sole owner of any organization.

Trust center

Hosting, subprocessors, SOC 2 / ISO posture, and audit evidence are summarized on the Trust center page (aligned with this document). The live subprocessor register is also available as machine-readable JSON.

Common questions