> ## Documentation Index
> Fetch the complete documentation index at: https://docs.qwoty.io/llms.txt
> Use this file to discover all available pages before exploring further.

# Security & compliance

> Learn about Qwoty’s security practices and compliance standards.

## Security Practices

<AccordionGroup>
  <Accordion title="Development Security">
    * **Code review**: All code changes require review before merging
    * **Dependency management**: Dependencies are regularly updated and monitored for vulnerabilities
    * **Static analysis**: Automated security scanning is part of the CI/CD pipeline
    * **Penetration testing**: Regular vulnerability assessments and penetration tests are conducted
  </Accordion>

  <Accordion title="Access Controls">
    * **Role-based access**: Teams support member, manager, and admin roles with distinct permissions
    * **API token scoping**: API tokens can be scoped to specific teams and set with expiration dates
    * **Session management**: Users can view and revoke active sessions
    * **Audit logging**: Document actions are logged with timestamps and IP addresses
  </Accordion>
</AccordionGroup>

***

## Infrastructure Security

The Qwoty cloud service uses the following security measures:

| Layer          | Implementation                                                    |
| -------------- | ----------------------------------------------------------------- |
| **Hosting**    | AWS infrastructure hosted in EU data centers (Ireland, Paris)     |
| **Network**    | TLS 1.2+ for all connections                                      |
| **Database**   | Managed database with automated backups and geographic redundancy |
| **Storage**    | AES-256 encrypted object storage for documents                    |
| **Monitoring** | 24/7 infrastructure monitoring and alerting                       |
| **Updates**    | Regular security patches applied to all infrastructure            |

***

## Data Encryption

<AccordionGroup>
  <Accordion title="Encryption in Transit">
    All data transmitted to and from Qwoty is encrypted using TLS 1.2 or higher. This includes:

    * Web application traffic
    * API requests
    * Email delivery (when supported by the receiving server)
    * Webhook payloads
  </Accordion>

  <Accordion title="Encryption at Rest">
    For Qwoty Cloud:

    * Database contents are encrypted at rest using AES-256
    * Document storage uses encrypted object storage
    * Backups are encrypted with geographic redundancy
    * Encryption keys are managed with regular key rotation
  </Accordion>
</AccordionGroup>

***

## Authentication Security

### Supported Authentication Methods

| Method                        | Description                                      |
| ----------------------------- | ------------------------------------------------ |
| **Email and password**        | Traditional authentication with hashed passwords |
| **OAuth providers**           | Google and Microsoft authentication              |
| **Team SSO**                  | SAML-based single sign-on for enterprise teams   |
| **Two-factor authentication** | TOTP-based 2FA with recovery codes               |

### Password Requirements

* Minimum length enforced
* Passwords are hashed using bcrypt before storage
* Password reset tokens are time-limited and single-use

### Session Security

* Sessions can be viewed and revoked from account settings
* Session tokens are rotated on authentication events
* Idle sessions expire after a configurable period

***

## Vulnerability Disclosure

Qwoty operates a responsible disclosure process for security vulnerabilities.

<AccordionGroup>
  <Accordion title="Reporting a Vulnerability">
    If you discover a security vulnerability, please report it by emailing:

    [**security@qwoty.io**](mailto:security@qwoty.io)

    Include the following information:

    * Description of the vulnerability
    * Steps to reproduce
    * Potential impact
    * Any suggested fixes (optional)
  </Accordion>

  <Accordion title="Response Timeline">
    | Stage                 | Timeline            |
    | --------------------- | ------------------- |
    | **Acknowledgment**    | Within 48 hours     |
    | **Initial triage**    | Within 5 days       |
    | **Status update**     | Within 10 days      |
    | **Resolution target** | Depends on severity |
  </Accordion>

  <Accordion title="Scope">
    <Tabs>
      <Tab title="In scope">
        * Qwoty application code
        * Authentication and authorization flaws
        * Data exposure vulnerabilities
        * Injection vulnerabilities
        * Cross-site scripting (XSS)
        * Cross-site request forgery (CSRF)
      </Tab>

      <Tab title="Out of scope">
        * Social engineering attacks
        * Denial of service attacks
        * Issues in third-party dependencies (report to the upstream project)
        * Issues requiring physical access to a user's device
        * Theoretical vulnerabilities without proof of concept
      </Tab>
    </Tabs>
  </Accordion>

  <Accordion title="Recognition">
    We acknowledge security researchers who responsibly disclose vulnerabilities. With your permission, we will credit you when the fix is released.
  </Accordion>
</AccordionGroup>

<Warning>
  Do not publicly disclose vulnerabilities until they have been addressed. Public disclosure of unpatched vulnerabilities puts users at risk.
</Warning>

***

## Security Updates

### Notification

Security updates are announced through:

* The [Qwoty changelog](https://qwoty.io/changelog)
* Direct email notification to affected customers when relevant

### Update Policy

* Critical vulnerabilities are patched as quickly as possible
* Release notes include all security-related changes

***

## Contact

For security-related inquiries:

* **Security vulnerabilities**: [security@qwoty.io](mailto:security@qwoty.io)
* **General questions**: [contact@qwoty.io](mailto:contact@qwoty.io)
* **Mailing address**: DOYE SAS, 18 rue Vignon, 75009 Paris, France

***