At Quanta, security is of utmost importance. We understand that our customers are trusting us with financial data, and we don’t take that privilege lightly. Our security approach is designed with transparency, integrity, and confidentiality in mind.
Protecting customer data
Encryption
Quanta makes use of our cloud infrastructure service providers to ensure data is encrypted at rest and in transit. Data at rest is protected using industry standard AES-256 encryption. Data in transit is protected by ensuring all endpoints use TLSv1.2 or higher.
Endpoint Security
Quanta exclusively stores customer data in secured production data environments; storing customer data on any other device is prohibited. Furthermore, production systems can only be accessed through verified workstations.
Network Security
Quanta production networks are segregated from development and staging networks.
Quanta benefits from DDoS (Direct Denial of Service) protection provided by our platform provider Render. This protection is from Cloudflare, the industry leader in DDoS mitigation.
Data Security
Quanta encrypts data at rest using industry standard AES-256 encryption. Our database provider Render performs daily backups of our production data. Additionally, Render undergoes annual third party application and network penetration tests with top tier independent firms.
On request, Quanta is able to delete customer data and provide confirmation of deletion.
Quanta does not store your credentials – including but not limited to your Quickbooks credentials, banking credentials, or other services that Quanta integrates with. Instead, we use secure revocable tokens (granted only after you authenticate) to connect with your data providers.
Confidentiality Policy
To access confidential information, employees must have appropriate privileges and be on their verified workstations. We also prohibit the sharing of customer information within and outside the company to anyone without appropriate privileges. Printed information must be shredded once no longer in use.
At Quanta, security is of utmost importance. We understand that our customers are trusting us with financial data, and we don’t take that privilege lightly. Our security approach is designed with transparency, integrity, and confidentiality in mind.
Monitoring and Risk Management
Access Control
Quanta makes use of MFA and strong password requirements wherever possible. We use role-based access control and follow the principle of least privilege when granting roles. Quanta maintains logs across our cloud infrastructure resources to monitor access to those resources.
Change Management
Quanta’s product development cycle includes rigorous testing before features can be launched to users. This includes the following steps in our code release lifecycle: automated unit, integration, and end-to-end tests, static code analysis tooling, manual QA, and engineering code reviews.
Incident Response and Business Continuity
Security Incident Response Process
Quanta invests in monitoring, observability, and alerting for our production environments. We take security seriously and have a 24/7 on-call process through which we resolve incidents as soon as they arise. The response plan includes 7 steps:
1. Assign an incident owner whose job is to ensure the incident is resolved 2. Mitigate the attack
3. Understand the impact
4. Run a post-mortem, noting any action items required to minimize the likelihood of similar incidents happening in the future
5. Create communication plan for impacted customers
6. Prioritize any necessary action items from the post-mortem
7. Close the incident
Security reports can be made to [email protected], where they will be triaged appropriately.