Your commercial data stays yours.

Qwotra separates the private information your team needs from the customer-safe information that belongs in the proposal. This page states plainly what the product does, who processes your data, and how retention and deletion work. Everything here is a current fact, not a roadmap item.

01 - Product controls

Customer-safe output by design

Two separate outputs. Every project produces a customer proposal and a private internal job record. They are built from separate layers; the internal record never ships with the proposal.

Supplier identity stays internal. Supplier and subcontractor names, vendor quote numbers, item codes, and source costs are removed from the customer layer by construction.

Markup and margin stay internal. Your pricing rules, markup, and gross margin live only in the internal record and internal views.

Leak check before export. A final scan of the exact export checks for supplier names, source costs, quote numbers, and internal codes. A failed check blocks the export.

What an export contains. You export the customer proposal and, separately, the internal pricing summary. Your uploaded source files stay attached to the project for your team.

02 - Account and access

Access is deliberate, not default

✓Accounts are approved individually during early access, and powerful actions (export, upload, email, download) are off by default until enabled for an account.

✓Sign-in uses a password or an emailed sign-in link, with self-serve password reset. Passwords require at least 8 characters with some variety, enforced on both the form and the server, and are handled by our authentication provider; Qwotra never stores plaintext passwords.

✓Your session lives in your browser and ends when you sign out.

✓Administrative access is limited to a named allowlist (the founder), and every mutating admin API call is recorded in an append-only audit log.

Qwotra does not currently offer per-role permission tiers inside an account, and we do not claim controls we have not built.

03 - Encryption and hosting

The deployed infrastructure, plainly

✓All traffic to Qwotra is encrypted in transit (HTTPS/TLS).

✓The application is hosted on Netlify. The database, authentication, and file storage run on Supabase.

✓Every account's data is isolated with database-level row security.

✓Uploaded vendor quote files live in private, account-scoped storage buckets; download links are short-lived and signed.

✓Credentials and API keys are held in the hosting provider's environment configuration, never in source code.

✓The database is backed up daily, and we keep independent backups on a schedule that prunes anything older than 90 days.

✓Our providers may store or process data in the United States and other regions; we do not claim Canada-only data residency.

04 - Processing providers

Who processes your data

Supabase. Database, authentication, and private file storage.

Netlify. Application hosting.

Anthropic. AI document processing for the Smart features, through its commercial API.

Stripe. Payments and billing; card numbers never touch Qwotra.

Resend. Transactional email.

Zapier. Internal notifications to the founder.

Google Workspace. Our business email.

Documents you run through the Smart features can include supplier names, costs, and pricing, and are sent to Anthropic through its commercial API to produce your results. Under Anthropic's commercial terms as of our policy date, API data is not used to train Anthropic's models without express permission, which we have not granted. Details are in the Privacy Policy.

05 - Retention and deletion

The data lifecycle, in plain terms

✓Your project data stays while your account is active.

✓You can delete projects yourself; deleting a project also removes its stored vendor files.

✓If you close your account or email a deletion request, we remove your data from the live systems promptly, and it ages out of backups on the backup cycle; no backup copy is kept longer than 90 days.

✓We never delete your data over a payment problem. A paused account keeps its data for at least 90 days so you can pay and resume or export everything, and we email you before anything further happens.

06 - Incidents and questions

A clear contact, not a black hole

✓Security contact: brent@qwotra.com. It reaches the founder directly.

✓Found a vulnerability? Report it to the same address and we will respond, investigate, and tell you what we did.

✓If we ever discover a breach affecting your data, we will notify you promptly with what we know and what we are doing, consistent with Canadian breach-notification requirements.

Reviewing Qwotra as a vendor and need documentation? Request security documentation and we will work through your checklist with you.

Clear facts beat vague reassurance.

Qwotra does not currently hold a SOC 2 or ISO certification and does not claim one. No service can promise perfect security, and we don't. What we publish here is what is actually deployed, and we keep this page current as the product evolves. The full legal detail lives in the Privacy Policy and Terms of Service.

← Back to Qwotra