QuantSec

QUANTUM SECURITY ASSURANCE

QUANTUM SECURITY ASSURANCE

[SECURITY]

Security at QuantSec

Close-up of a processor die glowing amber on a dark circuit board, representing how QuantSec protects client data and signs its reports

Our clients trust us with sensitive information about their systems. This page explains how we handle it, how our reports are signed and how to tell us about a security issue.

01

How we handle your data

  • We agree the scope of every assessment in writing before we start, and only access what that scope requires.

  • We use the information you share only to deliver the engagement you have asked for.

  • Access to client data is limited to the people working on your engagement.

  • We agree how long data is kept and how it is returned or deleted as part of each engagement.

If you need more detail for a security review or supplier questionnaire, email [email protected].

02

How our reports are signed

Every QuantSec report is digitally signed. The signature links the report’s contents to QuantSec, so anyone who receives a copy can check that it is authentic and has not been changed since it was issued. To verify a report, use our Verify page, which checks in your browser that the signature matches the report’s content. The QuantSec registry lists published profiles and reports and is not used for verification. If a report cannot be verified, do not rely on it and let us know.

Every QuantSec report is digitally signed. The signature links the report’s contents to QuantSec, so anyone who receives a copy can check that it is authentic and has not been changed since it was issued. To verify a report, use our Verify page, which checks in your browser that the signature matches the report’s content. The QuantSec registry lists published profiles and reports and is not used for verification. If a report cannot be verified, do not rely on it and let us know.

03

Reporting a vulnerability

If you believe you have found a security vulnerability in a QuantSec website, service or report, please email [email protected] with a description of the issue, the steps to reproduce it and any supporting material.

When researching and reporting, please:

  • Give us reasonable time to investigate and fix the issue before sharing it publicly.

  • Avoid accessing, changing or deleting data that does not belong to you.

  • Avoid testing that could degrade our services, such as denial of service, and do not use social engineering or physical attacks.

  • Keep the details of the issue confidential until we have agreed a disclosure date.

We will acknowledge your report, keep you informed as we investigate and let you know when the issue is resolved. We will not pursue action against anyone who reports an issue in good faith and follows this policy.