Request a demo

Security and Data Handling

Your commercial data stays yours.

Qwotra separates the private information your team needs from the customer-safe information that belongs in the proposal. See what the product does, who processes your data, and how retention and deletion work.

Last reviewed

Download security summary

Plain-language data flow

From source document to customer proposal

Source files stay in private account storage. Smart processing happens only when you run that feature. The result returns to the private working record, where a person reviews it before the customer-safe proposal can leave.

  1. 1

    Source documents

    RFP and quote files

  2. 2

    Private storage

    Supabase account scope

  3. 3

    Smart processing

    OpenAI, only when run

  4. 4

    Human review

    Approval and leak check

  5. 5

    Customer proposal

    Private details removed

01 Product controls

Customer-safe output by design

Two separate outputs. Every project produces a customer proposal and a private internal job record. They are built from separate layers. The internal record never ships with the proposal.

Supplier identity stays internal. Supplier and subcontractor names, vendor quote numbers, item codes, and source costs are removed from the customer layer by construction.

Markup and margin stay internal. Your pricing rules, markup, and gross margin live only in the internal record and internal views.

Leak check before export. A final scan of the exact export checks for supplier names, source costs, quote numbers, and internal codes. A failed check blocks the export.

02 Account and access

Access is deliberate

✓Account access is approved individually. Powerful actions (export, upload, email, download) are off by default until enabled.

✓Sign-in uses a password or an emailed sign-in link, with self-serve reset. Password rules are enforced on the form and the server, handled by our authentication provider. Qwotra never stores plaintext passwords.

✓Roles are enforced at the database: owner, admin, estimator, sales, approver, viewer. Source-cost visibility follows role rules.

✓Administrative access is restricted to named individuals, and every mutating administrative API call is recorded in an append-only audit log.

03 Encryption and hosting

Encryption and hosting

✓All traffic to Qwotra is encrypted in transit (HTTPS/TLS).

✓The application, database, authentication, and file storage run on established commercial cloud platforms.

✓Every account's data is isolated with database-level row security.

✓Uploaded vendor quote files live in private, account-scoped storage. Download links are short-lived and signed.

✓Credentials and API keys are held in environment configuration, never in source code.

✓The database is backed up daily. Independent backups are pruned at 90 days.

✓Our providers may store or process data in the United States and other regions. We do not claim Canada-only data residency.

04 Processing providers

Who processes your data

Qwotra uses established commercial service providers for:

✓Application hosting

✓Database, authentication, and private document storage

✓AI-assisted document processing, through a commercial API

✓Payments and billing (card numbers never touch Qwotra)

✓Transactional email and business communications

Netlify

Application hosting

Netlify security, opens in a new tab

Supabase

Database, authentication, and private document storage

Supabase security, opens in a new tab

OpenAI

AI-assisted document processing through a commercial API

OpenAI security and compliance, opens in a new tab

Stripe

Payments and billing. Card numbers never touch Qwotra.

Stripe security, opens in a new tab

Resend

Transactional email and business communications

Resend security, opens in a new tab

Documents you run through the Smart features can include supplier names, costs, and pricing, and are sent to our AI provider through its commercial API to produce your results. Under that provider's commercial terms as of our policy date, API data is not used to train its models without express permission, which we have not granted, and your data is not used to train public or third-party general-purpose models. Details are in the Privacy Policy. The current subprocessor list is available through our security-review process or a data-processing agreement.

05 Retention and deletion

The data lifecycle, by category

✓Raw customer data stays while your account is active. Deleting a project also removes its stored vendor files.

✓Raw data is removed from live systems within 30 days of account closure or a verified deletion request. Any export opportunity falls within that same 30-day period. No backup copy is kept longer than 90 days.

✓Customer-linked records (account, billing, acceptance, audit) are kept as long as the law and the signed agreement require. Protected aggregate information that cannot reasonably identify or reconstruct your business may be retained as stated in the Terms and Privacy Policy.

✓We never delete your data over a payment problem. A paused account keeps its data for at least 90 days so you can pay and resume or export everything, and we email you before anything further happens.

Qwotra data retention by category
Data categoryWhile activeAfter deletion or closure
Raw customer and project dataKept while the account is active. Deleting a project also removes its stored vendor files.Raw data is removed from live systems within 30 days of account closure or a verified deletion request. Any export opportunity falls within that same 30-day period.
Independent backupsDatabase backups run daily.No backup copy is kept longer than 90 days.
Account, billing, acceptance and audit recordsKept while needed to operate the account.Kept as long as the law and the signed agreement require.
Protected aggregate informationCannot reasonably identify or reconstruct your business.May be retained as stated in the Terms and Privacy Policy.

06 Incidents and questions

Security contact and incident response

✓Security contact: brent@qwotra.com. It reaches the founder directly.

✓Found a vulnerability? Report it to the same address and we will respond, investigate, and tell you what we did.

✓If we ever discover a breach affecting your data, we will notify you promptly with what we know and what we are doing, consistent with Canadian breach-notification requirements, and we keep the records those requirements demand.

Reviewing Qwotra as a vendor and need documentation? Request security documentation and we will work through your checklist with you.

For a direct security question, email brent@qwotra.com.

07 Firm boundaries

What we will not do

✓Use your data to train public or third-party general-purpose models.

✓Show internal pricing to suppliers or customers.

✓Send or release anything without a person approving it.

✓Claim a security certification Qwotra does not hold.

Clear facts beat vague reassurance.

Qwotra does not currently hold a SOC 2 or ISO certification and does not claim one. No service can promise perfect security, and we don't. What we publish here is what is actually deployed, and we keep this page current as the product evolves. The full legal detail lives in the Privacy Policy and Terms of Service.

North America's independent capital equipment platform.

Build your independent advantage.

Discover how Qwotra helps your team protect margin, deliver the customer promise and carry every result into the next decision.