At Quixyl, security is not an afterthought—it's the foundation of everything we build. We understand that
you're trusting us with sensitive business documents and financial data, and we take that responsibility
seriously. This Security Policy outlines our comprehensive approach to protecting your data and
maintaining the highest security standards.
Our Security Commitment
We employ 256-bit encryption, follow industry best practices, and maintain enterprise-grade security
standards to ensure your data remains secure, private, and always under your control.
1. Data Encryption
1.1 Encryption in Transit
All data transmitted between your browser and our servers is encrypted using TLS 1.3 (Transport Layer Security), the latest and most secure encryption protocol. This includes:
API requests and responses
Document uploads and downloads
Authentication and session management
Webhook delivery
All web application traffic
We enforce HTTPS across all our domains and subdomains with HSTS (HTTP Strict Transport Security) to prevent protocol downgrade attacks.
1.2 Encryption at Rest
Your uploaded documents and extracted data are encrypted at rest using AES-256 encryption, the same military-grade encryption used by banks and government agencies. This applies to:
Document Storage: All uploaded PDFs, images, and documents are encrypted
in our secure cloud storage (Cloudflare R2)
Database Records: Extracted data, user information, and metadata stored
in our PostgreSQL database (Neon) are encrypted
Backups: All database backups are encrypted and stored in geographically
distributed locations
Temporary Files: Any temporary processing files are encrypted and automatically
deleted after processing
1.3 Key Management
Encryption keys are managed using industry-standard key management practices:
Keys are rotated regularly according to security best practices
No single person has access to all encryption keys
Keys are stored separately from encrypted data
Access to key management systems requires multi-factor authentication
2. Infrastructure Security
2.1 Cloud Infrastructure
Our infrastructure is built on enterprise-grade cloud platforms with industry-leading security:
Application Hosting: Deployed on Coolify with containerized architecture
for isolation and security
Database: Neon PostgreSQL with built-in encryption, automated backups,
and connection pooling
Object Storage: Cloudflare R2 for secure, redundant document storage
GDPR requirements: Data protection and privacy for European customers
CCPA compliance: California Consumer Privacy Act standards
PCI DSS: Payment security through Stripe's certified infrastructure
ISO 27001 frameworks: Information security management best practices
Certification In Progress
We are actively working towards SOC 2 Type II certification. Our infrastructure and policies are
designed to meet these rigorous standards. For Enterprise customers requiring formal certification,
please contact our team to discuss timelines and requirements.
6. Security Monitoring & Incident Response
6.1 Continuous Monitoring
We maintain 24/7 security monitoring to detect and respond to threats:
Real-Time Alerts: Automated alerting for suspicious activities
Log Analysis: Centralized logging and analysis of all system events
Intrusion Detection: Automated detection of unauthorized access attempts
Uptime Monitoring: 99.9% uptime SLA with real-time status page
Performance Monitoring: Detection of anomalies that could indicate security
issues
6.2 Vulnerability Management
We proactively identify and address security vulnerabilities:
Regular vulnerability scanning of infrastructure and applications
Automated dependency updates for security patches
Quarterly penetration testing by third-party security firms
Bug bounty program for responsible disclosure
Critical vulnerabilities patched within 24 hours
6.3 Incident Response
In the unlikely event of a security incident, we have a comprehensive response plan:
Immediate Response: Security team notified immediately upon detection
Incident Containment: Rapid isolation and containment of affected systems
Customer Notification: Affected customers notified within 72 hours
Root Cause Analysis: Thorough investigation and remediation
Post-Incident Review: Process improvements to prevent recurrence
Transparent Communication: Regular updates via status page and email
6.4 Audit Logging
Comprehensive audit trails are maintained for security and compliance:
All user authentication and authorization events
Document uploads, downloads, and deletions
API access and usage patterns
Administrative actions and configuration changes
Logs retained for 90 days (Pro) or 1 year (Enterprise)
7. Employee Security & Access Control
7.1 Employee Background Checks
All employees with access to customer data undergo:
Comprehensive background checks before employment
Signed confidentiality and data protection agreements
Regular security awareness training
Annual security policy reviews and acknowledgments
7.2 Access Control
Employee access to systems and data is strictly controlled:
Principle of Least Privilege: Employees only have access to data necessary
for their role
Multi-Factor Authentication: Required for all system access
Access Reviews: Quarterly reviews of employee access permissions
Immediate Revocation: Access removed immediately upon termination
Audit Trails: All employee access to customer data is logged
7.3 Customer Data Access
We never access your data without explicit permission, except:
When you request technical support and grant permission
To investigate and resolve reported issues
As required by law or legal process
To prevent or address security incidents
All customer data access is logged and reviewed by our security team.
8. Physical & Environmental Security
8.1 Data Center Security
Our infrastructure runs in enterprise-grade data centers with:
24/7 on-site security personnel
Biometric access controls
Video surveillance and monitoring
Redundant power supplies and cooling systems
Fire suppression systems
Geographic redundancy for disaster recovery
8.2 Business Continuity
We maintain comprehensive business continuity and disaster recovery plans:
Automated Backups: Continuous database backups with point-in-time recovery
Geographic Redundancy: Data replicated across multiple regions
Failover Systems: Automatic failover for critical services
Recovery Time Objective (RTO): 4 hours for critical systems
Recovery Point Objective (RPO): 1 hour maximum data loss
We may update this Security Policy to reflect changes in our security practices or regulatory
requirements. Material changes will be communicated via:
Email notification to registered users
Prominent notice on our website
In-app notifications
Your Trust, Our Priority
Security isn't just a technical requirement—it's a promise. We're committed to earning and maintaining
your trust through transparent security practices, continuous improvement, and unwavering dedication to
protecting your data. If you have any questions or concerns about our security measures, our team is
always here to help.