Qualflare Security Policy

This policy covers qualflare.com and its subdomains, our web application, and our API.

Qualflare's security program is guided by the CIS Critical Security Controls, a prioritized set of safeguards maintained by the Center for Internet Security (CIS) and adopted widely across the security community. The sections below describe how we apply that framework, what our CIS Controls Supporter status and CSA STAR Level One listing do and do not mean, what we do and do not have in the way of third-party certification, and how to report a vulnerability if you find one.

We use the CIS Critical Security Controls as the general structure for our security program — as a reference framework, not a specific, audited Implementation Group baseline. In practice, that maps onto measures we already document in detail in our Privacy Notice and DPA Annex 2:

• Data protection. All connections to the Services use TLS 1.2 or higher; customer data is stored in encrypted databases and object storage.
• Account and access control management. Role-based access control inside the application, least-privilege access for Qualflare employees, and mandatory single sign-on and multi-factor authentication for production systems.
• Secure configuration of enterprise assets and software. Our cloud infrastructure and server configuration are hardened against CIS Benchmarks, the configuration guides published by the Center for Internet Security.
• Continuous vulnerability management. Automated dependency scanning and patching of known vulnerabilities, plus the public vulnerability-disclosure process described below.
• Audit log management. Security-sensitive actions are recorded in an immutable audit log retained for at least 365 days.
• Secure software development. Code review on every change to production code, plus automated security testing.
• Incident response management. Documented procedures for detecting, containing, and reporting security incidents.
• Service provider management. We assess each sub-processor before engagement and reassess on a regular cadence.
• Security awareness and training. All employees are bound by confidentiality obligations and receive privacy and security training.

Full technical detail lives in DPA Annex 2 — Technical and Organisational Measures.

Qualflare is listed as a CIS Controls Supporter. It's worth being precise about what that status is and isn't: it's a public commitment to help promote awareness and voluntary adoption of the CIS Controls across the security community. It is not a third-party audit or certification of Qualflare itself, and we don't represent it as one.

Qualflare OÜ is listed in the CSA STAR Registry at Level One, published 23 August 2026. The listing is our completed Consensus Assessments Initiative Questionnaire (CAIQ v4.1), which answers the Cloud Security Alliance's Cloud Controls Matrix question by question for the Qualflare platform.

As with the CIS status above, it's worth being precise about what Level One is and isn't. It is a self-assessment we publish ourselves — CSA hosts the answers and makes them public, but does not verify them. Level Two is the tier that adds an independent third-party audit, and we do not hold it. What Level One gives you is transparency: the answers are on the record, under our name, and you can hold us to them.

Qualflare does not currently hold a SOC 2 Type II or ISO 27001 certification. We intend to pursue independent third-party attestation as the company grows, and will make any resulting report available under confidentiality.

Physical data-centre security is provided by our infrastructure sub-processors — Google Cloud and Cloudflare — which operate ISO 27001-certified facilities. That certification is theirs, not ours; Qualflare does not operate its own data centre.

None of the above — the CIS Controls Supporter status, our use of the CIS Controls as a reference framework, or the CSA STAR Level One self-assessment — is a certification or a substitute for one. We're describing a security program, not claiming an audited outcome.

Email legal@qualflare.com with a description of the issue, the steps to reproduce it, and its potential impact. Proof-of-concept code or a screen recording helps us triage faster.

Please don't open a public GitHub issue, post about the issue publicly, or test against accounts other than your own. Give us a reasonable window to investigate and address a report before disclosing it publicly.

We read every report that comes in to this address and will acknowledge it. Confirmed issues are prioritized by severity and impact; we'll let you know once a fix is out, or if we've assessed the report as out of scope or not a vulnerability.

We won't pursue legal action against anyone who makes a good-faith effort to find and report a vulnerability in accordance with this policy, including:

• Avoiding privacy violations and disruption to others
• Not accessing, modifying, or deleting data that isn't your own
• Avoiding actions that could degrade the service for other users (e.g. denial of service)
• Giving us a reasonable amount of time to resolve an issue before any public disclosure

Report a vulnerability, or ask a question about this policy, at legal@qualflare.com. This is also the contact address published in our security.txt file.