KvantumCI Trust Center

The platform runs in a dedicated virtual network with separate subnet tiers. The database is reachable only from authorized service layers, which restricts lateral movement.

Managed request filtering at the edge blocks common web attack patterns before traffic reaches the platform.

Request-rate controls at the load balancer limit abusive and automated traffic.

All client traffic uses HTTPS (TLS 1.2+). Unencrypted requests are redirected to encrypted channels.

Service containers run as non-privileged users, which lowers the impact of a runtime compromise.

Frontend, API, scanning workers, BOM generation and identity run as separate services with dedicated runtime definitions, limiting the blast radius of any single component.

Scans and BOM generation run as asynchronous jobs on isolated queues, with dead-letter queues so failed jobs are contained and recoverable.

Runtime secrets are stored in a managed secrets service and injected at runtime. No secrets are kept in application code or deployment artifacts.

Identity service credentials are managed separately from application secrets, with scoped ownership.

User authentication runs on an identity provider hosted inside our own AWS environment. No third-party identity service processes your login data.

The managed database is configured with backup retention windows, scheduled maintenance and deletion protection.

User sessions are authenticated with signed tokens issued by our identity provider and validated by the API before any protected operation.

Every access decision includes organization context, keeping each customer's data logically separated on shared services.

Operations are protected by permission checks tied to user roles and assigned privileges.

Each protected API operation performs an explicit authorization check, enforcing least privilege per action.

Internal services and integrations authenticate with machine credentials separate from user identities, including BOM result submission.

API request payloads are validated against strict schemas before any business logic runs.

Source connections and metadata are verified before a scan starts, preventing unauthorized upstream processing.

Cross-origin access is explicitly limited to the KvantumCI frontend.

Billing events are verified by cryptographic signature before they are processed.

Repositories are cloned into a short-lived workspace used only during the scan. The workspace is deleted when the scan completes.

We store findings, scores and scan metadata, not repository snapshots. See Types of Data Processed.

OmniBOM uses temporary repository workspaces and cleans them up after each BOM generation job.

Integration API tokens, OAuth tokens, tenant tokens and settings are encrypted in the database with AES-256-GCM authenticated encryption and a unique random IV per value.

Verification tokens are hashed before storage, so token material is never stored in plain form.

Object storage used by the identity service is encrypted and versioned.

System logs are kept for up to 12 months and encrypted backups are purged within 90 days. See Data Minimization and Retention.

Account data is deleted within 30 days after the subscription ends.

Your code and scan data are never sent to AI or LLM services.

Data is hosted on AWS in us-east-1 (N. Virginia, United States). Dedicated EU infrastructure is available on request. See International Data Transfers.

Build and deployment pipelines get temporary cloud credentials through workload identity federation with scoped roles.

Every service image is scanned for vulnerabilities in the build pipeline before it is promoted.

Pipelines enforce linting, formatting checks and automated tests before changes ship.

All infrastructure is defined as code. Changes pass formatting, validation, linting and a reviewed plan before they are applied.

Sensitive configuration is injected at deployment or runtime, never baked into build outputs.

Production and testing environments are separated, with distinct deployment workflows and cloud targets.

All services send runtime logs to centralized cloud logging with defined retention.

Authentication requests are logged with credentials redacted.

Edge protection publishes telemetry used to review ingress anomalies and firewall activity.

Services expose health checks used to verify availability. Live status is published at status.kvantumci.com.

Security researchers can report issues to us directly. See Report a vulnerability.