Security

Every request that reads or writes board data is checked against the signed-in user's membership of that board, in our application, before any data is returned.

Row-level security at the database is a fail-closed backstop: no anonymous or unauthenticated connection can satisfy its policies.

Data is encrypted in transit, using TLS, between your browser and Quorums, and between Quorums and its AI provider.

Supabase, which hosts our database and file storage, states that all customer data is encrypted at rest with AES-256.

Vercel, which hosts the application, states that it encrypts data at rest with AES-256.

Each request to our AI provider is processed independently. We keep no copy of a request or its response outside your own workspace. Retention by our AI sub-processor is governed by its commercial terms: see the Data Processing Agreement and the sub-processor list.

When the Contract ends, you may export your Customer Data for 30 days (Terms of Service, clause 14.5). During that period we provide the export on request to legal@quorums.ai.

We confirm deletion to you in writing within 30 days of the end of the export period (Data Processing Agreement, clause 10.2).

Access to a board is by membership, with Admin and Member tiers and a read or write permission for each member.

If we become aware of a Personal Data Breach, or of any loss, corruption or unauthorised processing of your Personal Data, we notify you without undue delay with the information set out in clause 6.2 of the Data Processing Agreement.

We give at least 30 days' notice before appointing a new sub-processor, and list each addition, with the date notice was given, on the sub-processor list.

Multi-factor authentication is available to every user through our authentication provider.

Report a security concern to legal@quorums.ai.