Home / Security
Security
How this website is protected, how the product is designed to limit what it can touch, and where to report a problem.
This website
- It is served only over HTTPS. Requests over plain HTTP are redirected, and HTTP Strict Transport Security is on.
- A Content Security Policy limits where scripts, styles, fonts, images and frames can load from. The third-party scripts are the Calendly scheduler and Umami visit statistics; fonts come from Google Fonts. There are no advertising scripts.
- Framing by other sites is blocked, content-type sniffing is disabled, and the referrer and permissions policies are restricted.
- The site's storage is private and reachable only through its content delivery network.
The product's design
These are the design commitments already published on this site.
- No agents on hosts. Quantlyx runs with read-only credentials to the systems it is connected to.
- Nothing leaves your tenant, and nothing is written back unless a person approves a QuantQFix action.
- QuantQFix runs under a credential scoped to one action. Someone other than the proposer approves it, and production or critical cases need two approvals.
- Each proposal, approval and action is recorded in a hash-chained trail.
Report a problem
If you believe you have found a vulnerability in this website, email Info@quantlyxsecurity.com with the address, the steps to reproduce it and what you saw. Please do not access data that is not yours, and do not disrupt the site while you test.