Trust Center
Everything a procurement officer or a CISO wants to know in 5 minutes.
For teams operating in DORA, NIS2, EU AI Act and high-responsibility internal-policy contexts.
Quvant does not claim certifications it does not hold.
Quvant's security programme takes ISO/IEC 27001 controls and principles as a reference. Documentation of implementation status is available during enterprise evaluation.
DPA request
To formalize a Data Processing Agreement with Informis Labs, write to enterprise@quvant.app. Response within 2 business days.
Subprocessor List
| Provider | Service | GDPR Basis |
|---|---|---|
| MongoDB, Inc. | Primary application database | DPA |
| Railway Corporation | Backend application hosting | SCC |
| Redis (Railway plugin and/or Upstash per docs) | Cache / rate-limit / session helpers | SCC |
| Vercel Inc. | Landing + dashboard CDN / hosting | SCC |
| Lemon Squeezy (Sold through Link, LLC) — Stripe affiliate | Merchant of Record / self-serve payments | SCC |
| Resend Inc. | Transactional email | SCC |
SHA-256, Hash-chain integrity
The SHA-256 hash-chain links exported Evidence Pack™ fields; it does not certify reasoning reproducibility. LLM models are not deterministic even at temperature 0.
Retention & Deletion
- Analysis content7 years (DORA Art. 17), deletion on request, subject to retention obligation
- Evidence Pack™12 months, available earlier on request
- Billing data10 years (Italian fiscal obligation)
- Access logs12 months, then automatic deletion
- Backup30 days rolling
Security & compliance contacts
- Security reportssecurity@quvant.app
- DPA / enterprise complianceenterprise@quvant.app
- Incident notification(response within 24h)
Decision Support System
Quvant is a Decision Support System, not an autonomous decision-maker. Responsibility for the final decision rests entirely with the human operator who adopts the Evidence Pack™. Quvant produces structured adversarial documentation, not legal, financial, or regulatory compliance advice.
Claims ledger
Every public claim Quvant makes, with its honest status and the allowed wording. The ledger is the single source of truth: the site cannot show a claim it does not back.
Data Processing Agreement covering GDPR Art. 28 processor obligations, available and ready to sign on request.
DPA covering GDPR Art. 28 processor obligations, ready to sign.
liveEU AI Act Art. 9 self-assessment completed; not equivalent to third-party conformity assessment.
EU AI Act Art. 9 self-assessment completed (self-assessment, not certification).
self-assessedSHA-256 hash-chained
SHA-256 hash-chained; does not certify reasoning reproducibility.
liveNo model training on customer data.
No training on customer data.
liveAudit log retention 7 years (DORA Art. 17).
liveInfrastructure sub-processors (Railway, Vercel, Resend) hold SOC 2 Type II certification; Quvant inherits that posture, does not own it.
SOC 2 Type II sub-processors (Railway, Vercel, Resend); Quvant inherits the posture.
via providerSHA-256 hash-chained
SHA-256 hash-chained; does not certify reasoning reproducibility.
liveQuvant's security programme takes ISO/IEC 27001 controls and principles as a reference. Documentation of implementation status is available during enterprise evaluation.
control referenceQuvant has not completed a SOC 2 audit.
in progressTo keep the previous discussion from steering the check, the Blind Validator receives the original input and the candidate conclusion, not the debate that produced it.
liveQuvant is a Decision Support System: it produces adversarial documentation to support human decision-making. The operator is responsible for the final decision.
Quvant is a Decision Support System; the final decision rests with the human operator.
liveVersion 1.0, 2026-07-04 · Request DPA