Security

Updated October 30, 2026

We design, build and operate our own hardware, data centers and software. That gives us control over security at every layer, from the physical site to the API. This page summarises our practices; customers can request more detail under NDA.

Infrastructure

  • QIT Pods run in access-controlled sites with perimeter security, video surveillance and logged physical access.
  • Servers are provisioned from hardened, minimal images with secure boot. Firmware and BIOS are managed and updated by our team.
  • Production networks are segmented; management interfaces are not reachable from the internet.
  • Public endpoints are protected by DDoS mitigation and a web application firewall.

Data protection

  • All traffic to the API and console is encrypted with TLS 1.2 or higher, with HSTS enforced.
  • Data at rest is encrypted with AES-256.
  • Customer workloads are isolated per tenant. Serverless containers run in sandboxed environments with no access to other customers’ data.
  • Customer Content is never used to train models. Zero Data Retention is available for enterprise workloads.
  • EU and US data residency is available for compute workloads.

Access control

  • Employee access to production follows least privilege, requires SSO with hardware-backed MFA, and is logged and reviewed.
  • Customers can enforce SSO via SAML, configure MFA, scope API keys and rotate them at any time.

Application security

  • All code changes are peer reviewed and pass automated tests and dependency scanning before deployment.
  • We run regular internal security reviews and engage independent firms for penetration testing.

Monitoring and incident response

We monitor systems around the clock with alerting on anomalous activity. Our incident response process covers detection, containment, eradication, recovery and post-incident review. We notify affected customers of personal data breaches as described in our DPA.

Business continuity

Models are preloaded across multiple regions, and requests are rerouted automatically when a pod or region degrades. Account and configuration data is backed up and restoration is tested regularly. Our availability commitment is described in the SLA.

Reporting a vulnerability

If you believe you have found a security vulnerability, email hello@qit.energy with “Security report” in the subject. Please include steps to reproduce and give us reasonable time to fix the issue before disclosure. We will not take legal action against researchers who act in good faith, avoid privacy violations and service disruption, and do not access more data than necessary to demonstrate the issue.