Your customers’ words, kept safe

Infrastructure security

Qintr's application and database run on Railway. Data in our database is encrypted at rest and in transit, with automatic backups. Uploaded media is stored on Cloudflare R2 — not on the application server's local disk.

Application security

• All user input is validated and sanitised server-side
• Database queries use parameterised statements
• CSRF protection on authenticated endpoints
• Rate limiting and bot detection on public forms
• Dependencies are reviewed for known vulnerabilities
• Workspace-level isolation: every query is scoped to the authenticated user's organization
• Error reports sent to Sentry have form answers, cookies, names, emails and IP addresses removed

AI features

AI features are off unless a workspace switches them on. When they run, only the questions and the answer text go to the AI model (Anthropic's Claude), never the names, emails or companies we hold about people.

Payments

Self-serve plans are paid through Paddle, our Merchant of Record. Card details go straight to Paddle, a PCI DSS compliant payment provider. Qintr never sees or stores card numbers. Scale plans and custom contracts are paid by bank transfer against our invoice.

Responsible disclosure

Report to security@qintr.com with description, impact, and reproduction. We acknowledge within 48 hours. Don't access other people's data or run denial-of-service tests.

Incident response

In a confirmed breach affecting personal data, we'll notify affected customers and relevant authorities within 72 hours of becoming aware.