Security architecture
Defense-in-depth across identity, access, network, and detection — each control is live in production.
Last updated 12 controlsVulnerabilities security@thequantumclub.com
The controls
12 controls in 3 groups
Each control lists the frameworks it helps satisfy, by our own mapping. Where each framework stands is on the Compliance page.
Identity & access
4 controlsPasskey-first authentication
WebAuthn with user verification; phishing-resistant by design.
SCIM 2.0 provisioning
RFC 7644 directory-driven joiner/mover/leaver with full audit trail.
Data protection
4 controlsEncryption at rest
Database, storage and backups encrypted at rest (AES-256).
Row-Level Security
Postgres RLS enforced across 100+ tables — tenant isolation at the database layer.
Detection & resilience
4 controlsAtomic rate limiting
Auth-aware, fail-closed limiter (per-account + per-IP) on every authentication endpoint.
Supports SOC 2
Anomaly detection
Continuous scan (every 5 min) for credential-stuffing, spraying, velocity and takeover patterns — alerting today.
Supports SOC 2
Account recovery
PBKDF2-hashed recovery codes; five recovery paths with anti-enumeration guarantees.
Supports SOC 2
Continuity
Resilience & continuity
Availability, backups, incident response, and breach notification.
Availability is published in real time at status.thequantumclub.com, including component health and historical uptime.
- Recovery objectives
- We maintain defined recovery-time and recovery-point objectives (RTO / RPO) per service tier. The specific targets and our business-continuity plan are available under NDA on request.
- Backups
- Customer data is backed up on a recurring schedule with encryption at rest. Backups inherit European residency and are periodically restore-tested to verify they are recoverable, not merely written.
- Incident response
- We operate a documented incident-response process (detection, triage, containment, eradication, recovery and post-incident review) with severity-based escalation. Security-relevant events are logged to an append-only audit stream.
- Breach notification
- We notify affected customers and, where required, the competent supervisory authority of a personal-data breach within 72 hours of becoming aware, in line with GDPR Art. 33–34.
Researchers
Vulnerability disclosure
How to report a security issue, and what to expect from us.
Found a security issue? Email security@thequantumclub.com — also published in our security.txt (RFC 9116). Our coordinated-disclosure policy explains scope and timelines: disclosure policy.
We practise responsible disclosure and will keep you informed through remediation. Please do not access data that is not yours, and give us reasonable time to fix before publishing.
Safe harbour. We will not pursue legal action against, or report to authorities, researchers who act in good faith and in accordance with this policy — staying within scope, avoiding privacy violations and service degradation, and not exfiltrating data beyond the minimum needed to demonstrate a finding. If in doubt about whether your testing is authorised, ask us first at security@thequantumclub.com.
From the security review FAQ
Questions on security
- How do we report a vulnerability?
- Email our security team or use the contact in our security.txt. Our coordinated disclosure policy explains scope and what to expect.
- Do you support audit logging and SIEM export?
- Security-relevant events are recorded to an append-only audit stream today. A self-service SIEM/log-export integration is on our roadmap; until then we can provide audit records on request for enterprise customers.
- Can we run our own security review or send a questionnaire?
- Yes. We publish a pre-answered CAIQ-Lite security questionnaire on this Trust Center (and as machine-readable JSON) that covers most procurement questions up front. If you need a specific questionnaire (SIG, your own template) completed, contact our trust team and we will turn it around.