How we protect
client information and systems.

Organization workspaces

Each customer organization has its own workspace, and records are scoped to that organization and the user's role in it. Qwalora support staff can enter a customer workspace only through a support session that the customer's owner or administrator has approved. Sessions are time-limited, every request made in one is recorded, and the customer can revoke access at any time. A separate emergency procedure is read-only, short-lived, needs a second approver at Qwalora and notifies the customer.

Invitation and single sign-on

Accounts are created by invitation. Sign-in runs through a dedicated identity service that can federate to the customer's identity provider. Where sign-in is federated, multi-factor authentication is enforced by the customer's identity provider, and the product does not claim to verify it.

Connector credentials

Credentials that customers provide for connectors are encrypted at rest with AES-256-GCM, are not returned through the interface or API after they are saved, and can be rotated or revoked by the customer's administrator.

Approval before action

A change to a connected system runs only against an approval for that exact change: the organization, action, target and parameters. The approval must come from someone other than the requester, it expires, and it can be used once; editing the change requires a new approval. Authorization is checked again when the change runs, and a change that fails, is unsupported or is simulated is recorded as exactly that.

Integrity, stated precisely

Audit events are linked in a per-organization hash chain and protected against edits and deletion by database triggers, and evidence packages are signed with a key held by the service once they are finalized; a finalized package cannot change, and more evidence goes into a new linked version. Both can be checked inside the product to detect alteration.

A hash or a service-held signature detects change; it does not stop a record from being deleted, and it cannot be verified independently by a third party. The database triggers stop changes made through the application; an administrator of the database itself can still remove them. Retention periods are not enforced by the product today.

Outbound only

The edge agent initiates every connection outbound over TLS and needs no inbound firewall rules. It authenticates with an agent token that the customer can rotate or revoke, and it performs read-only tasks.