Enterprise-Grade Security by Design
Security is not an afterthought at QNNEAL — it is foundational to everything we build. Our platform is designed to meet the stringent requirements of enterprises, research institutions, and government agencies.
Infrastructure Security
QNNEAL operates on enterprise-grade cloud infrastructure with multi-region redundancy. All data is encrypted in transit using TLS 1.3 and at rest using AES-256 encryption. Our infrastructure is monitored 24/7 with automated threat detection and incident response.
Authentication & MFA
User authentication is secured with bcrypt password hashing (12 rounds), JWT token rotation (15-minute access, 7-day refresh), and account lockout after 5 failed login attempts. Multi-factor authentication (TOTP) is supported via Google Authenticator, Authy, and 1Password, with 10 single-use backup codes per user.
Role-Based Access Control (RBAC)
Four granular roles enforce the principle of least privilege: Owner (full control, billing, team management), Admin (manage users, keys, vault), Developer (create keys, use gateway), and Viewer (read-only). Per-user data isolation ensures no user can access another's credentials, configurations, or usage data.
SOC 2 Compliance Controls
Our platform implements SOC 2 CC6.1 (logical access), CC6.7 (session management), and CC7.2 (system monitoring) controls. All authentication, API key creation, role changes, and configuration modifications are tracked in an immutable audit trail. Session management allows users to view and revoke active sessions with device and IP tracking.
Comprehensive Audit Logging
Every API call, login, key creation, role change, team invite, MFA event, and configuration change is logged with timestamp, IP address, and user agent. Audit logs are retained for 90 days and available through the Settings dashboard. Enterprise customers can export logs for compliance reporting.
API Key Security
API keys use the qng_sk_ prefix format and are stored exclusively as SHA-256 hashes. Plaintext keys are shown exactly once at creation. Keys support granular permissions, revocation, and regeneration. Rate limiting protects auth endpoints: 5 logins/min, 3 registrations/min.
Vulnerability Disclosure
We welcome responsible disclosure of security vulnerabilities. If you discover a potential security issue, please report it to security@qnneal.dev. We commit to acknowledging reports within 24 hours and providing status updates throughout the resolution process.