Trust & Security
QualCanvas is built for qualitative researchers handling interview transcripts, fieldnotes, and other potentially-sensitive primary data. This page documents how we handle that data — what we host where, who we share it with, what we log, and what we're building toward.
At a glance
| Live service check | API health endpoint |
| Incident history | A dedicated public incident-history page is not currently available |
| Security contact | [email protected] |
| Compliance roadmap | SOC 2 certification is not currently available |
Hosting & data residency
- Application + database: Railway, US East region. All transcripts, codings, memos, and user accounts live here.
- CDN + edge: Cloudflare serves the frontend, proxies the custom API domain and provides R2 object storage for uploaded media.
- File uploads: Cloudflare R2 (S3-compatible), same Cloudflare account.
- EU region: an EU-resident application database is not currently available. Institutions with residency requirements should confirm suitability before uploading research data.
Encryption
- In transit: TLS 1.3 everywhere, HSTS enabled, HTTPS-only.
- At rest: Postgres + R2 disks encrypted at the volume layer (provider-managed).
- Sensitive credentials: User-supplied AI API keys are AES-256-GCM encrypted with a per-deployment master key (see
utils/encryption.ts). - Backups: Weekly
pg_dumpto a private R2 bucket scoped to a least-privilege token. A restore procedure is documented indocs/runbooks/RESTORE_DRILL.md; restore exercises are not yet reported publicly as a recurring service commitment.
Authentication
- Email + password (bcrypt, 12 rounds) with email verification
- Google OAuth 2.0 (no data sharing — identity only)
- Legacy access-code sign-in for grandfathered users
- Session JWTs stored in httpOnly+SameSite cookies, rotated on password change
- Not currently available: MFA and institutional SAML/OIDC SSO
Sub-processors
We share data with these providers only as needed to deliver the service. New sub-processors are added here with at least 30 days' notice for institutional customers (see DPA).
| Vendor | Purpose | Location | DPA / posture |
|---|---|---|---|
| Railway | Application + Postgres hosting | US East | Provider terms / DPA |
| Cloudflare | CDN, edge, DNS, R2 storage | Global edge | Provider terms / DPA |
| Stripe | Payment processing | US | Provider privacy and data terms |
| Resend | Transactional email | US | Provider terms / DPA |
| OAuth identity | Global | OAuth only — no data sharing | |
| OpenAI / Anthropic / Google AI | Large language model inference | US | Requests are proxied by QualCanvas; provider terms apply |
| Sentry | Error tracking | Configured project region | Provider terms / DPA |
| GitHub Actions | CI + backups | US | Provider terms / DPA |
Audit logging
Every authenticated request to a canvas resource is recorded in our internal AuditLog table with the action (read / write / update / delete / export), timestamp, hashed IP, and response status. Audit events remain available with the project while needed for security, support and research traceability.
As the owner of a canvas, you can pull the full audit trail at any time via GET /api/v1/canvas/<id>/audit (or via the Quality panel → "View audit trail" in the canvas UI).
Data subject rights (GDPR)
EU / UK customers can request access, rectification, erasure, portability, or restriction of their data via [email protected]. We respond within 30 days per GDPR Art. 12. International transfers covered by Standard Contractual Clauses; see our Privacy Policy.
Data processing agreement
Our standard DPA covers GDPR Art. 28, SCCs (Module 2, 2021/914) + UK Addendum, sub-processor change notification (30 days), and breach notification (72 hours). The current draft is available at /legal/dpa.md for review; institutional buyers should email [email protected] to counter-sign the executed copy.
Vulnerability disclosure
Report security issues to [email protected]. We target a 48-hour acknowledgement and 30-day fix for high-severity issues. We do not currently run a paid bug bounty.
Last updated: 2026-07-18. This page is informational and does not constitute a contract. For binding commitments, see the DPA + Subscription Agreement.