Security at QuickSecure
How we protect your data, what we're working towards, and how to report a vulnerability to us.
How We Keep Your Data Safe
Multiple layers of security protecting your vulnerability data and infrastructure information.
Encryption in Transit and at Rest
All data is encrypted in transit using TLS 1.2 or higher (TLS 1.3 where supported) and at rest using AES-256 encryption.
Secure Authentication
Multi-factor authentication (MFA) is available on every account.
Hardened Cloud Infrastructure
The platform is hosted on AWS in Sydney (ap-southeast-2), with AI analysis on AWS Bedrock kept within Australia (Sydney or Melbourne), network segmentation, least-privilege service roles, and managed services.
Audit Logging
Audit trails of user actions and system events for compliance and security monitoring.
Regular Backups
Automated encrypted backups of platform data.
Testing Our Own Platform
We regularly test our own platform with the same tooling we offer customers.
Working Towards Industry Standards
We're working towards formal certification, starting with ISO 27001.
ISO 27001
Coming Soon
We are working towards ISO 27001 certification for our information security management system.
Privacy by Design
We collect only what we need and protect what we keep.
Secure Development
Our development process follows recognised secure software development practices.
Security Vulnerability Reporting
Found a security issue? We appreciate responsible disclosure.
How to Report
If you discover a security vulnerability in QuickSecure, please report it through our contact form or by email:
Report via the contact form - select "Security report"
Or email hello@quicksecure.io. Our contact details are also published at /.well-known/security.txt.
Please include:
- Description of the vulnerability
- Steps to reproduce the issue
- Potential impact assessment
- Any proof-of-concept code (if applicable)
Disclosure Guidelines:
- Only test against accounts and data you own, or have explicit permission to access
- Do not access, modify, or delete other customers' data - stop and report as soon as you encounter it
- Do not run denial-of-service, social engineering, spam, or physical attacks
- Avoid automated testing at volumes that degrade the service for others
- Give us a reasonable time to fix the issue before disclosing it publicly
Our Commitment:
- We aim to acknowledge reports within 2 business days
- We will keep you informed of our progress
- We will credit you for the discovery (if desired)
- We will not pursue legal action against researchers who act in good faith and follow the disclosure guidelines on this page
Questions About Our Security?
Contact our security team, or sign up and see how we protect your data firsthand.