trust
Trust & Compliance Center
Security and trust, in the open.
The Quantum Club is built for elite hiring under heavy regulatory scrutiny. This is the evidence — our compliance posture, where your data lives, how we protect it, and how our AI is governed.
Live platform statusstatus.thequantumclub.com ↗Last updated
Compliance & certifications
Frameworks we meet today, and the attestations under way. Each state reflects what we can evidence now.
Compliant in-product: data-subject access, export, erasure and rectification; granular, affirmative consent; defined retention windows; 72-hour breach notification. A DPA is available now.
Details →Customer data is stored and processed in the European Union (AWS eu-west-1, via Supabase). No multi-region toggle — EU by default and by design.
Details →Club AI is assistive; a human always makes the hiring decision. Assessments are screening-support only — never standalone selection. Designed to meet the transparency and human-oversight duties for hiring AI.
Details →Controls are implemented to the SOC 2 Trust Services Criteria (security, availability, confidentiality). An independent Type II attestation is on our roadmap; this page will publish the report and auditor when it completes.
Details →Our information-security management maps to ISO/IEC 27001:2022 controls. Formal certification is planned; we will publish the certificate and scope statement once issued.
Details →The AI-management-system standard is the highest-leverage assurance for a hiring-AI platform. Pursuing certification is on our roadmap and will be evidenced here.
Details →Document vault
Policies and reports. Public documents open directly; gated reports unlock on request or under NDA.
Sub-processors
Every third party that may process customer data, what they do, and where.
| Vendor | Purpose | Data | Region | DPA |
|---|---|---|---|---|
| Supabase | Database, authentication, file storage | Account & application data | EU (AWS eu-west-1) | ✓ |
| Cloudflare | CDN, edge compute, DNS, WAF | Request metadata in transit | Global edge (EU-served) | ✓ |
| Stripe | Payment processing | Billing details (card data not stored by us) | EU / US (DPF, SCCs) | ✓ |
| Resend | Transactional & lifecycle email | Name, email, message content | EU / US (SCCs) | ✓ |
| AI model providers (Anthropic, Google) | Club AI features (matching, assistant) | Prompts — never used to train models | EU / US (SCCs) | ✓ |
| PostHog | Product analytics — consent-gated, off by default | Anonymised usage events | EU | ✓ |
Subscribe to changes
Get notified when we add a sub-processor, earn a new attestation, or update a policy.
Data residency & data flow
Where your data is stored and processed, and how cross-border transfers are governed.
European residency by default. Customer data is stored and processed in the European Union — AWS eu-west-1, via Supabase. There is no setting that relocates core customer data outside the EU.
Cross-border transfers to sub-processors are governed by Standard Contractual Clauses (and the EU–US Data Privacy Framework where applicable). The authoritative transfer list is the sub-processor table above and our Data Processing Agreement.
Security architecture
Defense-in-depth across identity, access, network, and detection — each control is live in production.
Identity & access
Data protection
Detection & resilience
Privacy & your rights
GDPR data-subject rights, retention, and how to exercise them.
You can access, export, correct and erase your personal data from your privacy settings in Club OS. Consent for meeting recording is granular and affirmative (video, audio and transcription are separate).
Retention windows are defined per data type, and deletion-on-request is honoured. Personal data is kept only as long as needed for the purpose it was collected or as required by law; our retention schedule is documented and available on request.
Our Data Protection Officer is reachable at privacy@thequantumclub.com and acts as the contact point for data-subject requests and supervisory authorities. Full detail: GDPR rights.
AI governance
How Club AI is governed for high-risk hiring under the EU AI Act — transparency, human oversight, and your data.
Your data is never used to train models
Candidate CVs, notes and meeting transcripts are never used to train or fine-tune public LLMs. Only internal, anonymised telemetry calibrates our own prompts.
A human always decides
Club AI is assistive. Match scores, summaries and recommendations inform people; they never make an automated hiring decision.
Hiring AI is high-risk — we treat it that way
The EU AI Act classifies recruitment AI as high-risk. We design for transparency (users know when AI is involved), human oversight, and against adverse impact.
Assessments are screening-support, not verdicts
Our assessments are positioned as observed work-sample evidence, never standalone selection or clinical/personality diagnosis.
AI sub-processors are named
The model providers behind Club AI are listed in our sub-processor table, with region and data-handling terms.
Resilience & continuity
Availability, backups, incident response, and breach notification.
Availability is published in real time at status.thequantumclub.com, including component health and historical uptime.
- Recovery objectives
- We maintain defined recovery-time and recovery-point objectives (RTO / RPO) per service tier. The specific targets and our business-continuity plan are available under NDA on request.
- Backups
- Customer data is backed up on a recurring schedule with encryption at rest. Backups inherit European residency and are periodically restore-tested to verify they are recoverable, not merely written.
- Incident response
- We operate a documented incident-response process — detection, triage, containment, eradication, recovery and post-incident review — with severity-based escalation. Security-relevant events are logged to an append-only audit stream.
- Breach notification
- We notify affected customers and, where required, the competent supervisory authority of a personal-data breach within 72 hours of becoming aware, in line with GDPR Art. 33–34.
Vulnerability disclosure
How to report a security issue, and what to expect from us.
Found a security issue? Email security@thequantumclub.com — also published in our security.txt (RFC 9116). Our coordinated-disclosure policy explains scope and timelines: disclosure policy.
We practise responsible disclosure and will keep you informed through remediation. Please do not access data that is not yours, and give us reasonable time to fix before publishing.
Safe harbour. We will not pursue legal action against, or report to authorities, researchers who act in good faith and in accordance with this policy — staying within scope, avoiding privacy violations and service degradation, and not exfiltrating data beyond the minimum needed to demonstrate a finding. If in doubt about whether your testing is authorised, ask us first at security@thequantumclub.com.
Security review FAQ
The questions enterprise security teams ask most often.
Where is our data stored?
Do you use our data to train AI models?
Are you SOC 2 / ISO 27001 certified?
How do you handle hiring AI under the EU AI Act?
Do you support SSO and SCIM?
How quickly are data breaches notified?
Can we sign a DPA?
How do we report a vulnerability?
Can we run our own security review or send a questionnaire?
How are your AI sub-processors governed?
What happens to our data if we leave?
Do you support audit logging and SIEM export?
Talk to our trust team
Report a vulnerability
security@thequantumclub.comPrivacy & data requests
privacy@thequantumclub.comSecurity reviews & documents
trust@thequantumclub.com