Quvant

Trust Center.

Public materials on sub-processors, hashes, retention, and contacts live here. Each material claim stays next to its status. A ledger status is not a certification.

Quvant does not declare certifications it does not hold. The security program uses controls and principles of ISO/IEC 27001 as a reference. Quvant has not completed a SOC 2 audit. A supplier's attestation does not certify Informis Labs or Quvant.

What the Blind Validator examines is described on How it works. The Blind Validator receives the original case and the candidate conclusion, not the debate that prepared it. It is not shown that every other signal is kept out, or that the whole barrier after synthesis is verified.

For information on the DPA and on data processing, write to enterprise@quvant.app.

DPA request

For information on the DPA and on data processing, write to enterprise@quvant.app.

Request DPA →

Subprocessor List

  • MongoDB, Inc.

    Service
    Primary application database
    GDPR Basis
    DPA

  • Railway Corporation

    Service
    Backend application hosting
    GDPR Basis
    SCC

  • Redis (Railway plugin and/or Upstash per docs)

    Service
    Cache / rate-limit / session helpers
    GDPR Basis
    SCC

  • Vercel Inc.

    Service
    Landing + dashboard CDN / hosting
    GDPR Basis
    SCC

  • Lemon Squeezy (Sold through Link, LLC) — Stripe affiliate

    Service
    Merchant of Record — checkout infrastructure configured, self-serve purchase not yet active
    GDPR Basis
    SCC

  • Resend Inc.

    Service
    Transactional email
    GDPR Basis
    SCC

SHA-256, Hash-chain integrity

The SHA-256 hash-chain links exported Evidence Pack™ fields; it does not certify reasoning reproducibility. LLM models are not deterministic even at temperature 0.

Retention & Deletion

This page does not state a period for audit logs or for analysis content.

The public DPA, in draft and not in force, refers to this page as the unique public source of the schedule by category. That clause has not been changed. This page does not state a period for analysis content or for audit logs, and it does not publish a substitute number.

  • Analysis contentNo public duration for analysis content.
  • Evidence Pack™12 months, available earlier on request
  • Billing data10 years (Italian fiscal obligation)
  • Access logs12 months, then automatic deletion
  • Backup30 days rolling

Security & compliance contacts

Decision Support System

Quvant is a Decision Support System, not an autonomous decision-maker. Responsibility for the final decision rests entirely with the human operator who adopts the Evidence Pack™. Quvant produces structured adversarial documentation, not legal, financial, or regulatory compliance advice.

Claims ledger

Every public claim listed here has a ledger status. The status is the recorded status, not a certification.

No model training on customer data.

No training on customer data.

live

SHA-256 hash-chained

SHA-256 hash-chained; does not certify reasoning reproducibility.

live

Quvant's security programme takes ISO/IEC 27001 controls and principles as a reference. Documentation of implementation status is available during enterprise evaluation.

control reference

Quvant has not completed a SOC 2 audit.

in progress

To keep the previous discussion from steering the check, the Blind Validator receives the original input and the candidate conclusion, not the debate that produced it.

live

Quvant is a Decision Support System: it produces adversarial documentation to support human decision-making. The operator is responsible for the final decision.

Quvant is a Decision Support System; the final decision rests with the human operator.

live

Version 1.0, 2026-07-04 · Request DPA