Security review FAQ
The questions enterprise security teams ask most often.
Last updated Last reviewed Questions trust@thequantumclub.com
- Where is our data stored?
- In the European Union — AWS eu-west-1, via Supabase. EU residency is the default and there is no setting that moves core customer data outside the EU.
- Are you SOC 2 / ISO 27001 certified?
- Our controls are implemented to the SOC 2 Trust Services Criteria and map to ISO/IEC 27001. Independent attestation/certification is on our roadmap — we will publish each report and auditor here when complete, rather than imply a certificate we do not yet hold.
- How do you handle hiring AI under the EU AI Act?
- Club AI is assistive and a human always makes the decision. We build for transparency, human oversight, and against adverse impact, and treat assessments as screening-support only.
- Do you support SSO and SCIM?
- Yes — SAML 2.0 and OIDC single sign-on, plus SCIM 2.0 user provisioning and de-provisioning with audit logging.
- How quickly are data breaches notified?
- Within 72 hours of becoming aware, in line with GDPR Article 33/34.
- Can we sign a DPA?
- Yes. Our Data Processing Agreement is on the Documents page. Its sub-processors are listed on our Sub-processors page.
- How do we report a vulnerability?
- Email our security team or use the contact in our security.txt. Our coordinated disclosure policy explains scope and what to expect.
- Can we run our own security review or send a questionnaire?
- Yes. We publish a pre-answered CAIQ-style security questionnaire on this Trust Center (and as machine-readable JSON) that covers most procurement questions up front. If you need a specific questionnaire (SIG, your own template) completed, contact our trust team and we will turn it around.
- How are your AI sub-processors governed?
- The model providers behind Club AI (Google) are named in our sub-processor table with region and data terms, and each is bound by a DPA with SCCs. We list them so you always know which third parties touch AI-related data.
- What happens to our data if we leave?
- You can export your data at any time via self-service in-app, and on contract termination customer data is deleted on request within our defined retention windows. We never retain customer data beyond what we are contractually or legally required to keep.
- Do you support audit logging and SIEM export?
- Security-relevant events are recorded to an append-only audit stream today. A self-service SIEM/log-export integration is on our roadmap; until then we can provide audit records on request for enterprise customers.